The discussions on international law have shown little progress in drawing closer between the positions. The states have made suggestions on how to capture the progress of the OEWG 2021-2025 in its Final Report and shared opinions on the structure and content of discussions on international law within the future permanent mechanism.
The persistent rift: The need for a new legally binding framework
In the substantive positions of the states on international law, the rift remains between the states that do not see a need for a new legally binding framework and those that do.
The majority of states (Sweden, the EU, the Republic of Korea, the UK and others) do not see the need for a new legally binding framework and emphasise the need to discuss the application of existing international law in cyberspace. In rushing to discuss new legally binding obligations, the UK sees the risk of undermining the application of core, foundational rules of international law, including the UN Charter.
Cuba, China, Russia, Pakistan, and the Islamic Republic of Iran reiterated their positions, stating that the new legally binding mechanism is necessary to prevent interstate conflicts in cyberspace and to contribute to strengthening cooperation in this area. China has supported the Russian Draft Convention on International Information Security as a good basis for discussions. At the same time, Pakistan and Iran stated that there are gaps in international law that need to be addressed by binding rules.
Despite the Chairs’ call to states to find flexibility in their statements in December 2024 and time pressure, the statements on both sides are repeats of the positions voiced in the past substantive sessions.
These differences directly translate to the language that the states were proposing to be included in the 2021-2025 OEWG Final Report, as well as positions on how to structure the Future Permanent Mechanism.
Final Report: How to best reflect progress
States have discussed the proposals on how to best reflect the progress in the 2021-2025 OEWG on international law in its Final Report, as it will serve as a summary of the efforts, positions, and basis for the negotiations within the future permanent mechanism.
The states predominantly concluded that the OEWG was a successful process and contributed to a greater understanding of international law in cyberspace. Specifically, states (Austria, Sweden, Brazil, Senegal, Canada, Thailand, Czechia, EU, Vanuatu, Switzerland, Australia, Germany and others) saw progress in a number of published national and regional positions on the applicability of international law in cyberspace in the course of the 2021-2025 OEWG.
There were also specific wording suggestions for inclusion in the Final Report. The Joint Statement on International Law (Australia, Chile, Colombia, the Dominican Republic, El Salvador, Estonia, Fiji, Kiribati, Moldova, the Netherlands, Papua New Guinea, Thailand, Uruguay and Viet Nam) gained support from Czechia, Canada, Switzerland, United Kingdom, Republic of Moldova, Ireland, and others. The re-published paper, now with more co-sponsors, offers a convergence language for the Final Report that includes peaceful settlement of disputes, respect for international human rights obligations, the principle of state responsibility, and application of international humanitarian law to ICT activities during armed conflicts.
Another wave of proposals was focused on including a clear reference to the applicability of international humanitarian law and the fundamental legal principles of humanity, neutrality, necessity, proportionality, and distinction in the Final Report, supported by Sweden, the USA, the Republic of Korea, Malawi, Senegal, the EU, Tonga on behalf of the Pacific Island Forum, Australia, Germany, Republic of Moldova, Ireland, Ghana, Austria, and others. Just like in the 9th OEWG substantive session in December 2024, the Resolution on protection for the civilian population against the humanitarian consequences of the misuse of digital technologies in armed conflict within the framework of the 34th International Red Cross and Red Crescent Conference resonated with the states.
Brazil has referred explicitly to the Operative Paragraph 4 of that Resolution (‘states recalled that in situations of armed conflict, international humanitarian law rules and principles serve to protect civilian populations and other protected persons and objects, including against the risks arising from ICT activities’) to be included in the Final Report. Canada, France, Netherlands, Czechia, and others supported this proposal.
Switzerland, which sees the inclusion of the applicability of international humanitarian law as a priority, has also proposed a specific wording for the Final Report that builds on the 34th ICRC resolution and includes medical and humanitarian facilities.
States also called for stronger wording on the applicability of human rights law (Australia, Albania, Malawi, Mexico, Mozambique, Moldova, North Macedonia, Senegal, Switzerland, Thailand, and Germany) in the Final Report.
Cuba and Iran believe the Final Report should include references on setting up a legally binding instrument, and definitions of terms and technical mechanisms.
The future permanent mechanism: How to tackle international law
States further discussed ways that the discussions on international law would be incorporated and framed within the Future Permanent Mechanism.
States reflected on Annex C of the Chair’s Discussion Paper on Draft Elements on Stakeholder Modalities and Dedicated Thematic Groups of the Future Permanent Mechanism, which proposed a dedicated thematic group on rules, norms and principles of responsible state behaviour and on international law. Mexico, Colombia, Indonesia, and Algeria endorsed the thematic group dedicated both to norms and international law, as they see these as complementary and contributing to safety and security.
Canada proposed integrating international law into each of the first three thematic working groups set out in the Chairs’ discussion paper (building resilience, enhancing cooperation in the management of ICT-related incidents, including through CBMs, and preventing conflict and increasing stability in the ICT sphere) to build common understandings on how international law applies to practical policy challenges. Thematic group meetings could include expert briefings on technical and legal topics and scenario-based discussions.
The states have deepened discussions on the Program of Action proposed by France, which seeks to incorporate discussions on international law in a cross-cutting manner in three action-oriented thematic groups: on building resilience, cooperation in the management of ICT-related incidents, and prevention of conflict and increasing stability in cyberspace. This approach was supported by Sweden, Portugal, Czechia, the UK, the EU, Albania, Australia, Germany, Ireland and others. The PoA also foresees the inclusion of non-state experts in cybersecurity, to which the EU and North Macedonia specifically expressed their support.
In addition to the two proposals above, several states have voiced additional proposals.
Switzerland generally supported the thematic and cross-cutting working groups as proposed by France but voiced concern that it might not be sufficient for in-depth discussions on international law. Switzerland considers it better if the discussion on the implementation of norms would occur in the cross-cutting working groups. In contrast, the discussion on the application of international law would benefit from a specific forum.
The USA believes that the states are ready to integrate discussion into practical, thematic working groups oriented toward addressing specific, real-world concerns to international peace and stability and focusing on practical tools.
Senegal recalled the equal importance and relevance of the five pillars of the OEWG mandate and would be willing to discuss adding a pillar on the application of international law.
Iran, China and Russia see as a priority within the future permanent mechanism to initiate a substantive discussion on developing legally binding obligations in the ICT field and have a dedicated thematic group on international law. These states do not support the participation of non-state experts in the discussions.
Ireland does not consider a thematic group on international law necessary or desirable. Their concern would be that such a group could be stifled by being overly outcome-focused and that it would duplicate efforts and divert resources and attention from more dynamic engagement on legal issues within the other thematic groups. Conversely, Egypt sees the need for a dedicated platform on international law in the future permanent mechanism and is sure that the modalities, mandate, structure, and types of discussions can be agreed on by consensus. Egypt sees the discussion as reshaping the content of international law and underscores the need to have a place within the UN to have a multilateral conversation with the participation of stakeholders.
The role of capacity building in fostering a better understanding of states on how international law applies to cyberspace and contributes to promoting peace, security, and stability in cyberspace was underscored by Tonga on behalf of the Pacific Island Forum, Viet Nam, Kenya, Ghana, Canada, Thailand, UK, France, Colombia, and many others.