ADVANCING CYBERSTABILITY

Executive summary

We have reached the end of a twenty-five-year period of strategic stability and relative peace among major powers. Conflict between states has taken new forms, and cyber activities are playing a leading role in this newly volatile environment. Over the last decade, the number and sophistication of cyber attacks by state and non-state actors have increased, thus threatening the stability of cyberspace. Simply put, people and organizations may no longer be confident in their ability to use cyberspace safely and securely, or be assured of the availability and integrity of services and information.

Against this backdrop, the Global Commission on the Stability of Cyberspace (GCSC) was convened to make recommendations for advancing cyberstability. We began by identifying a seven element Cyberstability Framework. This framework includes: (1) multistakeholder engagement; (2) cyberstability principles; (3) the development and implementation of voluntary norms; (4) adherence to international law; (5) confidence building measures; (6) capacity building; and (7) the open promulgation and widespread use of technical standards that ensure cyberspace is resilient. After defining this framework, the Commission explored in depth three of its elements: multistakeholder engagement, principles, and norms.

Multistakeholder engagement is called for in many international agreements, yet it remains contentious. Some continue to believe that ensuring international security and stability is almost exclusively the responsibility of states. In practice, however, the cyber battlefield (i.e., cyberspace) is designed, deployed, and operated primarily by non-state actors, and we believe their participation is necessary to ensure the stability of cyberspace. Moreover, their participation is inevitable, as non-state actors often are the first to respond to—and even to attribute—cyber attacks.

The Commission concluded that these non-state actors were not only critical for ensuring the stability of cyberspace, but that they too should be guided by principles and bound by norms. The four principles reflect this view, calling on all parties to be responsible, exercise restraint, take actions, and respect human rights:

• Responsibility: Everyone is responsible for ensuring the stability of cyberspace.
• Restraint: No state or non-state actor should take actions that impair the stability of cyberspace.
• Requirement to Act: State or non-state actors should take reasonable and appropriate steps to ensure the stability of cyberspace.
• Respect for Human Rights: Efforts to ensure the stability of cyberspace must respect human rights and the rule of law.

Building on these principles, and seeking to supplement and not duplicate the work of others, the Commission crafted eight norms designed to better ensure the stability of cyberspace and address technical concerns or gaps in previously declared norms:

1. State and non-state actors should neither conduct nor knowingly allow activity that intentionally and substantially damages the general availability or integrity of the public core of the Internet, and therefore the stability of cyberspace.
2. State and non-state actors must not pursue, support or allow cyber operations intended to disrupt the technical infrastructure essential to elections, referenda or plebiscites.
3. State and non-state actors should not tamper with products and services in development and production, nor allow them to be tampered with, if doing so may substantially impair the stability of cyberspace.
4. State and non-state actors should not commandeer the general public’s ICT resources for use as botnets or for similar purposes.
5. States should create procedurally transparent frameworks to assess whether and when to disclose not publicly known vulnerabilities or flaws they are aware of in information systems and technologies. The default presumption should be in favor of disclosure.
6. Developers and producers of products and services on which the stability of cyberspace depends should (1) prioritize security and stability, (2) take reasonable steps to ensure that their products or services are free from significant vulnerabilities, and (3) take measures to timely mitigate vulnerabilities that are later discovered and to be transparent about their process. All actors have a duty to share information on vulnerabilities in order to help prevent or mitigate malicious cyber activity.
7. States should enact appropriate measures, including laws and regulations, to ensure basic cyber hygiene.
8. Non-state actors should not engage in offensive cyber operations and state actors should prevent such activities and respond if they occur.

Recommendations

Finally, recognizing both the importance of multistakeholder engagement and the fact that declaring behavior normative does not make it so, the Commission makes six recommendations which focus on strengthening the multistakeholder model, promoting norms adoption and implementation, and ensuring that those who violate norms are held accountable.

Specifically, the Commission recommends that:

1. State and non-state actors adopt and implement norms that increase the stability of cyberspace by promoting restraint and encouraging action.
2. State and non-state actors, consistent with their responsibilities and limitations, respond appropriately to norms violations, ensuring that those who violate norms face predictable and meaningful consequences.
3. State and non-state actors, including international institutions, increase efforts to train staff, build capacity and capabilities, promote a shared understanding of the importance of the stability of cyberspace, and take into account the disparate needs of different parties.
4. State and non-state actors collect, share, review, and publish information on norms violations and the impact of such activities.
5. State and non-state actors establish and support Communities of Interest to help ensure the stability of cyberspace.
6. A standing multistakeholder engagement mechanism be established to address stability issues, one where states, the private sector (including the technical community), and civil society are adequately involved and consulted.

The publication of this report represents both an end and a beginning. The Commission has fulfilled its mandate. For the members and supporters of the GCSC, however, as well as all those who support its goals, the hard work required to implement these principles, norms, and recommendations is just beginning. Begin it must, as the benefits of cyberspace will be lost if its stability is not ensured.

1. Introduction

The digital evolution and cyberspace have dramatically transformed human existence.1 The ability to digitize, store, analyze, and transport data around the globe has had profound effects in every sector of society, and has changed the way we conduct personal, business, and political affairs. Today, approximately half the world’s population is online2 and this number is rapidly increasing. But even those not personally connected to cyberspace are affected by its reach, since the entities they rely upon to provide goods and services often use cyberspace for communications, logistics, and finance.

The benefits of cyberspace—and the need to ensure its stability—have often been discussed, as have its challenges. Most notably, cyberspace may support both noble and ignoble purposes. For example, global connectivity, anonymity, and lack of traceability permit individuals and machines to connect to data and systems without asserting identity, but criminals can also leverage these attributes to commit crimes with impunity. As a result, governments, companies, and people around the world are faced with conundrums. Governments are interested in protecting cyberspace, delivering public services, and promoting other important activities (e.g., education and online banking) but are also interested in advancing national security interests, including law enforcement, intelligence, and military capabilities. Companies, concerned about protecting their customers, reputations, and profits, find themselves under attack, investigating malicious activities, and/or subject to government data requests. People— whether they are themselves connected or not—are increasingly dependent on and embracing digital technology, but are concerned about its continued availability and integrity. Over the last decade, the number and sophistication of cyber attacks have increased, including attacks on government systems and critical infrastructures.3 As such, neither the status quo nor the observable trends are encouraging.

Cyber attacks, which are conducted by both state and non-state actors, make clear that the world needs a Cyberstability Framework. Such a framework will serve to reduce the potential for significant disruptions of cyberspace that will undermine its benefits and reduce people’s well-being, including their rights and freedoms. Clearly, well-designed and built products and services, managed well by IT professionals and computer users, will increase security and stability, just as poorly or negligently designed products and services, or poor or negligent operational practices, will undermine them. But better development and operations will not be enough, especially with state and non-state actors viewing cyberspace as a battlefield where one can achieve political, military, or economic advantage. A persistent attacker can defeat security measures, giving rise to the adage that “offense beats defense on the Internet” and creating instability.4 Thus, it is important to focus not only on technology but on behaviors: how do we encourage all actors to behave in responsible ways that enhance—and do not threaten—the stability of cyberspace?

To help answer this question, several governmental and non-governmental entities supported the creation of the Global Commission on the Stability of Cyberspace (GCSC),5 noting that:

We have reached the end of a twenty-five-year period of strategic stability and relative peace among major powers. Conflict between states will take new forms, and cyber activities are likely to play a leading role in this newly volatile environment, thereby increasing the risk of undermining the peaceful use of cyberspace to facilitate the economic growth and the expansion of individual freedoms.

In order to counter these developments, the Global Commission on the Stability of Cyberspace will develop proposals for norms and policies to enhance international security and stability and guide responsible state and non-state behavior in cyberspace. The GCSC will engage the full range of stakeholders to develop shared understandings, and its work will advance cyberstability by supporting information exchange and capacity building, basic research, and advocacy.6

Notably, the Commission itself is multistakeholder and global as it is comprised of individuals with diverse backgrounds and expertise. Some Commissioners have themselves served in government and were engaged in bilateral and multilateral negotiations on cyber issues, while others have experience in building, maintaining, and protecting the Internet itself. Others have represented civil society.

The Commission’s work does not exist in a vacuum and the GCSC, recognizing that many other institutions and processes (both past and present) share its interest in the stability of cyberspace, has sought not to duplicate the work of others. Rather, the GCSC attempts to build upon other multistakeholder and governmental processes and influence future work. These processes include the foundational and ongoing work of the United Nations Group of Governmental Experts (UN GGE),7 the work of the Open-Ended Working Group (UN OEWG), as well as the efforts of the Global Forum on Cyber Expertise (GFCE),8 World Summit on the Information Society (WSIS), the Global Commission on Internet Governance (the Bildt Commission), the Internet Governance Forum (IGF), the Global Conference on CyberSpace (GCCS/the London Process), the NETmundial Initiative, the Organization for Security and Co-operation in Europe (OSCE), the African Union Commission (AUC), the Charter of Trust, the Cybersecurity Tech Accord, The Hague Program for Cyber Norms, the United Nations Institute for Disarmament Research (UNIDIR), the Paris Call for Trust and Security in Cyberspace (“the Paris Call”), and the UN Secretary-General’s High-level Panel on Digital Cooperation. The Commission’s work was also informed by commissioned research and requests for public comments.

Some of the efforts listed focused, in part, on cyberspace stability, and were concerned that cyberspace stability and governance are inextricably linked. That is, absent a robust governance model, society lacks the interactions and decision-making processes necessary to ensure stability. For example, the Bildt Commission proposed a multistakeholder social compact for the digital privacy and security “between citizens and their elected representatives, the judiciary, law enforcement and intelligence agencies, business, civil society and the internet technical community, with the goal of restoring trust and enhancing confidence in the internet.”9

We commend these prior efforts at developing principles, rules, and norms to apply to behavior in the turbulent new domain of cyberspace and believe that a comprehensive framework is necessary to increase the stability of cyberspace. The historical record shows that societies and governments may in some cases take decades to develop broad, formal international governance structures for important new disruptive technologies.10 The emergence of cyberspace as a crucial dimension of globaleconomic, social, and security interdependence only dates from the late 1990s, when broad usage of the World Wide Web began. Thus, the evolving processes of governance are at an early stage where areas of normative coherence and incoherence co-exist.11 For example, while norms and institutions related to the Domain Name System are well developed, there are major areas of disagreement among states and among companies related to content regulation. Sometimes, state and non-state actors apply norms from other regimes such as intellectual property and trade and, increasingly, private companies are themselves setting norms.12 The purpose of our Commission is not to sort out these various questions of governance, but to put them within a general framework for ensuring the stability of cyberspace.

We also note that those concerned with the stability of cyberspace have struggled to keep up with those who seek to undermine it, as well as keep pace with technological developments and the evolution of geopolitical conflicts. Part of the challenge is that cyberspace has transformed the way actors pursue political and military objectives; with low barriers to entry, it is less difficult to become a cyber power than a traditional military power. Additionally, with new technology in their toolkits, some are hesitant to adopt constraints, particularly if those constraints are not widely honored. What is needed is an overarching Cyberstability Framework for the international community, one that promotes the stability of cyberspace yet remains useful as the pace of technological change continues to increase. We therefore start with defining the core objective: protecting the stability of cyberspace.

2. What is meant by the stability of cyberspace?

While the Commission’s definition builds on the standard definition of “stability,”13 it is more nuanced in two ways. First, there is the reference to user confidence. Confidence is important because human decisions may be based upon perceptions, not just facts, and if someone perceives a lack of stability, they may be reluctant to use cyberspace and obtain its benefits. By way of example, the use of cyberspace may streamline processes and make them more efficient, thus suggesting that certain functions (e.g., access to government services, online banking) could benefit from leveraging cyberspace. But if such systems are unreliable—or there is a perception that such systems are unreliable—their use will be limited, and the benefits of the technology lost.

Second, it must be remembered that cyberspace is a domain of constant change. There are changes in technology, in business models, in functionality, and in societal expectations about the role of technology in daily life. Thus, unlike the dictionary definition of “stability” which includes “returning to an original condition,” what we need are agile mechanisms to ensure the stability of cyberspace as technologies evolve. Simply put, everyone must remain confident in the availability and integrity of cyberspace even as it—and the world around it—changes.

4. Multistakeholder Engagement

Notwithstanding a plethora of international agreements among states citing the importance of a multistakeholder approach, it remains contentious. For some, the debate is philosophical and focuses on the comparative roles of state and non-state actors in technology policy and international affairs. For others, multistakeholder processes are practical, holding that states acting alone or with only minimal non-state input cannot ensure the stability of cyberspace.15 We agree with this latter view.

This debate on the merits of multistakeholder engagement has gone on for decades. Often, the issue arose in the context of managing Internet resources, but the question of norms and national security were also raised. For example, during the second phase of the UN World Summit on the Information Society, the United Nations Working Group on Internet Governance (WGIG) rejected the concept of single stakeholder leadership. Rather, it concluded that the Internet is too large to be managed by one stakeholder group or one organization alone and proposed a multistakeholder approach. Thus, in 2005, the Heads of State in the WSIS Tunis Agenda declared that “A working definition of Internet governance is the development and application by governments, the private sector and civil society, in their respective roles, of shared principles, norms, rules, decision-making procedures, and programmes that shape the evolution and use of the Internet.”16

This view was reaffirmed ten years later by the High-Level Meeting of the UN General Assembly on the overall review of the implementation of the WSIS outcomes which also stated in UN resolution 70/125 (2015):

We reaffirm, moreover, the value and principles of multi-stakeholder cooperation and engagement that have characterized the World Summit on the Information Society process since its inception, recognizing that effective participation, partnership and cooperation of Governments, the private sector, civil society, international organizations, the technical and academic communities and all other relevant stakeholders, within their respective roles and responsibilities, especially with balanced representation from developing countries, has been and continues to be vital in developing the information society.17

Again, the statement went beyond the management of critical Internet resources and directly to the heart of national security issues:

We recognize the leading role for Governments in cybersecurity matters relating to national security. We further recognize the important roles and contributions of all stakeholders, in their respective roles and responsibilities.18

Regarding norms specifically, the Group of Eight (G8) declared in 2011 that:

The security of networks and services on the Internet is a multi-stakeholder issue. It requires coordination between governments, regional and international organizations, the private sector, [and] civil society…Governments have a role to play, informed by a full range of stakeholders, in helping to develop norms of behaviour and common approaches in the use of cyberspace.19

Two years later, in 2013, the UN GGE issued its Report on Developments in the Field of Information and Telecommunications in the Context of International Security. In a section entitled “Building cooperation for a peaceful, secure, resilient and open ICT environment,” the UN GGE noted that “[w]hile States must lead in addressing these challenges, effective cooperation would benefit from the appropriate participation of the private sector and civil society.”20 The report went on to say, in a section entitled “Recommendations on norms, rules and principles of responsible behaviour by States,” that:

Member States should consider how best to cooperate in implementing the above norms and principles of responsible behaviour, including the role that may be played by private sector and civil society organizations.21

These positions were reaffirmed in the UN GGE’s 2015 report, where it was declared that:

While States have a primary responsibility for maintaining a secure and peaceful ICT environment, effective international cooperation would benefit from identifying mechanisms for the participation, as appropriate, of the private sector, academia and civil society organizations.22

This statement was repeated in a 2018 General Assembly resolution on Advancing responsible State behaviour in cyberspace in the context of international security.23 Other international agreements clearly express the same sentiment; for example, the Paris Call stated, “We recognize the necessity of a strengthened multi-stakeholder approach and of additional efforts to reduce risks to the stability of cyberspace and to build-up confidence, capacity and trust.”24

Most recently, in June 2019, the UN Secretary-General’s High-level Panel on Digital Cooperation, in its report, The Age of Digital Interdependence, stated:

Effective digital cooperation requires that multilateralism, despite current strains, be strengthened. It also requires that multilateralism be complemented by multi-stakeholderism—cooperation that involves not only governments but a far more diverse spectrum of other stakeholders such as civil society, academics, technologists and private sector.25

While the idea of a multistakeholder approach has proven to be successful, it is not universally supported. Some governments continue to believe that ensuring international security and stability is almost exclusively the responsibility of states. This more traditional view of security springs from the notion that states have the responsibility to protect their citizens from attack through forceful means, an idea reflected in the responsibilities of the United Nations Security Council as codified in Article 24 of the UN Charter.26 This line of thinking may also be reinforced by past experience because, in the physical domain, governments not only enjoyed a monopoly over the legitimate use of force, but were also in control of the military grade weapons (e.g., airplanes, tanks) used to attack and defend that domain.

In practice, the cyber battlefield (i.e., cyberspace) is designed, deployed, and operated primarily by the private sector. Governments are, despite their unique responsibilities, not the exclusive protectors of this domain. Even if governments maintain a de jure monopoly over the legitimate use of force in cyberspace, they no longer have a practical monopoly on attacking and protecting this domain, nor can they prevent the proliferation and use of powerful cyber weapons. Rather, the technical community, civil society, and individuals also play a major role in the protection of cyberspace, including the promulgation of standards. Therefore, the multistakeholder approach is necessary to improve outcomes and ensure that the norms and policies supporting the stability of cyberspace are well-formed and avoid unwanted consequences.

Equally important, even if states wish to go it alone, they cannot. The participation of non-state actors in matters affecting the stability of cyberspace is unavoidable. For example, many members of the private sector and technical community may be responsible for critical protocols and services, and they may protect states that use their commercial and open source products. Additionally, even the investigation and attribution of attacks, a traditional role for and political prerogative of governments, is no longer their sole area of knowledge and responsibility; some notable state attacks have been identified and publicized by non-governmental entities. In short, even though states have a unique role to play during and after an attack (including law enforcement activity and/or taking diplomatic or other state actions), they have no monopoly on investigation and attribution, nor can they effectively exclude non-state actors. As a result, developing successful cyberspace norms and policies—and ensuring adherence to them— requires participation by, and is a responsibility of, all stakeholders, and governments must focus on creating mechanisms that effectively incorporate participation of the private sector, the technical community, academia, and other representatives of civil society. This is exactly what many governments have called for.

5. Principles

Normative behavior derives from values. Declaring those values, whether they relate to individual responsibilities, state responsibilities, or fundamental human rights, must therefore be our starting point. Indeed, differing values can make achieving consensus difficult, as well as result in differing country or regional interpretations and implementations of international agreements. This is not to suggest that an agreement on principles is required for progress to be made; sometimes, parties agree on acceptable behaviors even if their motives for doing so differ. But shared principles and interdependence can lead to deeper commitments and reduce the risk of future disagreements or conflicts. It is therefore important that parties have candid discussions about the high-level principles which guide their thinking and from which norms flow.

The following four principles are critical to ensuring the stability of cyberspace:

6. Norms

While principles are a key starting point for establishing policy and guiding tactical actions, their high level of abstraction requires that they be supplemented with more granular agreements that define acceptable behavior. This means that principles must be supplemented by norms. Norms represent social behaviors that are expected and appropriate.34 It is impossible to discuss norms without referencing the work of other organizations, especially the UN GGE and its 2015 report.35 The UN GGE recognized that “[g]iven the unique attributes of ICTs, additional norms could be developed over time,”36 and the GCSC’s mandate was, in fact, to “develop proposals for norms and policies to enhance international security and stability.” To build on prior work and identify where additional norms may be warranted, it is important to start with the norms agreed to in 2015 which can be found, in their entirety, in Appendix A.

As the UN GGE noted in 2015, it was tasked to, among other things, “identify where additional norms that take into account the complexity and unique attributes of ICTs may need to be developed.”37 Since that time, ICT products and services—as well as their misuse— have continued to change. To address this, the GCSC focused on filling gaps in the current set of norms, adding technical specificity to the norms discussion, and addressing issues of implementation. Regarding filling gaps, for example, the GCSC endorsed a norm to protect the public core of the Internet38 and a norm to protect electoral systems.39 Similarly, while the UN GGE norm refers to the “integrity of the supply chain,”40 a GCSC norm speaks more specifically to the types of supply chain attacks that must be addressed.41

The other major difference between the UN GGE norms and those proposed by the GCSC is that the GCSC believes that responsibilities should be imposed on non-state actors as well, as they must exercise restraint or take affirmative steps to ensure the stability of cyberspace. We are not referring here to cyber attacks by criminals; criminals who are not deterred by government action will not be deterred by norms. But since technology changes rapidly and laws do not, it is helpful to be precise about what non-state behaviors should be encouraged or discouraged even in the absence of laws. For example, some are advocating that victims of hacking should be allowed to “hack back.” Even in the absence of laws permitting or prohibiting such conduct, the GCSC believes it inadvisable for several reasons, including the fact that the initial attacker may be routing its attack through third-party systems (e.g., a cloud provider or a hospital) and hacking back may therefore impact innocent users (e.g., cloud customers or patients). Additionally, due to these attacks on innocent victims, the hack back may be viewed as, or provoke, an escalation. In short, due to the complexities raised, even in the absence of laws, a norm restraining private sector actors may influence behavior and thus serve a salutary purpose.

7. Recommendations

Our six recommendations for ensuring the stability of cyberspace flow from our principles on responsibility, restraint, requirement to act, and respect for human rights. As everyone is responsible for, and a multistakeholder approach is critical to, ensuring the stability of cyberspace, our recommendations also seek to leverage the capabilities of state and non-state actors, in part through Communities of Interest. In short, we focus on what should be done and how it might be done.

1. State and non-state actors must adopt and implement norms that increase the stability of cyberspace by promoting restraint and encouraging action. State actors who have previously agreed to norms must more clearly define the terms used, an outcome that could be achieved through further negotiations and through practical experience implementing existing norms. Both state and non-state actors should offer clear evidence of norms adoption and implementation through public statements, and through changes in both policy and action.
2. State and non-state actors, consistent with their responsibilities and limitations, must respond appropriately to norms violations, ensuring that those who violate norms face predictable and meaningful consequences. Norms development and implementation will not be effective if those who violate norms learn that there is no price for doing so. Therefore, state and non-state actors should develop the internal capability to evaluate transgressions and quickly decide on and take appropriate individual and collective responses, consistent with the Requirement to Act Principle.
3. State and non-state actors, including international institutions, should increase efforts to train staff, build capacity and capabilities, promote a shared understanding of the importance of the stability of cyberspace, and take into account the disparate needs of different parties. Increasing capacity, capability, and understanding will broaden the world’s ability to implement international laws, norms, and other confidence building measures designed to enhance the stability of cyberspace while respecting human rights. All parties should leverage existing organizations, including the multistakeholder Global Forum on Cyber Expertise, that are focused on capacity building as this is a prerequisite to adopting and implementing norms, ensuring accountability, taking other stability measures, and respecting human rights.
4. State and non-state actors should collect, share, review, and publish information on norms violations and the impact of such activities. While the world has seen action that would constitute a violation of the norms set forth in the United Nations and proposed by the GCSC, reporting tends to be anecdotal rather than comprehensive. Organizations, particularly those that are independent of any state or commercial interest, should systematically collect and publish information on norms violations and their impact. Doing so will serve to catalyze responses by state and non-state actors to norms violations and serve to improve norms compliance.
5. State and non-state actors should establish and support Communities of Interest to help ensure the stability of cyberspace. Establishing and supporting Communities will serve to ensure that all interested parties including states, the private sector, the technical community, academia, and civil society all fulfill their responsibility to ensure the stability of cyberspace. These Communities can focus on, among other things, the interpretation, adoption, and implementation of the cybersecurity norms put forward in this report and elsewhere, whether evidentiary standards for attribution are robust, and whether norms violators are being held accountable in a timely and effective manner.
6. The GCSC recommends establishing a standing multistakeholder engagement mechanism to address stability issues, one where states, the private sector (including the technical community), and civil society are adequately involved and consulted. The Responsibility Principle recognizes that everyone has a role to play in ensuring the stability of cyberspace and reinforces the need for multistakeholder approaches. From 2011-17, the Global Conference on CyberSpace (GCCS) provided one platform for such engagement that brought in minister-level participants from foreign and security ministries who were charged with achieving global stability in other contexts, and it was also the launching point of the Global Forum on Cyber Expertise, an important capacity building effort. The Internet Governance Forum (IGF) has also offered an important platform for multistakeholder discussion. More recently, the Paris Call brought together the largest-ever multistakeholder community of supporters of cybersecurity norms. These efforts suggest that the time is ripe for the development of a global, inclusive, and action-oriented multistakeholder community focused on the practical implementation of the cybersecurity norms put forward in this report and elsewhere. The mechanism should be supported by a standing structure to ensure a sustained and continuous effort.

Appendix A: Norms adopted by the UN GGE 54

1. Consistent with the purposes of the United Nations, including to maintain international peace and security, States should cooperate in developing and applying measures to increase stability and security in the use of ICTs and to prevent ICT practices that are acknowledged to be harmful or that may pose threats to international peace and security;
2. In case of ICT incidents, States should consider all relevant information, including the larger context of the event, the challenges of attribution in the ICT environment and the nature and extent of the consequences;
3. States should not knowingly allow their territory to be used for internationally wrongful acts using ICTs;
4. States should consider how best to cooperate to exchange information, assist each other, prosecute terrorist and criminal use of ICTs and implement other cooperative measures to address such threats. States may need to consider whether new measures need to be developed in this respect;
5. States, in ensuring the secure use of ICTs, should respect Human Rights Council resolutions 20/8 and 26/13 on the promotion, protection and enjoyment of human rights on the Internet, as well as General Assembly resolutions 68/167 and 69/166 on the right to privacy in the digital age, to guarantee full respect for human rights, including the right to freedom of expression;
6. A State should not conduct or knowingly support ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public;
7. States should take appropriate measures to protect their critical infrastructure from ICT threats, taking into account General Assembly resolution 58/199 on the creation of a global culture of cybersecurity and the protection of critical information infrastructures, and other relevant resolutions;
8. States should respond to appropriate requests for assistance by another State whose critical infrastructure is subject to malicious ICT acts. States should also respond to appropriate requests to mitigate malicious ICT activity aimed at the critical infrastructure of another State emanating from their territory, taking into account due regard for sovereignty;
9. States should take reasonable steps to ensure the integrity of the supply chain so that end users can have confidence in the security of ICT products. States should seek to prevent the proliferation of malicious ICT tools and techniques and the use of harmful hidden functions;
10. States should encourage responsible reporting of ICT vulnerabilities and share associated information on available remedies to such vulnerabilities to limit and possibly eliminate potential threats to ICTs and ICT-dependent infrastructure;
11. States should not conduct or knowingly support activity to harm the information systems of the authorized emergency response teams (sometimes known as computer emergency response teams or cybersecurity incident response teams) of another State. A State should not use authorized emergency response teams to engage in malicious international activity.

CHAIRS

Michael Chertoff USA
Latha Reddy India
Marina Kaljurand Estonia (former Chair)

COMMISSIONERS

Abdul-Hakeem Ajijola Nigeria
Virgilio Almeida Brazil
Isaac Ben-Israel Israel
Scott Charney USA
Frédérick Douzet France
Anriette Esterhuysen South Africa
Jane Holl Lute USA
Nigel Inkster UK
Khoo Boon Hui Singapore
Wolfgang Kleinwächter Germany
Olaf Kolkman Netherlands
Lee Xiaodong China
James Lewis USA
Jeff Moss USA
Elina Noor Malaysia
Joseph S. Nye, Jr. USA
Christopher Painter USA
Uri Rosenthal Netherlands
Ilya Sachkov Russia
Samir Saran India
Marietje Schaake Netherlands
Motohiro Tsuchiya Japan
Bill Woodcock USA
Zhang Li China
Jonathan Zittrain USA

SPECIAL REPRESENTATIVES AND ADVISORS

Carl Bildt Sweden
Vint Cerf USA
Sorin Ducaru Romania
Martha Finnemore USA

DIRECTORS

Alexander Klimburg Austria
Bruce W. McConnell USA

RESEARCH ADVISORY GROUP CHAIRS

Sean Kanuck USA
Koichiro Komiyama Japan
Marília Maciel Brazil
Liis Vihul Estonia
Hugo Zylberberg France

Secretariat

THE HAGUE CENTRE FOR STRATEGIC STUDIES (HCSS)

Alexander Klimburg, Director, Global Commission on the Stability of Cyberspace Initiative and Secretariat
Louk Faesen, Project Manager, Global Commission on the Stability of Cyberspace Secretariat
Elliot Mayhew, Project Assistant, Global Commission on the Stability of Cyberspace Secretariat

With additional support from: Timon Domela Nieuwenhuis Nyegaard, Koen van den Dool, Niels Renssen, and Kaja Karlson.

EASTWEST INSTITUTE (EWI)

Bruce W. McConnell, Co-Director, Global Commission on the Stability of Cyberspace Secretariat
Anneleen Roggeman, Project Manager, Global Commission on the Stability of Cyberspace Secretariat

With additional support from: Abagail Lawson, Dragan Stojanovski, and Conrad Jarzebowski.

Partners, Sponsors, and Supporters

The Hague Centre for Strategic Studies, the EastWest Institute, and the Commissioners would like to recognize and acknowledge the following organizations for their support:

PARTNERS:

• Ministry of Foreign Affairs of the Netherlands, Timo Koster and Dimitri Vogelaar
• Microsoft, Jan Neutze and Kaja Ciglic
• Cyber Security Agency of Singapore, David Koh and Sithuraj Ponraj
• Internet Society (ISOC)
• Ministry of Foreign Affairs of France, Henry Verdier and David Martinon
• Afilias, Ram Mohan and Philipp Grabensee

SPONSORS:

• Federal Department of Foreign Affairs of Switzerland
• GLOBSEC
• Ministry of Foreign Affairs of Estonia
• Ministry of Internal Affairs and Communications of Japan

SUPPORTERS:

• African Union Commission
• Black Hat USA
• DEF CON
• European Union Delegation to the UN in Geneva
• Global Forum on Cyber Expertise
• Google
• Municipality of The Hague
• Packet Clearing House
• Tel Aviv University
• United Nations Institute for Disarmament

These organizations and institutions are committed to advancing the debate and putting forward creative solutions to some of the most pressing challenges facing the stability of cyberspace.

Researchers

The Commission would like to thank the members of its Research Advisory Group, a group of over 200 online members that connected the GCSC to the wider academic community. In particular, we would like to thank the researchers who were commissioned to write briefings and memos to inform the deliberations of the Commissioners.

GCSC ISSUE BRIEF 1 (NOVEMBER 2017)

Alex Grigsby, Formerly of the Council on Foreign Relations (CFR)
Deborah Housen-Couriel, Konfidas Digital Ltd.
Joanna Kulesza, University of Lodz and Rolf H. Weber, University of Zürich
Oluwafemi Osho, Joseph A. Ojeniyi, and Shafi’i M. Abdulhamid, Federal University of Technology, Minna
Analía Aspis, University of Buenos Aires
Robert Morgus, Formerly of New America, Max Smeets, Formerly of the Center for International Security and Cooperation, Stanford University, and Trey Herr, Harvard Kennedy School
Arun Mohan Sukumar, Madhulika Srikumar, and Bedavyasa Mohanty, Observer Research Foundation (ORF)

GCSC ISSUE BRIEF 2 (MAY 2018)

Shen Yi, Jiang Tianjiao, and Wang Lei, Research Center for the Governance of Cyberspace, Fudan University
Elana Broitman, Mailyn Fidler, and Robert Morgus, Formerly of New America
Elonnai Hickok and Arindrajit Basu, Centre for Internet and Society
Thomas Uren, Bart Hogeveen, and Fergus Hanson, Australian Strategic Policy Institute (ASPI)
Dragan Mladenović and Vladimir Radunović, DiploFoundation
Thomas Reinhold, Institute for Peace Research and Security Policy, University of Hamburg

Consultations

The Commission would like to thank the following individuals and organizations for submitting extensive comments in response to the Request for Consultations on the Singapore Norm Package (from 17 December 2018 until 17 January 2019) and the Definition of Stability of Cyberspace (from 14 August 2019 until 6 September 2019):

Hussein Abul-Enein, Access Partnership
Kayode Akanni, DesignIT
Jonathan D. Aronson, University of Southern California (USC)
Aviram Atzaba, Israel National Cyber Directorate
Arindrajit Basu, Gurshabad Grover, Elonnai Hickok, and Karan Saini, Center for Internet & Society
Vytautas Butrimas, NATO Energy Security Centre of Excellence
Cybersecurity Tech Accord
Michael Daniel, Cyber Threat Alliance
Global Partners Digital
Arvind Gupta and Dickey Kumar, Vivekananda International Foundation
Tara Hairston and Anastasiya Kazakova, Kaspersky
Sven Herpig, Stiftung Neue Verantwortung
Drew Mitnick, Access Now
George M. Moore, James Martin Center for Nonproliferation Studies
Brett van Niekerk and Trishana Ramluckan, University of KwaZulu-Natal
Peter Swire, Justin Hemmings, and Sreenidhi Srinivasan, Georgia Tech Scheller College of Business
Johan de Wit, Siemens/TU Delft

Finally, the Commission would like to thank the following experts, whose work and expertise have guided and informed the deliberations of the Commission:

Dennis Broeders, Leiden University
Deborah Brown and Verónica Ferrari, Association for Progressive Communications
Michael Daniel, Cyber Threat Alliance
François Delerue, Institut de Recherche Stratégique de l’École Militaire – IRSEM
Akhil Deo and Arun Mohan Sukumar, Observer Research Foundation (ORF)
Martha Finnemore, George Washington University
Aude Géry, University of Rouen
Duncan Hollis, Temple Law School
Joanna Kulesza, University of Lodz
Peter Rowland, Packet Clearing House
Michael Schmitt, Exeter Law School