Despite recent progress in establishing multilateral frameworks, obstacles to international cooperation on cyber issues remain. Disagreements over stakeholder participation in UN discussions and concerns about the adequacy of human rights protections under the Cybercrime Convention illustrate the difficulty of reconciling differing national interests and approaches. Thus, neither initiative guarantees effective implementation. Their collective contribution to global cyber governance will depend on whether States can manage their differences and sustain meaningful international cooperation.

In a year in which the UN system has struggled to address major global challenges, it has two major developments in cybersecurity to its credit. These are the establishment of a permanent global mechanism for dialogue and cooperation on cybersecurity, which began substantive discussions in July 2026, and the opening for signature of the UN Convention against Cybercrime in October 2025. India signed the Convention on 25 September 2026.[1]

The permanent mechanism is the outcome of a 20-year process that began with the first UN Group of Governmental Experts (UNGGE) established in 2004–2005, when cybersecurity was still largely regarded as a technical rather than a strategic issue. The growing sophistication of cyber threats and their increasing intersection with international security created added urgency to develop rules of the road in cyberspace through the UNGGE mechanism.

For a time, this mechanism provided some forward momentum, with the 2013 UNGGE report recognising the applicability of existing international law to cyberspace, while the 2015 report established 11 voluntary, non-binding norms of responsible state behaviour and advanced confidence-building and capacity-building measures.[2] Despite these milestones, the subsequently constituted UNGGE was undermined by growing geopolitical divisions in cyberspace and could not produce a consensus report in 2017, bringing the mechanism to a halt. It was resurrected in 2019, when the UN General Assembly established a new GGE alongside a parallel mechanism, the Open-Ended Working Group (OEWG).

While the UNGGE process was relatively exclusive, consisting of the first 15, and then 25 members, including the permanent members of the Security Council, the OEWG comprised all member countries of the United Nations, with civil-society groups allowed as observers and for secondary discussions and consultations. This reflected the view that a small group of countries could not develop rules governing cyberspace.

The parallel processes reflected both procedural and substantive differences over cyber governance. The United States favoured continuing the GGE process, with its limited membership and emphasis on building upon the existing consensus on responsible State behaviour and the application of international law. Russia, supported by China, advocated an OEWG open to all UN Member States and offering opportunities for wider stakeholder consultation. While this was presented as a more inclusive approach, the United States and other Western governments were concerned that the Russian initiative could reopen existing agreements and advance a more state-centric vision of cyberspace, emphasising sovereignty and control over information.

Both concluded their work in 2021 with consensus reports that reaffirmed key elements of the existing framework for responsible State behaviour in cyberspace. The OEWG’s work was subsequently continued through a second five-year process running from 2021 to 2025. A second OEWG, established in 2021, held sustained discussions on threats, international law, norms of responsible State behaviour, confidence-building and capacity-building. Its final report, adopted by consensus in July 2025, made several recommendations, including creating a permanent Global Mechanism to institutionalise this process.[3]

Criticisms of the OEWG Reports were similar to those directed at UNGGE reports: compared with the scale of the threats facing cyberspace, many recommendations were cautious, and the language was often deliberately generic. Many contentious issues, including the application of international humanitarian law, the development of new norms and the use of Information and Communication Technologies (ICT) in ongoing conflicts, were not covered.

Although the process had built in the participation of non-governmental stakeholders, many obstacles blocked their participation from the credentialing stage onward.  Nevertheless, the fact that 193 States, with sharply differing conceptions of sovereignty, international law and responsible behaviour in cyberspace, were able to conclude the five-year process with a consensus report is itself significant.[4]

The second OEWG recommended creating a permanent Global Mechanism in its consensus report of July 2025.  After........

© IDSA