Unlocking Digital Peace Talks at the UN

Digital peace has been on the agenda at the United Nations since 1998, and UN member states have made some progress. At least one critical reality, however, stands in the way of meaningful advancement: Currently, not all UN member states are committed to advancing digital peace. 

Differing from the approach to many conventional weapons, digital disarmament is not considered a precondition of digital peace. UN member states recognized early that digital technologies’ intangible and multiuse nature defied traditional arms control.  Rather than seeking to “control” specific technology, considered neither technically feasible nor economically desirable, countries strove to advance digital peace by defining “responsible use” of technology.

While glacial compared to technology’s evolution, a UN framework for Responsible State Behavior in Cyberspace has developed over the past two decades. The framework recognizes that existing international law applies to the activities of states in cyberspace, sets out 11 voluntary norms of responsible behavior, and identifies confidence-building measures and capacity-building principles.

This year, the final reports of two landmark UN negotiations fully endorsed the framework: the inaugural Open-Ended Working Group (OEWG) on development in the field of information and communication technologies in the context of international security, and the sixth Group of Governmental Experts (GGE) on responsible state behavior in cyberspace. 

Unlike the previous reports, the OEWG report was negotiated among all UN member states so countries can no longer claim they were not party to the negotiations as an excuse for exemption. The GGE report deepened the framework, including specific recognition that international humanitarian law applies to cyber operations during armed conflict.

These developments, however, occurred amid increasing malicious cyber activity conducted or condoned by countries. Considering this, many countries are now prioritizing implementation of the framework and development of accountability mechanisms for when countries violate their commitments. 

Yet even if implemented and enforced, some argue that the existing framework will not deliver digital peace. This raises some obvious — but little discussed — realities. 

All UN member states would need to agree upon any additional commitments, but not all countries share the same motivations. Liberal democracies do not hold the balance of power; while they may want meaningful progress, they will not accept new commitments that undermine the framework, or legitimize authoritarian behaviors. Given these negotiating realities, simply preserving the status quo is often a victory. 

The UN is replete with examples of agreements struck in politically polarized times. In each case, despite differing national interests, member states shared a common objective. However, on this issue, not all countries share the objective of advancing digital peace, especially if it means asymmetrically losing their cyber edge.

A growing number of countries possess offensive cyber capabilities. And the blunt reality is that those countries will not accept meaningful restraints on their own offensive cyber capabilities unless they can verify reciprocity by their adversaries. 

Herein lies the conundrum. Verification of the scale and sophistication needed to underwrite digital peace does not yet exist. If a critical pipeline is not secured against ransomware, how can we expect to reliably verify that an adversary is not prepositioned on that pipeline for future attack? In this geo-strategic environment “trust me” does not cut it.

Inspection regimes are often touted as a solution. Putting aside questions of technical feasibility, no proposal to date has adequately addressed the private sector’s role, nor the sensitive, sovereign nature of the networks most in need of verification. 

This article is a call to action to industry, civil society and academia as well as to governments. If we want digital peace, we must unite behind it as a shared objective. Solving the verification conundrum will be key to unlocking digital peace.