Q1/2020 - UN Cybersecurity Groups (OEWG & UNGGE)

2. Formelle Tagung der Open Ended Working Group/OEWG, New York, 10. -  14. Februar 2020

Die 2. formelle Tagung der OEWG fand vom 10. bis 14. Februar 2020 in New York statt. Diskussionsgrundlage waren die Berichte der 1. Tagung (September 2019) und der „Informal Intersessional“ (Dezember 2019) sowie eine Reihe von Input Papers einzelner UN-Mitgliedstaaten und von NGOs.

Die Sitzung war von einem konstruktiven Klima geprägt. Politisch motivierte Kontroversen blieben aus. Erneut waren, wie bereits bei der 1. formellen OEWG Sitzung, aus dem nicht-staatlichen Bereich nur ECOSOC-akkreditierte NGOs zugelassen, was sowohl von den NGOs als auch vielen UN-Mitgliedsstaaten kritisiert wurde. Der Input aber, den nicht-staatliche Stakeholder während der „Informal Intersessional“ im Dezember 2019 geliefert hatten und den der Chair der „Informal Intersessional“, David Koh, Direktor der National Cybersicherheitsagentur in Singapur, in seinem Bericht an die 2. OEWG-Sitzung zusammengefasst hatte, wurde in der Diskussion von vielen Regierungen positiv gewürdigt und substanziell aufgegriffen.

Der Bericht von David Koh, Chair der „OEWG Informal Intersessional“ vom 28. Januar 2020 zieht eine außerordentlich positive Bilanz des sogenannten „Experiments“ einer Multistakeholder-Tagung zu Fragen der Sicherheit im UN-Rahmen. Das Experiment sei durchweg gelungen[1]. Regierungen würden enorm vom Input nicht-staatlicher Akteure aus Wirtschaft, Wissenschaft, Zivilgesellschaft und technischer Community profitieren.

Kohs Bericht enthält in 85 Punkten eine Vielzahl von Vorschlägen nicht-staatlicher Stakeholder zu den OEWG-Themen Bedrohungen im Cyberspace, Normen und Gesetze, vertrauensbildende und kapazitätsbildende Maßnahmen sowie Multistakeholderismus. Koh nennt Vorschläge zum Schutz des öffentlichen Kerns des Internet (Protection of the Public Core of the Internet), zur Errichtung eines robusten Mechanismus für die Zuordnung von Cyberangriffen (Robust Gobal Attribution Framework), zu Berichtspflichten über Verwundbarkeiten in Hard- und Software (Norm of Reporting Vulnerabilities) und zu Schutzmaßnahmen für Lieferketten bei digitalen Produkten und Dienstleistungen (Supply Chain Integrity of ICT Products and Services).

Der Bericht bezieht sich auf eine Vielzahl von nicht-staatlichen Initiativen und Empfehlungen wie den Paris Call for Trust and Security, die Global Commission on Stability in Cyberspace (GCSC), das Global Forum on Cyber Expertise (GFCE), den Tech-Accord (Microsoft), die Charter of Trust (Siemens), des IGF Best Practice Forum on Cybersecurity, FIRST und andere. Koh schlussfolgert, dass Cybersicherheit nur unter Einbeziehung der speziellen Expertise von Wirtschaft, Wissenschaft, Zivilgesellschaft und technischer Community gestaltet werden könne. Nötig sei auch ein multidisziplinärer Ansatz (holistic approach).

Koh verweist auch auf Themen, bei denen es unterschiedliche Meinungen gab, wie z.B. Vorschläge zur Ausarbeitung von völkerrechtlich verbindlichen Verträgen oder zur Schaffung neuer Institutionen wie einer Art IAEA für den Cyberspace[2].

Im Lichte der Diskussion legte der Schweizer OEWG-Chair Jürg Lauber am 11. März 2020 den ersten Entwurf eines Abschlussberichts (Initial Pre-Draft) vor. Der Plan, zwei weitere „Intersessionals“ Ende März und Ende Mai 2020 durchzuführen, wurde durch die Corona-Krise umgestoßen. Botschafter Lauber hat am 16. März 2020 das März-Treffen abgesagt und um schriftliche Kommentare zu seinem Entwurf bis zum 16. April 2020 gebeten. Bei der 3. formellen und abschließenden Sitzung (6. -10. Juli 2020 in New York) soll ein Konsens-Bericht verabschiedet werden, der dann an die 75. UN-Vollversammlung geleitet wird. Laubers Bericht enthält 68 Paragraphen und ist in sechs Abschnitte gegliedert:

  • Einführung
  • Existierende und kommende Bedrohungen
  • Völkerrecht
  • Regeln, Normen und Prinzipien für verantwortungsvolles Verhalten von Staaten
  • Vertrauensbildende Maßnahmen
  • Kapazitätsbildung
  • Regulärer Institutioneller Dialog
  • Schlussfolgerungen und Empfehlungen.

Der Bericht baut auf den elf Normen für verantwortungsbewusstes Handeln von Staaten im Cyberspace, die von der UN-Vollversammlung 2015 verabschiedet wurden (UN-Resolution 70/237), auf. Er bekräftigt, dass das Völkerrecht in seiner Gesamtheit offline wie online relevant ist.

Im Abschnitt über die Bedrohungsszenarien wird u.a. auf neue technologische Entwicklungen verwiesen, die zu einer Militarisierung des Cyberspace und entsprechenden Risiken für die internationale Sicherheit führen können[3]. 

Der Bericht geht auf die Kontroverse ein, ob existierende Normen im Völkerrecht ausreichend seien, um mit den neuen Bedrohungen umzugehen oder ob ein „Upgrade“ bzw. eine „erweiterte Interpretation“ der bestehenden Normen notwendig seien bzw. ob ganz neue Normen und neue völkerrechtliche Verträge ausgehandelt werden müssten. Lauber schlägt eine Art iterativen Prozess vor, bei dem es für einige Bereiche rechtlich bindende Normen geben sollte, während für andere Bereiche rechtlich nicht bindende Empfehlungen ausreichend seien[4]. 

Lauber erwähnt auch Vorschläge, neue Wege zu beschreiten bei der Schaffung von Mechanismen zur friedlichen Lösung von Konflikten im Cyberspace und der Entwicklung von Methoden zur Zuordnung von Cyberangriffe auf der technischen Ebene[5]. 

Neu ist ein Kapitel zu einem regelmäßigen institutionellen Dialog (Regular Institutional Dialogue). Dieser Teil diskutiert Optionen, inwiefern ein neuer permanenter Mechanismus zur Diskussion von Cybersicherheitsfragen unter dem Dach der UNO geschaffen werden soll, der auf den bestehenden Mechanismen der UN-Abrüstungsarchitektur aufbaut und sie ergänzt sowie nicht-staatliche Stakeholder in die Debatte einbezieht, ohne dabei den zwischenstaatlichen Charakter der entsprechenden Verhandlungen in Frage zu stellen[6]. 

Mehrfach betont der Bericht den Nutzen einer erweiterten Multistakeholder-Kooperation im Bereich der Cybersicherheit[7]. 

Der letzte Abschnitt des Berichts „Schlussfolgerungen und Empfehlungen“ ist noch sehr vage und arbeitet mit „Placeholdern“.  In einem zusätzlichen Paper werden weitere Vorschläge von UN-Mitgliedsstaaten aufgelistet, die zunächst nicht im „Initial Pre-Draft“ enthalten sind. Dazu gehören auch Vorschläge von China zu Internet Governance und zur Cybersouveränität.

Ziel ist es, den Bericht im Juli 2020 im Konsens zu verabschieden. Damit wäre die Arbeit der OEWG abgeschlossen. Eine der Empfehlungen der OEWG wird es aber sein, dass sich die 76. UN-Vollversammlung im Jahr 2021 mit der Zukunft eines ständigen institutionellen Dialogs befassen soll, was durchaus zu einer Erneuerung oder Erweiterung des Mandats der OEWG führen könnte[8].  2021 liegt dann auch der Bericht der 6. UN-GGE vor.   

2. Substantielle Tagung der 6. Group of Governmental Experts/UNGGE, Genf, 24. - 28. Februar 2020

Die 2. substanzielle Sitzung der 6. UN-GGE fand vom 24. - 28. Februar 2020 in Genf statt. Sitzungen der UN-GGE sind nicht öffentlich. Nicht-staatliche Vertreter sind nicht zugelassen. Es gibt keine Berichterstattung über Fortschritte. Verhandlungsteilnehmer berichteten von einem konstruktiven Klima und der Entschlossenheit der 25 UN-GGE Mitgliedsstaaten[9], im Jahr 2021 einen konstruktiven Abschlussbericht vorzulegen. Die 5. GGE war 2017 gescheitert und ohne Abschlussbericht auseinandergegangen.

Mehr zum Thema
Q1/2020
  1. [1] Informal intersessional consultative meeting of the Open-ended Working Group on developments in the field of information and telecommunications in the context of international security, New York, 2. – 4. Dezember 2019, Chair’s Summary, New York, 28. Januar 2020: „I found the discussions to be informative, interactive and highly relevant for taking forward the work of the international community in this area. The different perspectives provided by States, industry, civil society and academia were enriching and the concrete ideas put forward were constructive and innovative.“, in: https://www.un.org/disarmament/open-ended-working-group/
  2. [2] Informal intersessional consultative meeting of the Open-ended Working Group on developments in the field of information and telecommunications in the context of international security, New York, 2. – 4. Dezember 2019, Chair’s Summary, New York, 28. Januar 2020: „84. Stakeholders expressed the hope that “Multi-stakeholderism” would not be a ticking of a participation box, but that all stakeholders would have a role in actively shaping policy and decision-making. States have exclusive responsibility for national security but responsible behaviour should be required by all actors“, in: https://www.un.org/disarmament/open-ended-working-group/
  3. [3] Initial “Pre-draft” of the report of the OEWG on developments in the field of information and telecommunications in the context of international security, New York, 11. März 2020 „14. In their discussions at the OEWG, States expressed concern at the malicious use of ICTs carried out by State actors, including the possible use of proxies. It was also noted that some ICT capabilities previously only available to States were now accessible to non-State actors, including terrorists and criminals.15. States expressed the view that the development or use of offensive ICT capabilities, as well as the stockpiling of vulnerabilities, are contributing to the militarization of the digital space. Pursuit of increasing automation and autonomy in ICT operations was also put forward as a specific concern. States highlighted as a central threat the possibility that ICTs could be used in a manner inconsistent with a State’s obligations under international law. Additional concerns were conveyed regarding interference in the internal affairs of States through the use of ICTs, including by means of information operations and disinformation campaigns. Concerns were also raised about the exploitation of harmful hidden functions and the integrity of global ICT supply chains. 16. States underscored that a lack of awareness, resilience and adequate capacities constitutes a threat in and of itself as all countries are increasingly reliant on digital technologies. 17. It was noted that threats may have a differentiated impact on different actors, including on youth, the elderly, women and men, on vulnerable populations, particular professions, and other categories of actors, as well as on States with different levels of ICT security and resilience. 18. States noted significant technological trends, including progress in machine learning, encryption, and quantum computing; the ubiquity of connected devices (”Internet of Things“); new ways to store and access data through distributed ledgers and cloud computing; and the expansion of big data, including digitized personal data. While recognizing the substantial beneficial applications of these innovations, States cautioned that technological advances and new applications may also expand attack surfaces, amplify vulnerabilities in the ICT environment or facilitate novel malicious activities. At the same time, there was broad agreement that measures to promote responsible State behaviour should remain technology-neutral. 19. While States observed that critical infrastructure is defined differently in accordance with national prerogatives and priorities, they emphasized the severity of threats to particular categories of infrastructure, including for instance the health and financial sectors and electoral infrastructure. Transborder and transnational critical infrastructure was highlighted as at risk as was supranational critical information infrastructure, notably those global systems upon which public or financial services rely. In this regard, States underscored that attacks on critical infrastructure pose not only a threat to security, but also to economic development and people’s livelihoods. 20. In light of the increasingly concerning digital threat landscape, and recognizing that no State is sheltered from these threats, the OEWG underscored the urgent need for States to further develop, through multilateral forums, cooperative measures to address such threats. It was affirmed that acting together and inclusively would produce more effective and far-reaching results. The positive contributions of the private sector, civil society and academia were also emphasized in this regard.“, in: https://www.un.org/disarmament/open-ended-working-group/
  4. [4] Initial “Pre-draft” of the report of the OEWG on developments in the field of information and telecommunications in the context of international security, New York, 11. März 2020: 26. During the discussion the view was expressed that existing international law, complemented by the voluntary, non-binding norms that reflect consensus among States, is currently sufficient for addressing State use of ICTs. It was noted that efforts should therefore be directed to reaching common understanding on how the already agreed normative framework applies and can be operationalized. 27. At the same time, during the discussion, it was also noted that there may be a need to adapt existing international law or develop a new instrument to address the unique characteristics of ICTs. In particular, it was highlighted that certain questions on how international law applies in the use of ICTs have yet to be fully clarified. Such questions include, inter alia, what kind of ICT-related activity might be interpreted by other States as a threat or use of force (Art. 2(4) of the Charter) or might give a State cause to invoke its inherent right to self-defence (Art. 51 of the Charter). They also include questions relevant to how the principles of international humanitarian law, including the protection of civilians and civilian objects, apply to ICT operations in the context of armed conflict. In this regard, it was noted that the issue of the applicability of international humanitarian law to the use of ICTs by States needed to be handled with prudence. 28. In this context, proposals were made for the development of a legally binding instrument on the use of ICTs by States as the quickly evolving nature of the threat environment and the severity of the risk necessitates a stronger, internationally agreed framework. It was noted that such a binding framework may lead to more effective global implementation of commitments and a stronger basis for holding actors accountable for their actions. 29. It was suggested that while existing bodies of international law do not include specific reference to the use of ICTs in the context of international security, international law can develop progressively in this regard. Developing complementary binding measures concurrently with the implementation of norms was also proposed. A politically binding commitment4 with regular meetings and voluntary State reporting, was also suggested as a possible middle ground approach. 30. States proposed that a first step to further develop common understandings could be increased exchanges on their interpretation of how international law applies to the use of ICTs by States“ in: https://www.un.org/disarmament/open-ended-working-group/
  5. [5] Initial “Pre-draft” of the report of the OEWG on developments in the field of information and telecommunications in the context of international security, New York, 11. März 2020: 32. From the perspective of maintaining peace and preventing conflict, it was noted that greater focus could be placed on adherence to key Charter principles such as the settlement of disputes by peaceful means and refraining from the threat or use of force. In this context, States recalled existing mechanisms for the settlement of disputes, including the Security Council and the International Court of Justice. It was suggested that developing a common approach to attribution at the technical level could lead to greater accountability, transparency, and could help support legal recourse for those harmed by malicious acts.“, in: https://www.un.org/disarmament/open-ended-working-group/
  6. [6] Initial “Pre-draft” of the report of the OEWG on developments in the field of information and telecommunications in the context of international security, New York, 11. März 2020: 62. A variety of proposals were made to take forward regular institutional dialogue. It was noted that the GGE process since 2004 has been a form of regular dialogue. It was also suggested that the format of the OEWG, with its inclusive membership and transparent discussions, should become the standard for discussion and therefore the renewal of its mandate was called for. It was highlighted that there was value in having the sixth Group of Governmental Experts meeting in parallel to the OEWG, stressing their complementarity and the opportunity to capitalize on the unique features of each process. Looking beyond the mandates of the OEWG and sixth GGE, a further suggestion was that regular institutional dialogue could be the follow-up mechanism to a politically binding instrument. 12 Another possibility raised was that an inter-governmental specialized agency could be established“ in: https://www.un.org/disarmament/open-ended-working-group/
  7. [7] Initial “Pre-draft” of the report of the OEWG on developments in the field of information and telecommunications in the context of international security, New York, 11. März 2020: „64. The OEWG’s mandate provided for the possibility of holding intersessional consultative meetings with other stakeholders, including the private sector, non-governmental organizations and academia. The three-day informal consultative meeting of the OEWG held in December 2019 produced a rich exchange between States and other stakeholders. The OEWG also heard interventions from non-governmental organizations during an informal multi-stakeholder segment at its first and second sessions. In order to further inform their engagement with the OEWG, some States noted that they have conducted domestic multi-stakeholder consultations or calls for submissions. 65. It was recalled that States hold primary responsibility for national security, public safety and rule of law. It was also noted that regular dialogue should be primarily intergovernmental in nature, and an appropriate mechanism to leverage the experience and knowledge of other stakeholder groups would need to be found. In their interventions, States acknowledged that building a more resilient and secure ICT environment necessitates multi-stakeholder cooperation and partnerships. While recognizing the unique role and responsibility of States in relation to security, there was growing appreciation that States may benefit from the expertise in non-governmental communities and that responsible behaviour of other actors makes an essential contribution to this environment“ in: https://www.un.org/disarmament/open-ended-working-group/
  8. [8] Initial “Pre-draft” of the report of the OEWG on developments in the field of information and telecommunications in the context of international security, New York, 11. März 2020: „The OEWG recommends that the 76th session of the General Assembly of the United Nations convene a new open-ended working group of the General Assembly acting on a consensus basis to continue the consideration of developments in the field of information and telecommunications in the context of international security.“, in: https://www.un.org/disarmament/open-ended-working-group/
  9. [9] Mitglieder der 6. UN-GGE sind: Australien, Brasilien, China, Estland, Frankreich, Deutschland, Indien, Indonesien, Japan, Jordanien, Kasachstan, Kenia, Mauritius, Mexiko, Marokko, Niederlande, Norwegen, Rumänien, Russland, Singapur, Süd-Afrika, Schweiz, Großbritannien, USA, Uruguay, in: https://www.un.org/disarmament/group-of-governmental-experts//