WIREDGOV

For five years, the Open-Ended Working Group (OEWG) on cybersecurity has negotiated key thematic areas which can undermine international stability. Experts following these negotiations weigh in on the progress, sticking points and future of the themes and goals of the OEWG.

Cyber operations have become an enduring feature of geopolitical competition, increasingly targeting critical infrastructure and testing the boundaries of international stability. In the past few weeks, Microsoft reported that Chinese state-linked and non-state actors had exploited a zero-day vulnerability affecting on-premises SharePoint servers – including at the US National Nuclear Security Administration, which is responsible for overseeing nuclear weapons. The vulnerabilities were reportedly ‘exploited en masse to intrude hundreds of organizations globally’, spanning governments and critical sectors.

Incidents like this are not exceptional – they are emblematic of a broader pattern: persistent, state-linked cyber operations that exploit systemic vulnerabilities, erode trust and undermine international stability. Against this backdrop, efforts to define how states should behave in cyberspace – what is acceptable and what crosses the line – have become more urgent, but also more contested.

And yet, amidst these tensions – and perhaps paradoxically – 193 states gathered at the United Nations from 7 to 11 July to negotiate precisely that: the rules of the road for state behaviour in cyberspace. This final session of the Open-Ended Working Group (OEWG) on cybersecurity marked the conclusion of a five-year diplomatic process under the UN First Committee on Disarmament and International Security.

The session resulted in the establishment of a Global Mechanism, the approval of a final report that had been significantly watered down, and – somewhat unexpectedly – the early conclusion of negotiations on the final day, avoiding what many anticipated would be a long Friday of talks.

This piece brings together experts who have followed these negotiations from up close. Their reflections trace both the progress and sticking points of the past five years in each of the six thematic areas covered by the OEWG (existing and potential threats, norms, international law, confidence building measures, cyber capacity building and regular institutional dialogue) – and offer insights into what lies ahead.

Cyber Diplomacy Amid Growing Scepticism

Louise Marie Hurel

But first, a note on context and importance for the sceptics who (rightfully so) have and may continue to ask why and how a UN process can help devise concrete responses to growing instability in cyberspace.

Since 2004, the UN has hosted formal negotiations on this issue, beginning with the Group of Governmental Experts (GGE), which reached a milestone in 2015 by reaffirming that international law applies to cyberspace and by proposing 11 non-binding norms for responsible state behaviour. A decade later, those norms and the legal principles they reference have become the cornerstone of the UN Framework for Responsible State Behaviour in Cyberspace. And unlike the more exclusive, time-limited GGEs, the OEWG’s universal format granted all member states a seat at the table and a five-year mandate (2021–2025) to address this evolving security domain.

As I sat in a (thankfully) air-conditioned UN conference room on a scorching Manhattan morning, somewhere between 42nd and 45th Street, I watched states large and small gather to negotiate the final document of this phase: an articulation of shared (and diverging) understandings across the six key topics.

To those outside the room – especially security researchers, private sector companies, or national security practitioners – the idea that the UN could meaningfully shape cyber behaviour may seem overly diplomatic, even naive. After all, in the context of Russia–Ukraine, Israel–Iran, or India–Pakistan, cyber campaigns are no longer blips in armed conflict or crises; they are a feature of it. States are speaking more explicitly about integrating cyber as part of broader deterrence strategies and as a core part of achieving ‘warfighting’ readiness. The US is adopting a full-spectrum operational posture. The UK is integrating cyber and electromagnetic capabilities under one command.

As states exploit the fine lines between crisis and conflict, the strategic imperative remains: without shared understandings – however limited – about what constitutes responsible behaviour in cyberspace, the risk of escalation will only grow.

Click here for the full press release