Competing U.S.-Russia Cybersecurity Resolutions Risk Slowing UN Progress Further

Josh Gold is a research assistant at Citizen Lab, at the University of Toronto’s Munk School, and a non-resident visiting scholar at the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). 

As COVID-19 has wrought worldwide disruption, so too has it affected the UN Open-Ended Working Group (OEWG) on cybersecurity—the only forum open to all UN member states for deliberating how to promote a peaceful and stable cyberspace. Because the pandemic prevented its final in-person meeting, the OEWG missed its mandated July 2020 deadline for a consensus report containing agreements on norms, international law, and other leading global cybersecurity issues.

The OEWG has since been extended [PDF]; its final substantive in-person meeting is tentatively scheduled for March 2021. After two online summer sessions, another virtual session from September 29 to October 1 set the OEWG rolling again, including a proposed new format for the future. But the late September meeting also marked the debut of a novel pair of conflicting resolutions from the United States and Russia.

Although the two draft resolutions have been circulated among UN member states, neither are yet final nor public. The proposed U.S. resolution calls on states to wait until the current Group of Governmental Experts (GGE) and OEWG meetings are completed in early 2021 before formally proposing a new process to address cyber issues at the UN. In contrast, the draft Russian resolution calls for a new OEWG to be convened from 2021-2025, despite the fact that the current OEWG has not yet finished its work. The Russian resolution would also reaffirm the right of states to combat “the dissemination of false or distorted news” and recognize states’ “duty” to refrain from any “defamatory campaign” for interfering in other states’ domestic affairs.

The clashing resolutions risk repeating recent history, when two parallel resolutions from both sides were adopted in 2018—creating the OEWG while renewing the longstanding GGE. Now, the Russian push for a new and extended OEWG seems counterproductive, especially given a proposed new “Programme of Action” [PDF] (PoA) format for UN cybersecurity deliberations, which is currently under discussion in the OEWG.

Released for discussion on October 1by France and Egypt, the proposed PoA has quickly gained the support of a diverse range of at least forty countries, with several others—including all African Union member states—also rumored to be leaning toward endorsement. Recently described in-depth by French scholars and analyzed in an informal Australian research paper [PDF], it seeks to replace the dual-track discussions of the GGE/OEWG with a single, permanent UN forum.

However, the Russian push for a new and extended OEWG raises doubts as to whether the call for a PoA can achieve consensus support, which it needs in order to be endorsed in the final OEWG report. If so, the PoA could potentially be put to the UN General Assembly as a resolution later on, perhaps incorporated into a future U.S. resolution. In this case the PoA, initially pitched to eliminate the redundancy of the two parallel UN cyber processes, could simply emerge as a replacement to the GGE—while existing alongside an extended OEWG. Such a dual-track scenario would run contrary to the objectives of the PoA and could substantially reduce its effectiveness.

Russia’s draft resolution follows a recent trend of behavior widely seen as unproductive. Over this past summer, two informal online OEWG sessions were marked by Russian antics including a Friday evening surprise on June 12, when Russia’s delegation unilaterally announced an eleventh-hour veto of the secretariat’s plan [PDF] from May to prolong the OEWG mandate. The announcement momentarily lurched the OEWG process into uncertainty (as it meant the OEWG would have to conclude by its original July deadline), and was followed by a fiery intervention [PDF] by Russia at a June 15 informal meeting which excoriated the existing OEWG draft report. Russian bluster soon subsided, though, and Russia later accepted a plan to reschedule the final OEWG session.

Such behavior from the Russian delegation, combined with its premature resolution calling for a five-year OEWG to study how to move forward rather than to work with an existing, widely supported proposal like the PoA, raises questions about the extent to which Russia seeks meaningful outcomes from the OEWG.

The one-year-old OEWG, which, unlike the GGE is open to all countries, has enabled some 120 countries to actively participate and share their national positions in the deliberations since its inception. Now, many feel [PDF] that it is time to “translate norms ‘on paper’ into norms ‘in practice’.” Yet after a year of discussion, it is unclear how much more can be agreed among states beyond the existing agreements, such as on norms and the applicability of international law. Given this stagnation, a new permanent forum focused on implementation, like the PoA, could be the most effective way forward. Unfortunately, the UN is not always known for its effectiveness.