[DRAFT] Elements for the Open-Ended Action-Oriented Permanent Mechanism on ICT Security in the context of international security

1 This paper sets out elements for the establishment at the United Nations of an open-ended, action-oriented permanent mechanism on ICT security in the context of international security following the conclusion of the work of the Open-Ended Working Group on security of and in the use of ICTs 2021-2025 (OEWG). The permanent mechanism will be open-ended and action-oriented in nature; it will build on previous consensus reports, and will further develop and operationalize an action-oriented programme to advance the cumulative and evolving framework for responsible State behaviour in the use of ICTs.

2 Building on the objectives affirmed in relevant General Assembly resolutions, including inter alia, A/RES/78/16 and A/RES/78/237, relating to discussions on regular institutional dialogue within the OEWG, States agree to finalize the elements of the openended action-oriented permanent mechanism, including as contained in this paper, by consensus within the framework of the OEWG, so as to ensure a seamless transition to the new mechanism.

Guiding Principles

3 The establishment of the open-ended action-oriented permanent mechanism will be guided by the elements agreed by consensus in the OEWG, including the common elements agreed by consensus in paragraphs 55 to 57 of the second Annual Progress Report (APR) of the OEWG and reproduced below.

4 The open-ended action-oriented permanent mechanism would be based on the following common elements:

(a) It would be a single-track, State-led, permanent mechanism under the auspices of the United Nations, reporting to the First Committee of the United Nations General Assembly;

(b) The aim of the future mechanism would be to continue to promote an open, secure, stable, accessible, peaceful and interoperable ICT environment;

(c) The future mechanism would take as the foundation of its work the consensus agreements on the framework of responsible State behaviour in the use of ICTs from previous OEWG and GGE reports;

(d) It would be an open, inclusive, transparent, sustainable and flexible process which would be able to evolve in accordance with States’ needs and as well as in accordance with developments in the ICT environment.

5 States recognized the importance of the principle of consensus regarding both the establishment of the future mechanism itself as well as the decision-making processes of the mechanism.

6 Other interested parties, including businesses, non-governmental organizations and academia could contribute to any future regular institutional dialogue, as appropriate. Their contribution would take place in accordance with modalities to be agreed by consensus within the OEWG; these modalities could be further reviewed and developed within the future mechanism.

7 States recognized that regional and sub-regional organizations could continue to play an important role in implementing the framework for responsible State behaviour in the use of ICTs. In addition, regional, cross-regional and inter-organizational exchanges can establish new avenues for collaboration, cooperation, and mutual learning. As not all States are members of a regional organization and not all regional organizations focus on the issue of security in the use of ICTs, States noted that regional efforts are complementary to the work of the open-ended action-oriented permanent mechanism.

Functions and Scope

8 The main functions of the open-ended action-oriented permanent mechanism are:

a) To further develop the cumulative and evolving framework for responsible State behaviour in the use of ICTs;

b) To advance implementation of the cumulative and evolving framework for responsible State behaviour in the use of ICTs;

c) To strengthen the capacity of all States to develop and implement the cumulative and evolving framework for responsible State behaviour in the use of ICTs.

9 Guided by the functions listed above, the open-ended action-oriented permanent mechanism will address, with a view to facilitating an integrated, policy-oriented and crosscutting approach to discussions, the following issues , inter alia, existing and potential threats; rules, norms and principles of responsible State behaviour and the ways for their implementation, and if necessary, to introduce changes to them or elaborate additional rules of behaviour; how international law applies in the use of ICTs, including the development of additional legally binding obligations as appropriate; confidence-building measures; and capacity-building. 

10 The open-ended action-oriented permanent mechanism would work towards the advancement of mutually-beneficial cross-cutting objectives, including inter alia, enhancing cooperation on ICT security, increasing stability in the ICT security sphere, and fostering resilience in the context of existing and potential ICT security threats.

11 The open-ended action-oriented permanent mechanism would promote engagement and cooperation with relevant stakeholders, including business, non-governmental organizations and academia, and other international and regional organizations, within the framework of an inter-governmental process in which negotiation and decision-making are exclusive prerogatives of States.

Structure

12 The structure of the open-ended action-oriented permanent mechanism is as follows:

a) Substantive Plenary Sessions: One substantive plenary session to be convened per year, with each session lasting for one week. Substantive plenary sessions would carry out discussions in accordance with the scope and functions set out above, as well as consider the work and recommendations of the dedicated thematic groups. The substantive plenary sessions will consider and adopt Progress Reports to be submitted to the First Committee on a biennial basis.

b) Dedicated Thematic Groups: Dedicated thematic groups to be convened to conduct focused discussions. The dedicated thematic groups would report to the substantive plenary sessions with updates and recommendations.

c) Dedicated Intersessional Meetings: The Chair of the open-ended action-oriented permanent mechanism could also convene dedicated intersessional meetings to engage in additional discussions on specific issues as necessary.

d) Dedicated Stakeholder Consultations: A dedicated stakeholder consultation of at least one day in length to be convened prior to each substantive plenary session, open to all interested parties, including States, regional organizations, businesses, non-governmental organizations and academia.

e) Review Conference: A Review Conference to be convened every four years to review the effective functioning of the open-ended action-oriented permanent mechanism and provide strategic direction and guidance for the substantive plenary sessions and dedicated thematic groups over the subsequent four years. Additionally, at the Review Conference, any modifications to the elements for the open-ended action-oriented permanent mechanism contained in this document could also be decided by States on the basis of consensus.

13 The open-ended action-oriented permanent mechanism will be led by a Chair elected to serve for a period of two years on the basis of equitable geographical rotation. The dedicated thematic groups will be led by Vice-Chairs elected to serve for a period of two-years on the basis of equitable geographic representation.

14 The open-ended action-oriented permanent mechanism will establish the following dedicated thematic groups with a view to facilitating an integrated, policy-oriented and crosscutting approach to discussions:

a) A dedicated thematic group on international law, with the participation of legal advisors and experts, in order to advance an in-depth study and understanding of how international law applies to the use of ICTs, including the development of additional legally binding obligations, as appropriate.

b) A dedicated thematic group on Confidence-Building Measures (CBMs) to support the further development and operationalization of the voluntary Global CBMs, as well as the Global POC Directory, and to ensure the active participation of technical experts and national POCs.

c) A dedicated thematic group on capacity-building to facilitate the active participation of capacity-building practitioners and to provide a platform for States and stakeholders to work together on capacity-building initiatives, including, inter alia, by convening the Global Roundtable on ICT security capacity-building on a regular basis, and exploring “additional avenues of funding specifically targeted at capacity-building related to ICT security including through potential coordination and integration with existing development programmes and funds”.¹Second Annual Progress Report of the OEWG, A/78/265, para 43e).

d) A dedicated thematic group to facilitate a cross-cutting approach to ICT security, including developing recommendations, policy guidance and best practices on priority challenges such as the protection of critical infrastructure; facilitating cooperation between States following a serious cyber incident; and improving States’ ability to deter and mitigate ICT threats and identifying capacity-building measures that would best support the recommended actions. Through a crosscutting approach to ICT security, this group would address the implementation and development of the voluntary non-binding norms of responsible State behaviour, application of international law, and the use of confidence building measures and appropriate capacity-building measures to support the policy goal of achieving an open, secure, stable, accessible, peaceful and interoperable ICT environment. 

15 In addition to the dedicated thematic groups specified above, the Chair of the openended action-oriented permanent mechanism could also convene additional dedicated thematic groups with a fixed duration, to be led by facilitators appointed by the Chair, to engage in focused discussions on specific issues as necessary.

16 Recommendations and updates by the dedicated thematic groups would be provided to the open-ended action-oriented permanent mechanism at its substantive plenary sessions for consideration by States.

17 To facilitate inclusive participation, meetings of the open-ended action-oriented permanent mechanism, including the substantive plenary sessions, dedicated intersessional meetings, and meetings of any dedicated thematic groups, should not be held in parallel.

Modalities

18 The open-ended action-oriented permanent mechanism would operate as follows:

a) The permanent mechanism to be established as a subsidiary body of the UN General Assembly reporting to the First Committee.

b) The UN Office for Disarmament Affairs to serve as the Secretariat of the permanent mechanism.

c) An e-portal and/or website to be established to support and facilitate the work of the permanent mechanism, including its dedicated thematic groups.

d) Formal meetings of the permanent mechanism to be convened at UNHQ in New York.

19 To ensure a seamless transition from the work of the OEWG to the open-ended action-oriented permanent mechanism, the first substantive plenary session of the new mechanism will be convened no later than June 2026. In this regard, States agree to the following arrangements: 

a) An organizational session to be convened in December 2025 to carry out, inter alia, (a) the election of officers, and (b) the adoption of the agenda.

b) The first substantive plenary session to be convened in March 2026

Decision Making

20 The open-ended action-oriented permanent mechanism will take all decisions on the basis of consensus. Decisions could be put forward by the Chair for adoption by States on a consensus basis at any time during a substantive plenary session, with decisions to be formalized as soon as they are agreed upon by the open-ended action-oriented permanent mechanism.