Multistakeholder initiatives on cyber norms

Microsoft’s call for a Digital Geneva Convention (February 2017) – which should ‘commit governments to avoiding cyber-attacks that target the private sector or critical infrastructure or the use of hacking to steal intellectual property’ – attracted the attention of the digital policy community. It brought into focus the idea that, in the search for a more secure and stable Internet, Internet companies need to engage with governments and work together on reasonable policy arrangements. The proposal gave rise to many pertinent questions related to the future of digital governance, in particular in the security field. Here, we address some of them.

In April 2017, Microsoft’s Brad Smith announced three new documents that continue to shape the proposal for a Digital Geneva Convention. The first carries key clauses which should form part of the convention; the second outlines a common set of principles and behaviours for the tech sector to help protect civilians in cyberspace; the third proposes the setting up of an independent attribution organisation to identify wrongdoing. In May 2017, Smith renewed the call for a Digital Geneva Convention, in response to the WannaCry ransomware attack.

What is the main aim of a Geneva Digital Convention?

What should a Geneva Digital Convention regulate?

The six principles proposed by Microsoft are typically based in national security, related to both defensive and offensive cyber-operations. They are a mix of policy and legal regimes. Principle 1 could be classified as the ius ad bellum principle, dealing with justification and prevention of conflicts; principles 3, 4, and 5 have a strong cyber-disarmament focus; principles 2 and 6 are applicable both in conflict and peacetime operations.

Moving from the six principles, Microsoft’s arguments shift towards protecting citizens in the case of conflict – which in legal terms is known as ius in bello – or even broadly speaking towards what we might call human cybersecurity. Human security is anchored in the protection of human wellbeing. Since human wellbeing increasingly depends on digital space, the question of human cybersecurity is likely to come more into focus.

If Microsoft’s proposal aims to focus on human cybersecurity, this will bring developmental aspects into discussion – ensuring means for people to achieve cyber wellbeing (access to the Internet, development of local content, etc), as well as human rights issues, including a potential right to safe access to the Internet.

In February 2018, several lead global technology companies - Siemens, IBM, Deutsche Telecom, Airbus and others - have presented their joint Charter of Trust for a Secure Digital World calling for shared ownership of cyber and IT security by various stakeholders, responsibility throughout the supply chain, security by default, education, certification for critical infrastructure and solution, transparency and response, regulatory framework, and joint initiatives.

The 10 principles of the Charter could be summarised as:

1. Ownership of cyber and IT security: Responsibility anchored to the highest governmental and business levels - designated specific ministries and CISO.
2. Responsibility throughout the digital supply chain: Risk-based rules, baseline standards (including identity and access management, encryption, and continuous protection) and protection across all IoT layers in place in companies, and governments if necessary.
3. Security by default: Highest level of security and data protection in-built into the design of products, functionalities, processes, technologies, operations, architectures, and business models.
4. User-centricity: Products, systems, and services as well as guidance provided based on the user’s cybersecurity needs, impacts, and risks. 
5. Innovation and co-creation: Driving and encouraging contractual public-private partnerships to deepen understanding and adapt security practices to new threats.
6. Education: Cybersecurity courses in schools, at universities, within professional education and trainings, introduced to enable transformation of skills and job profiles of the future.
7. Certification for critical infrastructure and solutions: Mandatory independent third-party certification for critical infrastructure and critical IoT solutions established within companies, and governments if necessary.
8. Transparency and response: Industrial cybersecurity network to allow for sharing information on threats and reporting incidents beyond critical infrastructure.
9. Regulatory framework: Multilateral collaboration promoted in regulation and standardisation in line with work of the World Trade Organisation, and cybersecurity rules included into Free Trade Agreements.
10. Joint initiatives: Collaboration through joint initiatives, and with other stakeholders.

The signatories are listed on the Charter website.

The Internet industry is under increasing pressure by governments to provide digital information to be used in criminal investigations and anti-terrorist activities. Traditional channels for international cooperation are slow and cumbersome. A regular legal process for obtaining digital evidence via Mutual Legal Assistance Treaties (MLATs) may take at least ten months. To bring the legal system up to speed for the digital era, Google has proposed new norms for providing digital evidence to foreign governments.

Google’s proposal would allow law enforcement to request digital evidence directly from Internet companies, bypassing the need to go through MLAT channels. According to the proposal, this would work only between countries that adhere to privacy, human rights, and due process standards.

The Pall Mall Process is an international, multi-stakeholder initiative, launched by France and the United Kingdom, to address the proliferation and irresponsible use of commercial cyber intrusion capabilities, including by cyber mercenaries. Grounded in the Pall Mall Declaration—a non-binding framework built on four pillars: accountability, precision, oversight and transparency—the process promotes cooperation among governments, industry and civil society to advance responsible practices and norms for the development and use of these tools.

On 3–4 April 2025, France and the United Kingdom convened the second Pall Mall Process Conference in Paris, which brought together 45 States and international organisations, alongside a broad coalition of representatives from the private sector, civil society and academia. At this conference, participating actors adopted a Code of Practice, already endorsed by 25 States, to establish voluntary political commitments and practical recommendations to address the challenge. Unique in its content, form and breadth of support, the Code reflects a shared understanding of the threat, reaffirms the relevance of existing international legal and normative frameworks, and sets out practical measures across different political levers.

By contributing to the implementation of the United Nations framework on responsible State behaviour in cyberspace and the principles of the Paris Call for Trust and Security in Cyberspace, the Pall Mall Process strengthens collective efforts to foster accountability and stability. Taking an inclusive approach, it will continue to disseminate good practices widely and track progress on their implementation.