The UN’s approach to international cybersecurity has gradually evolved from developing a framework for responsible state behaviour in cyberspace towards placing greater emphasis on its implementation. Adopted incrementally between 2013 and 2024, this framework rests on four pillars: norms, international law, confidence-building measures, and capacity-building. Implementation efforts have accompanied this process, including the creation of practical tools such as the Global Intergovernmental Points of Contact Directory, launched in 2022 to facilitate interstate communication and cooperation, reflecting this growing emphasis on execution.
The establishment of the Global Mechanism on Information and Communications Technologies, after almost 25 years of ad hoc UN cyber formats, is the latest step in this evolution. The mechanism, which had its first plenary session in New York on 20-24 July, is intended to bring a more action-oriented approach to the existing framework. It emerges against a backdrop of enduring geopolitical tensions, diverging state positions, and persistent gaps in implementation capacity which continue to complicate efforts to translate agreed commitments into practical implementation.
A familiar start
Substantively, the Global Mechanism’s first plenary, chaired by El Salvador, looked largely familiar to an audience acquainted with previous UN cyber processes. Like under the preceding open-ended working groups (OEWGs), geopolitical tensions were never far from the discussion, with ongoing conflicts reflected in statements. Critical infrastructure and artificial intelligence featured prominently, alongside recurring concerns such as ransomware, while states repeatedly emphasised the importance of capacity-building for implementation of the framework.
It also became clear that the Global Mechanism inherits many of the same controversies that shaped the OEWGs, including disagreements over the applicability and interpretation of international law, whether additional norms or rules are needed, and the participation of non-governmental stakeholders.
There were also signs that states are putting their international commitments into practice: the secretariat noted that 125 states had nominated a total of 319 points of contact to the Global Directory. Yet the discussion around this illustrated the difficulties of turning words into action – from capacity constraints to concerns over good-faith use.
The real test: dedicated thematic groups
Apart from the fact that the new mechanism is permanent, the biggest innovations are the two dedicated thematic groups (DTGs) which complement the annual plenary ‘by providing the opportunity for more detailed and action-oriented discussion’. As decided in 2025, dedicated thematic group one focuses on challenges and group two on capacity-building.
As Chairperson Egriselda López herself has put it, the thematic groups ‘have no prior template to build on’, so the biggest unanswered questions revolve around them: how topics will be selected for discussion, how closely the two groups will work together, and how they will be linked to the plenary.
The July plenary was tasked with putting the Global Mechanism on a solid procedural footing and setting the course for its future work. To some extent, it succeeded. States adopted a provisional agenda for the coming substantive plenaries and confirmed – despite some controversies – the dedicated thematic group co-facilitators appointed by López (group one is Australia and Egypt; group two: Malaysia and the Netherlands).
Some states also used their statements during the substantive session to discuss how the thematic groups could work in practice ahead of their first meetings in December, while others, including Russia and France, submitted more detailed proposals beforehand. However, rather than resolving outstanding issues, this highlighted points of contention, ranging from how discussions in the groups should be structured to how the groups should relate to the plenary, the role of experts, the nature of the groups’ outputs, and the extent to which such outputs should require consensus.
So what’s next?
In the aftermath of the first substantive session, the chair made a first attempt to give more concrete direction. Based on the issues raised by states during the plenary, she proposed ‘protection of critical infrastructure from ICT threats and strengthening collective resilience‘ as a cross-cutting topic for the first meetings of the thematic groups. This at least answers the previously open question of which topic to address.
The proposal received broad support from states at an early-September town hall. López announced that she would refine the proposal to reflect states’ inputs and plans to circulate an indicative timetable and guiding questions by the end of October. In the meantime, the process for the nomination of experts by states is now open. These experts will provide briefings to the dedicated thematic groups, bringing technical and practical insights into the discussions.
Agreeing on a topic is only the starting point: the more consequential question is how the thematic groups will turn that topic into meaningful, ‘action-oriented’ discussions. If ‘action-oriented’ is to be more than a buzzword, states need to show what it means in practice.
From ambition to action
All states, but especially those that have strongly advocated for an action-oriented mechanism, should use the dedicated thematic groups to create a space that is genuinely different from the plenary.
This requires preparation and coordination. Implementation happens at the national and regional level. Thus, states should come to the thematic groups having done their homework. The EU’s non-paper on norms implementation, which maps its efforts to implement the 11 UN voluntary, non-binding norms of responsible state behaviour in cyberspace, is an example of a good first step – but many more steps are needed.
Existing tools that document how states are implementing their commitments can provide a useful basis for these exchanges. The UN’s Survey of Implementation, for example, collects information on how states are putting the agreed framework for responsible state behaviour in cyberspace into practice. Canada recently made its responses to this survey publicly available, offering a concrete example of how states can share information on their implementation activities.
The thematic groups could also make better use of cross-regional exchange. Regional organisations have accumulated considerable experience translating the global framework into practice, including through confidence-building measures addressing critical infrastructure protection, joint positions on international law, and advancing norms implementation.
They have also developed different approaches to taking stock of implementation, including dedicated discussions among member states, questions to guide exchanges about implementation challenges, and regular updates on progress. These are not necessarily models to copy, but they provide experience to build on. Cross-regional exchange has often depended on individual initiatives or one-off events; the thematic groups could help institutionalise it.
In line with Lopéz’s proposal, states should come to the December thematic group sessions with short updates on their norms implementation activities. They should also submit detailed information via written updates in advance to facilitate preparation and allow more time for focused discussion during the sessions. One state might describe its national approach and remaining capacity gaps. Another might share best practices on critical infrastructure protection as a regional confidence-building measure, while a third might explain how it would apply specific international law principles to a concrete scenario.
Meanwhile, the experts – perhaps including implementers at the national level such as those from cybersecurity authorities, critical infrastructure operators, and civil society – will point out common technical or societal vulnerabilities, feeding into the conversation on existing and potential threats. Guiding questions and coordination amongst like-minded states could support the preparation of these briefings, for example, by ensuring the nomination of experts from diverse backgrounds.
Non-governmental stakeholders participating as experts should also come prepared and coordinate among themselves, for example, by bringing joint recommendations rather than multiple individual proposals.
The thematic groups could then identify common gaps and formulate recommendations for consideration by the plenary.
Connecting the pieces
To meet the overall objective of going from ‘agreements to implementation‘, states should emphasise action in the next plenary, in 2027.
A promising trend already emerged in the OEWG: as the group carried out its work, an increasing number of states highlighted, for instance, their national cyber confidence-building activities in their statements.
The same should happen in the Global Mechanism, with the plenary providing a space to take stock of progress and feed the practical work of the thematic groups back into the broader political discussion. Other formats – such as side events, working– or non-papers, and (cross-)regional initiatives – can complement this effort.
The coming months are the time for states to prepare, bring their implementation experience to the table, and shape the thematic groups into spaces that can transform UN cyber discussions into practice. The Global Mechanism has created the space. Now states need to bring the action.
Related Posts
