01Home02About Us03Career04Services05Products06Blogs07Get In Touch
01Govern
Cybersecurity Regulatory CompliancePrivacy Regulatory CompliancePolicies/ SOP’s DevelopmentCapability & Maturity Assessment of SOC & Cybersecurity ProgramThird-Party Risk AssessmentVirtual CISO Services
02Identify
Comprehensive Cyber Risk AssessmentVulnerability AssessmentCybersecurity Audits/ ReviewGap Assessment as per Regulatory Standards & GuidelinesThreat Intelligence & Brand Monitoring
03Protect
Identity SecurityEndpoint SecurityZero Trust StrategyCloud Security StrategySecure Configuration (Baseline)/ Hardening Review & DocumentationAnti-Ransomware Assurance
04Detect
Managed Next-Gen Security Operations as a ServicePenetration Testing / Red TeamingDeception Strategy – Design and ImplementationCyber Threat HuntingAnalysis Services – Malware, Traffic & User BehaviourTraining on Security Operations
05Respond
Incident Response Plan – Design & ExerciseDigital ForensicsCyber Crime Investigation
06Recover
Design Disaster Recovery PlanDesign Business Continuity PlanDesign Backup StrategyChaos Engineering – Resilience Testing Strategy
07Training & Awareness
Training on Digital Forensics & Incident ResponseTraining on Security OperationsCybersecurity Awareness Training – Phishing SimulationsCapacity Building as per NICE Framework
08OT Security
OT Security ConsultationSecure Development Lifecycle (SDLC) for OT ProductsPenetration TestingTraining and DevelopmentManaged Security ServicesRisk Management
All blogs

Responsible State Behaviour in Cyberspace: Where are we headed?

Written byMandeep
PublishedMarch 7, 2025
Reading time13 min read

I recently read a report of an Open-Ended Working Group (OEWG) mandated by the United Nations (UN) to advance work on developing standards of responsible state behaviour in cyberspace. On digging a little deep into the work of this group, I had a lot of open-ended questions in my mind in context to the recent technological developments in cyberspace and the ongoing battle of tech norms. So let me build some context for you.

United Nations (UN) has been home to debates and negotiations on the rules, norms, and principles of states’ responsible behaviour in cyberspace since I was born (the early 1990s). So what is responsible state behaviour in Cyberspace?

Responsible behavior in cyberspace refers to the actions and activities of states and other actors in the digital domain that are consistent with international laws, norms, and principles. These behaviors are aimed at promoting the stability, security, and prosperity of cyberspace, while also respecting the sovereignty and rights of other states and individuals.

I am aware that one of the earliest efforts to address this issue was the UN Group of Governmental Experts (GGE) on Developments in the Field of Information and Telecommunications in the Context of International Security, which was established in 1998. This group has held a series of meetings and produced several reports on issues related to international security in cyberspace.

In light of ever-deteriorating geopolitical tension, it is important to acknowledge the success of both groups to arrive at a consensus text (which means Member States agree to adopt the draft resolution without taking a vote). To promote stability, the members of the United Nations have developed a framework that clearly articulates what states should and should not do in cyberspace. This framework for responsible state behaviour has four pillars. The first is that international law, including the Charter of the United Nations, applies to state conduct in cyberspace. Next are 11 agreed norms that set clear expectations of responsible state behaviour during peacetime. Those norms are supported by confidence-building measures which strengthen transparency, predictability, and stability. The last pillar is cyber capacity building to ensure all states can harness the benefits and mitigate the risks of increased connectivity.

The evolution of Tech Norms

The United Nations (UN) has played a significant role in shaping tech norms in the cyber domain, which has had an impact on other stakeholders including governments, academia, civil society, and the private sector. This has led to agenda rivalry among state and non-state platforms, but it has also pushed all involved stakeholders to advance their thinking and action.

The conflict between Tech Norms and UN Norms in Cyberspace

I understand that it is possible (and its happening) for tech norms to conflict with UN norms for cyberspace, as these norms may have different goals or priorities. For example, some tech norms may prioritize the protection of personal privacy, while UN norms for cyberspace may prioritize the stability and security of the digital domain.

Conclusion

In my understanding it may be useful for the UN to consider ways to bring together state actors and non-state actors to discuss the current gap between UN norms and tech norms. By taking an inclusive approach and involving a diverse range of stakeholders in this process, it may be possible to establish norms that can be formally adopted as binding resolutions for both states and non-state actors.