The expansion of Information and Communication Technologies (ICT) has led to the emergence of new threats, such as the threat to the security of the Internet.

A response to increasing cyber insecurity has required the development of cyber capabilities, that is- in general terms- the mobilisation of technological, strategic and economic resources. Some countries have been advanced at developing national mechanisms for responding to these threats, e.g., passing data protection laws that provide breach notification requirements, establishing national computer security incident response teams (CSIRTs), launching a national cybersecurity strategy, having well-protected infrastructures, fostering investment in research and development for cybersecurity and digital transformation etc.

At global level, two parallel United Nations initiatives were launched in 2019: the UN Group of Government Experts (GGE) and a UN Open-Ended Working Group (OEWG). Although different in the groups’ mandates and composition, both discussed how to advance the three pillars of international law, norms and Confidence Building Measures, and what role capacity building should play.

In terms of guiding framework, the Global Forum on Cyber Expertise (GFCE) developed principles of Cyber Capacity Building (CCB) in its Delhi Communiqué on a Global Agenda for Cyber Capacity Building as the EU introduced a detailed set of cybersecurity capacity building principles that were then augmented by the EU cyber diplomacy principles. Against this backdrop, the OEWG has proposed its own set of principles. With this, the OEWG has broadened the number of states committing to the principles of CCB to all UN members.

Hence, it can be perceived that CCB has increasingly become more important. But not only this, the understanding and definition of CCB has broadened, too: the field is deepening in terms of the range of issues it tackles. It began with a focus on cybercrime, but has added protecting critical national infrastructure, strategic planning, public awareness, skills for the workforce, diplomacy etc. In addition, Cybersecurity has been further developed in parallel within different parent communities, including criminal justice, technical incident response, foreign policy, defence, development cooperation, civil society and the private sector, each with their own culture and aims. This development leads to fragmentation which is a challenge to having a coordinated approach. The GFCE is currently the sole multistakeholder forum dedicated to supporting coordination.

The guiding questions for the main session will be as follows:

1. Coming from a long journey that started in the mid 2000s: where are we now with CCB? Important milestones have been achieved, such as guiding principles of the OEWG, better coordination through GFCE- what is missing? Is it sufficient in order to address the challenges in terms of definition and understanding of CCB and enhanced coordination?

2. “Capacity” has been associated with having the resources to build institutional capacities, the maturity to deal with emerging threats, the skills within the national workforce, and the strategies and technologies in place to respond to incidents in a timely and coordinated manner. These capacities can be linked to development contexts and capabilities, they can also be associated with military capabilities. Hence, both can be used interchangeably to refer to ‘being able’ to conduct and maintain a ‘good’ cybersecurity.

In addition, in 2020 France, Egypt and 41 other countries sent a proposal for a UN Programme of Action that would, i.a., define the most urgent capacity building needs. what are these urgent needs from the speakers’ perspectives? Are they different depending on the countries’/stakeholders’ context?

3. Measuring CCB

Different instruments and frameworks have been devised to assess ‘capacity’, ‘maturity’, and ‘capability’ of states by establishing quantitative and qualitative variables for measurement, e.g., the Oxford Cybersecurity Capacity Maturity Model (CMM) and the International Telecommunications Union Global Cybersecurity Index (ITU GCI). What are experiences of the speakers and best practices when it comes to measure the “baseline” and progress?

4. Implementation

The number of countries and organisations involved in capacity building is growing. What have been the success factors for the implementation of CCB measures? What has worked and is the approach suitable for scaling-up?

5. OEWG

The OEWG started its second mandate (2021–2025). In November 2022, the First Committee of the UN General Assembly adopted a resolution on the programme of action (PoA) on cybersecurity, which proposes to establish a PoA as a permanent, inclusive, action-oriented mechanism after the OEWG 2021-2025 ends.

One of the challenges remains the participation of non-state stakeholders in the OEWG process. Which other challenge should the OEWG address? Which milestones and results can be expected from the OEWG till 2025?

Speakers:

• Abdul-Hakeem Ajijola, GFCE Title: Chair of GFCE Working Group on Cyber Incident Management & Critical Infrastructure Protectionroup (AUCSEG)
• Peggy Hicks, Director at the UN Office of the High Commission for Human Rights
• David Koh, Commissioner of Cybersecurity and Chief Executive of the Cyber Security Agency (CSA) of Singapore
• Pilar Saenz, Foundation Karisma, Colombia

Onsite Moderator: Anriette Esterhuysen, Former MAG Chair

Online Moderator: Sook-Jung Dofel, MAG Member

Rapporteur: Hariniombonana Andriamampionona, MAG Member