Geneva Dialogue on Responsible Behaviour in Cyberspace

Geneva Dialogue on Responsible Behaviour in Cyberspace
Name	Geneva Dialogue on Responsible Behaviour in Cyberspace
Formation	2019
Headquarters	Geneva
Region served	International
Leader title	Convenor

Geneva Dialogue on Responsible Behaviour in Cyberspace is an international consultative process convened to advance norms for state conduct in cyberspace through multilateral dialogue among states, industry, and civil society. Launched with support from diplomatic actors and technical institutions, the process brings together representatives from diverse actors to negotiate confidence-building measures and clarify obligations in cyber operations. The Dialogue operates alongside parallel tracks in intergovernmental forums and transnational initiatives to influence the development of international cyber norms and legal interpretations.

Background and Establishment

The Geneva Dialogue was initiated following discussions in forums such as the United Nations General Assembly, UN GGE and the UN OEWG, drawing on precedents set by the Tallinn Manual project, meetings at the World Economic Forum, and regional cybersecurity exercises like Locked Shields. Founding support came from diplomatic missions in Geneva, technical organizations including the Internet Society, and policy research institutions such as Chatham House and the Geneva Centre for Security Policy. The initiative was announced amid parallel norm-development efforts at the OSCE, the African Union, and the European Union cybersecurity policy community.

Principles and Objectives

The Dialogue promotes adherence to principles articulated in instruments including the Tallinn Manual 2.0, the UN Charter, and consensus language from the UN GGE reports, aiming to clarify how international law applies to state behavior in cyberspace. Objectives include reducing escalation between states like United States, Russian Federation, and People's Republic of China through risk reduction measures, promoting responsible disclosure practices endorsed by Microsoft, Google, and Apple, and integrating perspectives from the World Health Organization and International Committee of the Red Cross on critical infrastructure resilience. The process seeks to harmonize approaches favored by actors such as NATO, ASEAN, and the African Union Commission with private-sector frameworks advanced by ICANN and FIRST.

Participants and Membership

Participation is open to national delegations, industry representatives from firms like Cisco Systems, IBM, Amazon Web Services, and civil society organizations including Human Rights Watch, Access Now, and Electronic Frontier Foundation. Academic contributors have come from institutions such as Harvard University, Oxford University, and École polytechnique fédérale de Lausanne. Observers include intergovernmental bodies like the International Telecommunication Union, the Council of Europe, and regional bodies such as the Organization of American States. States represented have ranged from France, Germany, and United Kingdom to Brazil, India, and South Africa, with participation also from small states active in cyber diplomacy like Estonia and Singapore.

Key Meetings and Outcomes

Early sessions mirrored discussions at the Geneva Internet Governance Forum and produced non-binding outcome documents echoing recommendations in the Tallinn Manual and the UN GGE reports. Notable outcomes include consensus language on protecting medical devices and energy infrastructure during crises—issues previously raised in the WannaCry and NotPetya incidents—and adoption of voluntary reporting formats similar to those used in Prime Ministerial-level cybersecurity dialogues. The Dialogue served as a venue for joint statements involving delegations from United States and Russian Federation on crisis communications, and for technical briefings used by delegations to inform contributions to the UN OEWG and the OSCE confidence-building workshops.

Implementation Mechanisms and Confidence-Building Measures

Implementation has emphasized transparency measures such as voluntary incident reporting, hotlines for incident response modeled on protocols from CERT Coordination Center and CCDCOE, and exercises analogous to Cyber Storm and Locked Shields. Confidence-building measures promoted include mutual notifications of major cyber incidents, information-sharing partnerships akin to arrangements between Interpol and national law enforcement, and capacity-building programs delivered with assistance from World Bank and UNDP to strengthen national Computer Emergency Response Teams like CERT-EU.

Criticisms and Challenges

Critics cite limited binding authority compared with treaties such as the Budapest Convention and note uneven participation by major cyber powers including the People's Republic of China and Russian Federation in some sessions. Analyses by think tanks such as RAND Corporation and Carnegie Endowment for International Peace highlight difficulties reconciling divergent positions on sovereignty, attribution, and offensive operations reflected in disputes over proposals reminiscent of debates at the Tallinn Manual workshops. Other challenges involve integrating commercial actors like Huawei and TikTok with security-sensitive state actors, and bridging differences between human-rights advocates from Amnesty International and national security agencies from Japan and Israel.

Influence on International Cyber Norms and Law

The Dialogue has contributed to the diffusion of non-binding norms that have informed resolutions at the United Nations General Assembly and guidance by bodies like the Council of Europe and NATO. Its outputs have informed national cyber strategies promulgated by states including United Kingdom and Canada, and technical standards advanced by IETF and ISO. While not a treaty-making forum like negotiations under the United Nations Convention on Certain Conventional Weapons, the Dialogue functions as a convening mechanism shaping practice, assisting adjudicators and policymakers interpreting international law in cases involving actors such as Sony Pictures Entertainment and incidents traced to groups linked to states.

Category:Internet governance