UN GGE

UN GGE
Name	UN GGE
Formation	2004
Purpose	Study of information security and cyber norms
Parent organization	United Nations
Headquarters	New York City

UN GGE The UN GGE is a United Nations-established group convened to analyze issues of information security, state behavior in cyberspace, and the applicability of international law. It brings together experts and representatives from member states, academic institutions, think tanks, and international organizations to produce consensus-based reports informing bodies such as the United Nations General Assembly, UN Security Council, International Court of Justice, and International Telecommunication Union. The group’s outputs have influenced debates involving actors like European Union, United States, Russian Federation, People's Republic of China, and regional organizations including African Union and Association of Southeast Asian Nations.

Background and mandate

The GGE was established following discussions at the United Nations General Assembly and work by subsidiary organs such as the United Nations Office for Disarmament Affairs and the United Nations Institute for Disarmament Research. Its mandate includes studying threats to international peace and security linked to information and communications technologies, clarifying how instruments like the Charter of the United Nations and treaties such as the Geneva Conventions apply to cyber operations, and recommending cooperative measures for confidence-building among states. The mandate has been shaped by inputs from actors including NATO, Organisation for Economic Co-operation and Development, Commonwealth of Nations, Council of Europe, World Bank, and scholarly centers like Harvard University, Stanford University, and Oxford University.

Membership and structure

Membership comprises experts nominated by member states in line with resolutions adopted by the United Nations General Assembly; participating states have included United States, United Kingdom, France, Germany, Japan, Brazil, India, South Africa, Brazil, Mexico, Australia, Canada, Italy, Spain, Netherlands, Sweden, Norway, Argentina, Turkey, Israel, Saudi Arabia, United Arab Emirates, Egypt, Nigeria, Kenya, Indonesia, Malaysia, Philippines, Thailand, Vietnam, Pakistan, Bangladesh, Sri Lanka, Colombia, Chile, Peru, Poland, Belgium, Switzerland, Austria, Greece, Portugal, Romania, Bulgaria, Hungary, Czech Republic, Slovakia, Ireland, Denmark, Finland, Iceland, New Zealand, South Korea, North Korea and others at various times. Structurally, the GGE operates under chairpersons drawn from member states, with secretariat support from United Nations Office at Geneva and liaison with agencies such as the International Telecommunication Union and Interpol. It assembles thematic panels with contributors from institutions like Massachusetts Institute of Technology, Carnegie Endowment for International Peace, Chatham House, Brookings Institution, and Council on Foreign Relations.

Key reports and findings

GGE reports have been issued periodically and have addressed topics including the applicability of the Charter of the United Nations to cyber operations, state responsibility under customary international law as discussed in the International Law Commission outputs, norms for responsible state behaviour akin to proposals from European Union External Action Service, and measures to prevent escalation involving actors such as NATO and Shanghai Cooperation Organisation. Major findings include that existing international law applies to cyberspace, that certain cyber activities can amount to uses of force under precedent involving the International Court of Justice and state practice, and recommended voluntary norms similar to those advocated by Microsoft, Google, Facebook, Amazon, and civil society organizations like Electronic Frontier Foundation and Human Rights Watch.

Major sessions and outcomes

Notable GGE sessions produced consensus reports in years when chairpersons from states such as United States Department of State-affiliated officials, representatives from Russian Federation Ministry of Foreign Affairs, and envoys from China Ministry of Foreign Affairs led deliberations. Outcomes have included consensus language on peacetime confidence-building measures, proposals for information-sharing frameworks echoing mechanisms used by NATO Cooperative Cyber Defence Centre of Excellence, and endorsements of capacity-building initiatives similar to those by UN Development Programme and World Bank Group. Sessions have influenced multilateral processes at forums like the Geneva Internet Platform, Internet Governance Forum, and negotiations tied to instruments such as the Budapest Convention on Cybercrime.

Influence on international law and norms

GGE outputs have been cited in debates before the International Court of Justice, in national policy documents of United States Department of Defense, Ministry of Defence (United Kingdom), and in white papers from Russian Federation Armed Forces and People's Liberation Army. They have informed norm-building efforts led by European Union, African Union, and coalitions like the Global Commission on the Stability of Cyberspace and have guided private sector standards from entities such as Internet Corporation for Assigned Names and Numbers, Institute of Electrical and Electronics Engineers, and International Organization for Standardization. GGE recommendations have shaped capacity-building funded by United Nations Development Programme, World Bank, Asian Development Bank, and bilateral programs from Japan International Cooperation Agency and United States Agency for International Development.

Criticisms and controversies

Critics from academia and policy communities including scholars at Princeton University, Yale University, Columbia University, and advocacy groups like Amnesty International have argued the GGE’s consensus approach produces lowest-common-denominator language that may obscure state practice differences among United States, Russian Federation, and People's Republic of China. Controversies include disputes over attribution norms involving companies such as Kaspersky Lab and incidents attributed to actors tied to Fancy Bear, Cozy Bear, Lazarus Group, and state responses framed by doctrines discussed in NATO summit communiqués. Other criticisms focus on participation transparency, the exclusion of some non-state stakeholders active in forums like Internet Governance Forum and Global Forum on Cyber Expertise, and competition with parallel tracks such as the Open-Ended Working Group and regional initiatives by Association of Southeast Asian Nations Regional Forum.

Category:United Nations bodies