A Year of Some Consequence for Global Cyber Governance

Summary

Despite recent progress in establishing multilateral frameworks, obstacles to international cooperation on cyber issues remain. Disagreements over stakeholder participation in UN discussions and concerns about the adequacy of human rights protections under the Cybercrime Convention illustrate the difficulty of reconciling differing national interests and approaches. Thus, neither initiative guarantees effective implementation. Their collective contribution to global cyber governance will depend on whether States can manage their differences and sustain meaningful international cooperation.

In a year in which the UN system has struggled to address major global challenges, it has two major developments in cybersecurity to its credit. These are the establishment of a permanent global mechanism for dialogue and cooperation on cybersecurity, which began substantive discussions in July 2026, and the opening for signature of the UN Convention against Cybercrime in October 2025. India signed the Convention on 25 September 2026.[1]

The permanent mechanism is the outcome of a 20-year process that began with the first UN Group of Governmental Experts (UNGGE) established in 2004–2005, when cybersecurity was still largely regarded as a technical rather than a strategic issue. The growing sophistication of cyber threats and their increasing intersection with international security created added urgency to develop rules of the road in cyberspace through the UNGGE mechanism.

For a time, this mechanism provided some forward momentum, with the 2013 UNGGE report recognising the applicability of existing international law to cyberspace, while the 2015 report established 11 voluntary, non-binding norms of responsible state behaviour and advanced confidence-building and capacity-building measures.[2] Despite these milestones, the subsequently constituted UNGGE was undermined by growing geopolitical divisions in cyberspace and could not produce a consensus report in 2017, bringing the mechanism to a halt. It was resurrected in 2019, when the UN General Assembly established a new GGE alongside a parallel mechanism, the Open-Ended Working Group (OEWG).

While the UNGGE process was relatively exclusive, consisting of the first 15, and then 25 members, including the permanent members of the Security Council, the OEWG comprised all member countries of the United Nations, with civil-society groups allowed as observers and for secondary discussions and consultations. This reflected the view that a small group of countries could not develop rules governing cyberspace.

The parallel processes reflected both procedural and substantive differences over cyber governance. The United States favoured continuing the GGE process, with its limited membership and emphasis on building upon the existing consensus on responsible State behaviour and the application of international law. Russia, supported by China, advocated an OEWG open to all UN Member States and offering opportunities for wider stakeholder consultation. While this was presented as a more inclusive approach, the United States and other Western governments were concerned that the Russian initiative could reopen existing agreements and advance a more state-centric vision of cyberspace, emphasising sovereignty and control over information.

Both concluded their work in 2021 with consensus reports that reaffirmed key elements of the existing framework for responsible State behaviour in cyberspace. The OEWG’s work was subsequently continued through a second five-year process running from 2021 to 2025. A second OEWG, established in 2021, held sustained discussions on threats, international law, norms of responsible State behaviour, confidence-building and capacity-building. Its final report, adopted by consensus in July 2025, made several recommendations, including creating a permanent Global Mechanism to institutionalise this process.[3]

Criticisms of the OEWG Reports were similar to those directed at UNGGE reports: compared with the scale of the threats facing cyberspace, many recommendations were cautious, and the language was often deliberately generic. Many contentious issues, including the application of international humanitarian law, the development of new norms and the use of Information and Communication Technologies (ICT) in ongoing conflicts, were not covered.

Although the process had built in the participation of non-governmental stakeholders, many obstacles blocked their participation from the credentialing stage onward.  Nevertheless, the fact that 193 States, with sharply differing conceptions of sovereignty, international law and responsible behaviour in cyberspace, were able to conclude the five-year process with a consensus report is itself significant.[4]

The second OEWG recommended creating a permanent Global Mechanism in its consensus report of July 2025.  After formally establishing the permanent global mechanism, the mechanism held an organisational session in March 2026, followed by a first substantive plenary in July 2026. The recommendation for a permanent mechanism and the quick move toward establishment and substantive discussions are noteworthy and recognise that the UNGGE’s limited membership and the OEWG’s intermittent deliberations were not sufficiently robust mechanisms to respond to the challenges of cybersecurity. A standing forum was needed to address international cybersecurity needs on an ongoing basis.

The Global Mechanism retains the five pillars developed through the earlier UN processes: threats in the ICT domain; rules, norms and principles of responsible State behaviour; the application of international law; confidence-building measures; and capacity-building. To complement plenary discussions, dedicated thematic groups (DTGs) were constituted to discuss issues in more depth.[5] The first addresses specific ICT security challenges through a cross-cutting approach, while the second focuses on accelerating ICT security capacity-building.[6] The final arrangements did not include a separate thematic group on international law, including international humanitarian law (IHL), despite earlier proposals for dedicated discussions on applying international law to ICTs.

The difficulties that emerged at the mechanism’s first substantive plenary, held from 20 July to 24 July, demonstrate that institutionalisation does not eliminate the political disagreements that have characterised the UN cyber governance process. States discussed the 11 voluntary, non-binding norms agreed upon in 2015, with proposals to exchange national experiences, develop practical guidance, and use scenario-based exercises to improve understanding of how the norms apply.

The proceedings also demonstrated how difficult it will be to realise these goals. Disputes over the participation of civil society, academia and industry, in particular, showed that questions about the role of non-State stakeholders remain unresolved. Although the agreed modalities provide for stakeholder participation on a non-objection basis, member States’ objections blocked 50 of approximately 70 applications for accreditation to the July plenary.[7] The objections to stakeholder accreditation highlighted the difficulties of reconciling the Global Mechanism’s intergovernmental character with the participation of non-governmental actors and illustrate ongoing differences over how to maintain this balance in practice.[8]

The basic problems of funding, implementation, and compliance with voluntary norms remain unresolved, even as the permanent forum has started functioning. Establishing a permanent mechanism also does not guarantee that States will behave more responsibly in cyberspace. But in an increasingly contested cyber environment, creating such an institutional framework is progress in itself.

India has been an active participant in discussions at both the UNGGE and the OEWG, where it has emphasised capacity building, reflecting a long-standing concern that cybersecurity must account for the considerable differences in technological capabilities and institutional resources among states. At the July 2026 plenary, India also committed to funding the operationalisation of the proposed Global ICT Security Cooperation and Capacity Building Portal, with the Indian Computer Emergency Response Team (CERT-In) providing technical consultancy.[9] The portal is envisaged as a platform for sharing resources, capacity-building opportunities and information about national requirements. Its effectiveness will depend on whether States actively contribute to and use it. This initiative illustrates how the Global Mechanism could move beyond general declarations towards practical cooperation. It also tests whether a standing multilateral forum can help bridge capacity gaps that have long complicated international efforts to improve cybersecurity.

If the Global Mechanism represents an effort to institutionalise dialogue on responsible State behaviour in cyberspace, the Cybercrime Convention represents a parallel attempt to establish a common legal framework for international cooperation against criminal activity. The two address distinct but interconnected challenges and together mark a significant step forward in the UN’s approach to global cyber governance.

The proposal for a Cybercrime Convention is more recent, beginning with a proposal by the Russian Federation in 2019, which had 17 co-sponsors. On 27 December 2019, the General Assembly adopted Resolution 74/247, establishing an onerously named Ad Hoc Committee to Elaborate a Comprehensive International Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes.[10] Although the General Assembly established the Committee in December 2019 and scheduled it to begin work in 2020, the COVID-19 pandemic delayed its work; the organisational session took place in May 2021, with formal negotiations beginning in February 2022 after a further pandemic-related postponement.  States debated the scope of criminal offences, investigative powers, electronic evidence, and international cooperation over eight formal sessions and five intersessional stakeholder consultations, with many disagreements, particularly over the possibility of misusing the Convention. The General Assembly finally adopted a draft text of the Convention on 8 August 2024 and adopted it on 24 December 2024.[11]

The Convention includes procedures for obtaining and preserving electronic evidence, international cooperation (including mutual legal assistance and extradition), technical assistance and capacity-building, and safeguards relating to human rights and the application of domestic law.[12] Rather than establishing one broad, all-encompassing definition of cybercrime, the Convention is offence-specific and details the offences within its ambit. These included Illegal access to computer systems, Illegal interception of electronic data, Interference with computer data or systems, Misuse of devices intended to facilitate such offences and certain offences involving online child sexual abuse or exploitation (CSAM). States were required to criminalise these offences under their respective domestic law and establish procedures and mechanisms for international cooperation in investigating and prosecuting them.[13]

The Convention was opened for signature at a ceremony in Hanoi, Vietnam, in October 2025. As of October 2026, the Convention had attracted 95 signatories (including India, which signed in September 2026), but only three States (Azerbaijan on 15 April 2026, Qatar on 4 February 2026, and Viet Nam on 17 April 2026) had ratified it, with 40 ratifications required for it to enter into force, indicating that the path to implementation remains uncertain. Implementation challenges emerged even before the Convention entered into force. At a meeting in Vienna in January 2026, States could not agree on the rules of procedure for its future Conference of the States Parties.[14] As with the Permanent Mechanism, one of the principal disagreements concerned participation by civil society, academia, and other non-governmental stakeholders. While some governments saw no space for them, emphasising the Convention’s intergovernmental character and national sovereignty, others supported more inclusive and transparent participation.

The Convention’s adoption has also not resolved the substantive disagreements that marked its negotiation. Supporters view a universal framework as a way to address the difficulties of obtaining electronic evidence across borders, particularly when investigations involve jurisdictions with limited existing cooperation arrangements. Critics, including human rights and digital rights organisations, have raised concerns about the breadth of investigative powers, the sharing of electronic evidence relating to a wide range of serious crimes, and the reliance on domestic law for key safeguards. They fear that differences in national legislation and standards of judicial oversight could permit the Convention’s mechanisms to be used against legitimate political expression, journalism or other protected activities.[15] The Convention contains human rights provisions and grounds on which cooperation may be refused, but critics argue that these do not provide sufficiently consistent safeguards across jurisdictions.

A secondary question is how the Convention will operate alongside existing international arrangements, particularly the Budapest Convention on Cybercrime.[16] The Budapest Convention on Cybercrime, adopted under the auspices of the Council of Europe in 2001, was the first binding international treaty specifically addressing cybercrime. Although open to accession by non-European States, it has not achieved universal participation; most members are from Europe, and Africa and Asia together account for about 25 per cent.[17] India, while supporting its objectives in principle, expressed reservations about certain provisions and favoured a broader framework negotiated under UN auspices.

The new treaty thus has partly emerged from the view that a universal framework was needed to facilitate cooperation among States with different legal systems and levels of capacity.[18] A common treaty may make cooperation possible where bilateral or regional arrangements are limited. Still, it does not automatically resolve differences over jurisdiction, evidentiary standards, or the protection of individual rights. Much will therefore depend on how States implement the Convention domestically and how they apply its cooperation provisions in practice.

The Global Mechanism and the Cybercrime Convention address different but complementary dimensions of cybersecurity: responsible State behaviour and cooperation in criminal justice. States may themselves be implicated in cyber operations, or their territories and infrastructure may also be exploited by cybercriminals, particularly where limited capacity constrains their ability to detect or prevent such activity. Unless there is progress on both fronts, these challenges will persist. The successful conclusion of both processes demonstrates that multilateral cooperation remains possible where common frameworks are necessary, despite deep geopolitical divisions. Yet these same divisions are likely to constrain further progress.

The Global Mechanism does not create new binding obligations, and its effectiveness will depend on whether States use it to develop shared understandings, implement existing commitments and build confidence. The Cybercrime Convention, by contrast, establishes treaty obligations. Still, these will become operative only after the Convention enters into force once 40 countries have ratified it, and only for those countries that have ratified it.  Even after that threshold is reached, its effectiveness will ultimately depend on ratification by all participating States, domestic implementation, and governments’ willingness to cooperate. Ultimately, the significance of both developments will depend not simply on the agreements reached, but on whether States translate them into meaningful participation and practical cooperation.

Views expressed are of the author and do not necessarily reflect the views of the Manohar Parrikar IDSA or of the Government of India.

[1] “EAM Jaishankar Signs UN Convention against Cybercrime”, DD India, 26 September 2026.

[2] “Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security: Note by the Secretary-General”, United Nations, 22 July 2015.

[3] “Final Report of the Open-ended Working Group on Security of and in the Use of Information and Communications Technologies 2021–2025”, United Nations, 11 July 2025, p. 1.

[4] Vladimir Radunović et al., “UN OEWG Concludes, Paving Way for Permanent Cybersecurity Mechanism”, Geneva Internet Platform (GIP), Digital Watch Observatory, 17 July 2025.

[5] “Final Report of the Open-ended Working Group on Security of and in the Use of Information and Communications Technologies 2021–2025”, no.3, pp. 19–20.

[6] “Letter from the Chair‑Designate to the Global Mechanism on ICTs in the Context of International Security”, United Nations Office for Disarmament Affairs, 19 March 2026.

[7] “(1st Meeting) Plenary Session, Global Mechanism on ICTs in the Context of International Security (20–24 July)”, United Nations, 20 July 2026.

[8] “Joint Multistakeholder Statement on the Objections to the Participation of Stakeholders in Plenary Meetings and Review Conferences of the UN Global Mechanism”, United Nations Office for Disarmament Affairs, 22 July 2026.

[9] “India to Fund Portal for UN for Global ICT Security”, The Economic Times, 24 July 2026.

[10] “Countering the Use of Information and Communications Technologies for Criminal Purposes”, Resolution A/RES/74/247, United Nations General Assembly, 20 January 2020.

[11] “United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes: Resolution Adopted by the General Assembly”, Resolution A/RES/79/243, United Nations General Assembly, 31 December 2024.

[12] “United Nations Convention against Cybercrime”, United Nations Office on Drugs and Crime, 2024.

[13] “Ad Hoc Committee on Cybercrime”, Geneva Internet Platform (GIP), Digital Watch Observatory, 2026.

[14] “EU Statement at the Ad Hoc Committee to Prepare the Draft Text of the Rules of Procedure for the Conference of the States Parties to the UN Convention against Cybercrime”, European External Action Service (EEAS), 26 January 2026.

[15] “Joint Statement on the Proposed Cybercrime Treaty Ahead of the Concluding Session Submitted by participating NGOS”, United Nations Ad Hoc Committee on Cybercrime, 23 January 2024.

[16] “Conventions on Cybercrime: The Budapest Convention and the Draft UN Treaty”, Council of Europe, 27 August 2024.

[17] “The Convention on Cybercrime (Budapest Convention, ETS No. 185) and its Protocols”, Council of Europe, 2026.

[18] “Recommendation for a Council Decision Authorising the Negotiations for a Comprehensive International Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes”, European Commission, 29 March 2022.