Geneva Dialogue

Vulnerabilities in Digital Products: How Does This Impact the World Around Us?
2023-03-29 11:00 - 12:00 (Europe/Zurich)
What do the SolarWinds hack, the use of Pegasus spyware, and the Colonial Pipeline ransomware attack have in common? Even though they have different targets, threat actors, and impacts, they all exploit software vulnerabilities.
Vulnerabilities in digital products remain an almost indispensable component of cyberattacks, especially high-impact ones.
In this Geneva Dialogue webinar, together with expert panellists, we will discuss:

How do vulnerabilities emerge, how are they exploited, and to what end?
What can we learn from these exploitations?
What role do software vulnerabilities play in today’s digitalised society?

About the Geneva Dialogue
The Geneva Dialogue on Responsible Behaviour in Cyberspace is led by the Swiss Federal Department of Foreign Affairs (FDFA) and implemented by Diplo. It aims to map the roles and responsibilities of actors (states, the business sector, civil society, and the academic and tech communities ) in contributing to greater security and stability in cyberspace in the context of international peace and security, identify good practices and possible gaps in existing efforts, and, ideally, put forward recommendations for overcoming such gaps.
Event recording

Vulnerabilities in digital products: How can humans decrease risks for humans?
2023-04-04 11:00 - 12:00
Who is responsible for vulnerabilities in digital products and supply chain security? Who is primarily expected to take action?
What can vendors, manufacturers, regulators, policymakers, diplomats, and users do to minimise risks in cases of such vulnerabilities?
In the first Geneva Dialogue webinar on software vulnerabilities, the aim was to set the scene on the risks brought about by vulnerabilities in digital products. In this second webinar, we dive deeper into the perspective of different actors and discuss recent initiatives such as the EU Cyber Resilience Act, and calls for shifting responsibility to manufacturers in the US National Cybersecurity Strategy.
To join and contribute to the discussion, register using the link below, and join us live on Tuesday, 4 April 09:00-10:00 UTC (11:00-12:00 CEST).
About the Geneva Dialogue
The Geneva Dialogue on Responsible Behaviour in Cyberspace is led by the Swiss Federal Department of Foreign Affairs (FDFA) and implemented by Diplo. It aims to map the roles and responsibilities of actors (states, the business sector, civil society, and the academic and tech communities ) in contributing to greater security and stability in cyberspace in the context of international peace and security, identify good practices and possible gaps in existing efforts, and, ideally, put forward recommendations for overcoming such gaps.
Event recording

Cyber norms in action: How to translate diplomatic agreements into real security for us all?The launch of the Geneva Manual
2023-12-07 10:00 - 16:30
Vulnerabilities in digital products and networks leading to cyberthreats raise security concerns from individual users to international security and peace. While States hold primary responsibility, meaningful cooperation with non-state actors, such as the private sector, academia, civil society, and the technical community, is crucial to foster a secure, open, and peaceful cyberspace. However, what are those other actors expected to do? Where and how can they support states in ensuring the security and stability in cyberspace?
Join us on December 7th for the launch of the Geneva Manual – a comprehensive guide on non-state actors’ contributions to the implementation of cyber norms.
The Geneva Manual will undergo continuous development in the years ahead to encompass a wide range of cyber norms, guided by discussions with the multistakeholder community.
Established by the Swiss Federal Department of Foreign Affairs and led by DiploFoundation, with support of the Republic and State of Geneva, C4DT, Swisscom and UBS, the Geneva Dialogue particularly asks how the norms and confidence-building measures (CBMs) might be best operationalised (or implemented) by relevant actors as a means to contribute to international security and peace.
The inaugural edition of the Manual focuses on two norms related to supply chain security and responsible reporting of ICT vulnerabilities.
The event will take place in a hybrid format: to register to participate online, please follow this link.
Short videosSorry, your browser doesn't support embedded videos.Sorry, your browser doesn't support embedded videos.PROGRAMMEEvent recording

Side-event on “Sharing best practices for implementing responsible behavior in cyberspace” organized by the Mission of the Netherlands
2024-01-23
The Geneva Dialogue participated in the side event on “Sharing best practices for implementing responsible behavior in cyberspace” organized by the Mission of the Netherlands. Imad Add (Center For Digital Trust at EPFL) represented the Geneva Dialogue as a member of the Core Group and one of the most active experts of the Dialogue.

This event brought together different stakeholders and examined how the international community has been progressing in implementing the normative framework endorsed by the UN General Assembly and what still needs to be done. In this context, the first edition of the Geneva Manual was cited as an example of a multistakeholder effort to facilitate responsible behavior in cyberspace.

The Geneva Manual side-event during the UN OEWG 7th substantive session
2024-03-07 13:15 - 14:45
On 7 March in New York, the Geneva Dialogue organised the side-event during the 7th substantive session of the UN Open-ended working group (OEWG). The event was co-sponsored by Switzerland, Canada, Chile, the Netherlands, and DiploFoundation, and gathered around 40 experts representing governments and non-state stakeholders.
Ambassador Adrian Hauri, Deputy Permanent Representative, Permanent Mission of Switzerland to the UN welcomed participants, highlighting Switzerland’s commitment to a secure, free, and open cyberspace, in line with international law, human rights, and international humanitarian law.

Vladimir Radunović, Director of E-diplomacy and Cybersecurity Programmes at Diplo provided a comprehensive overview of the first chapter of the Geneva Manual on Responsible Behaviour in Cyberspace, launched in December 2023.

Participants, including industry representatives and diplomats discussed how existing cyber norms assist each of us – representatives of various stakeholder groups and organisations – in promoting responsible behaviour in cyberspace, and what possible roles and responsibilities stakeholders shall implement to minimise security risks while producing digital products or when using them. An interactive tabletop exercise, based on the roles in the Geneva Manual, was organised after to discuss challenges related to responsible vulnerability disclosure and relevant roles and responsibilities of stakeholders to ensure the security of digital products and services.

The event underlined the need to translate cyber norms into actionable practices and the importance of capacity building. It was also announced that in 2024 the Geneva Dialogue will start a new phase discussing the norms and confidence-building measures (CBMs) related to critical infrastructure protection (CIP).

The Geneva Manual side-event at the OSCE
2024-03-12 09:30 - 11:00
On 12 March in Vienna, the Geneva Dialogue organised the side-event: “The Geneva Manual on Responsible Behaviour in Cyberspace and its application in the OSCE region: The Role of Non-State Stakeholders in Enhancing Cybersecurity and Building Confidence”.
The side event discussed the roles and responsibilities of various stakeholders in promoting responsible behaviour in cyberspace, namely through the operationalisation of the 11 cyber norms, as agreed in the 2015 UN GGE report, and confidence-building measures (CBMs).

The discussion centred around the Geneva Manual, a comprehensive guide which documents the views of relevant stakeholders, in particular the technical community and the private sector, for the operationalisation of the agreed norms, CBMs, good practices, and their application in the Organization for Security and Co-operation in Europe (OSCE) region. In particular, the side event discussed how the Geneva Manual can facilitate the implementation of the relevant OSCE CBMs (including CBM 4, 14, 15, and 16).
Ambassador Raphael Nägeli, Permanent Representative of Switzerland to the OSCE welcomed participants, highlighting Switzerland’s commitment to a secure, free, and open cyberspace, in line with international law, human rights, and international humanitarian law.

Panellists, including Daniel Klingele, Senior Advisor, International Security Division, FDFA and Swiss representative to the UN OEWG; Sofia Martinez Gomez, Member of the Geneva Dialogue Core Group, and Anastasiya Kazakova, Cyber Diplomacy Knowledge Fellow, DiploFoundation discussed what challenges exist for relevant stakeholders to help effectively operationalise the OSCE CBMs and address the security of and in the use of ICTs, as well as what contribution the Geneva Manual makes to support the operationalisation of the OSCE CBMs. The roundtable was moderated by Serge Droz, Senior Adviser, FDFA.

Geneva Dialogue masterclass:The role of regional organisations to facilitate the implementation of cyber norms and CBMs
2024-03-20 13:00 - 15:00
On 20 March, the Geneva Dialogue on Responsible Behaviour in Cyberspace organised a masterclass, the first one in a series in 2024, to start analysing the implementation of the existing norms and confidence-building measures (CBMs) related to critical infrastructure protection. In particular, the masterclass focused on the work of regional organisations: their ongoing projects, priorities, and possible opportunities to engage relevant stakeholders to support states in the implementation of the existing norms and CBMs. The format of masterclasses allows active learning and knowledge sharing among the Geneva Dialogue experts and invited keynote speakers from different fields such as cyber diplomacy, technology, and cybersecurity. The online event took place under Chatham House rules. Below, we’re sharing some of the takeaways from the discussion.
The representatives of four regional organisations and unions such as the African Union, Association of Southeast Asian Nations (ASEAN), Organization of American States (OAS), and Organization for Security and Co-operation in Europe (OSCE), shared their experiences and initiatives in promoting the operationalisation of the UN cyber-stability framework. The four keynote presentations have demonstrated the growing maturity of regional approaches to enhance international cooperation, transparency, and trust building in cyberspace governance.
In particular, the OSCE is considered a pioneer in developing cyber CBMs, drawing on its experience in disarmament affairs. Since 2012, an informal working group has been drafting CBMs for cyberspace, leading to the adoption of 16 non-binding voluntary CBMs aimed at transparency, cooperation, and resilience. These 16 CBMs can be categorised into three main groups: posturing (increasing transparency of state posture in cyberspace), communication (facilitating timely communication and cooperation between states), and preparedness/resilience (promoting national preparedness and cyber resilience). One of the CBMs, i.e. CBM #8, involves the nomination of technical or policy points of contact for cybersecurity by participating states. These contacts facilitate communication, coordination, and exchange of information, contributing to cyber-stability.
The CBMs have also been an important pillar in the approach taken by the OAS in the Latin American and Caribbean region. The OAS cybersecurity program operates within the Inter-American Committee Against Terrorism (CICTE). In 2016, the OAS started to look at the non-traditional CBMs related to cyberspace. In 2018, the OAS adopted a resolution stressing the need to prepare and agree upon a set of CBMs for cyberspace in order to enhance interstate cooperation and transparency. One of the further successes for the OAS region was the establishment of the point of contacts directory, which currently includes over 82 cyber policy points of contacts, and 19 ministers of foreign affairs contacts. For those who may be wondering why there are no technical points of contacts, the OAS established the network of government cyber incident response teams (CSIRT) of OAS Member States. The CSIRTAmericas Network is now a cybersecurity community which includes over 47 CERTs from 22 countries along with 379 professionals.
When it comes to Africa, the countries are facing numerous challenges such as the lack of capacities, political will, and sufficient awareness among states. More specifically, the need for public–private partnerships to build capacities and means to gather up-to-date threat intelligence to promote collective responses to cyberthreats has been highlighted. Despite these challenges, the African Union has announced several important initiatives ( e.g. the establishment of the African Union Cyber Security Expert Group, aimed at providing guidance on cyber policies and strategies, as well as recents initiatives to establish cyberthreat information sharing platforms and capacity-building programs.
When discussing the developments in the ASEAN region, it was highlighted that the countries’ leaders first endorsed the voluntary cyber norms in 2015, with subsequent establishment of a working committee to develop a regional action plan. The major focus was on capacity building, i.e. the establishment of dedicated cybersecurity agencies in member states and ongoing efforts to develop regional action plans and metrics for implementing cyber norms. In 2021, the Member States also adopted the ASEAN Cybersecurity Cooperation Strategy, which outlines five focus areas for advancing cyber readiness, strengthening international cyber policy coordination, enhancing trust in cyberspace, and regional capacity building.
The ASEAN countries were also successful in advancing the regional action plan metrics developed to identify capabilities required for norm implementation and to facilitate cooperation and capacity-building activities within ASEAN.
During the session, the role of non-state actors was underscored as essential for the practical implementation of these norms and measures. Furthermore, it has been discussed that the implementation of cyber norms and CBMs is an ongoing and collaborative process requiring multistakeholder engagement. The need for improved communication, education, and institutional memory was highlighted to ensure sustained knowledge and engagement among diplomats and technical experts

The Geneva Manual on Responsible Behaviour in Cyberspace: The Role of Non-State Stakeholders in the Implementation of Norms
2024-05-27 13:00 - 14:30
Virtual discussion at the GFCE Working Group A&B

Is there a need, and why, for an international approach to protect critical infrastructure (CI)? Are there any additional sectors or dependencies which should be categorised as critical? What are the main existing and emerging threats and risks to CIP, considering the emerging tech such as Artificial Intelligence (AI)? What would minimum cybersecurity measures for CIP include? What are the examples of working regional/international arrangements to respond to ICT incidents affecting CI? And how do existing cyber norms assist stakeholders in promoting responsible behaviour in cyberspace and ensuring CIP?
On 27 May the Global Forum on Cyber Expertise (GFCE) Working Group A and B and Geneva Dialogue on Responsible Behaviour in Cyberspace organised a joint interactive virtual discussion to discuss the implementation of agreed cyber norms, including on critical infrastructure protection.
The session started with the presentation of the first chapter of the Geneva Manual, which focuses on norms related to supply chain security and the reporting of ICT vulnerabilities. The first chapter highlights the substantial role of the private sector in their implementation of these norms, but also acknowledges the critical function of civil society and academia in raising awareness about cybersecurity issues and influencing policy and corporate governance.
During the roundtable discussion, participants debated whether an international approach is needed to protect critical infrastructure, which is currently defined and regulated at the national level. Some participants supported a common approach based on guidelines to identify what constitutes critical infrastructure in different countries. They emphasized the need for a shared understanding of what critical infrastructure is. Additionally, participants highlighted the importance of informal communication channels in managing incidents and exchanging vulnerability information.
For the simulation exercise, participants were divided into two groups to play different roles: a telecommunications company as a critical infrastructure facility and a national cybersecurity agency. Each group received messages and questions to develop a response.
In the group representing a critical infrastructure facility, participants stressed the importance of clear roles and responsibilities between the facility operator and its service providers, as well as the implementation of zero-trust architecture. In the event of a data breach, security operations centers (SOCs) were noted as crucial for monitoring systems, whether on-premises or in the cloud. Clear communication with customers and authorities, based on detailed information and forensic analysis, was also highlighted as an essential step in incident response.
The discussions highlighted the complexities of responding to cybersecurity incidents, especially those involving third-party service providers. The exercise underscored the need for clear communication channels, international cooperation for cross-border cybersecurity threats, and robust incident response planning. Participants also noted the potential benefits of cyber insurance for recovery efforts after a cyberattack.
Another group discussed the security incident from the perspective of a national cybersecurity agency. They debated how much information to share with a neighboring country’s national CERT, which had been hit by a ransomware attack and was requesting assistance. The discussion considered the Traffic Light Protocol (TLP) classification and the implications of sharing sensitive information. They also discussed existing relationships between agencies and the need for a pre-established information-sharing platform. The importance of adhering to cyber norms and establishing a mechanism for mutual assistance in cybersecurity incidents was emphasized.
The session concluded with stressing the importance of the exercise in understanding the nuances of agreed-upon cyber norms and the need for preparedness and collaboration among stakeholders.

The Geneva Manual: How Do Cyber Norms Guide Us In Protecting Critical Infrastructure? Singapore International Cyber Week
2024-10-16 04:00 - 06:00
Cyber threats targeting critical infrastructure (CI) and assets, often undetected by the victim, have become the ‘new normal’ in today’s heightened geopolitical climate. Additionally, decision-makers are concerned not only with malicious cyber activities, but also with faulty and insufficiently secure software development practices that can cause global disruptions due to interconnected supply chains.
To maintain international security and peace, do we – both state and non-state stakeholders – know what is the right thing to do to secure critical assets? How do the agreed cyber norms support operators of critical facilities and other relevant stakeholders? Which questions should actors focus on to reduce harm from cyber threats affecting CI?
On 16 October, the Geneva Dialogue organised a multistakeholder session to discuss these questions in the context of the the Geneva Manual on Responsible Behaviour in Cyberspace, a comprehensive guide on the implementation of cyber norms and confidence-building measures (CBMs) by non-state stakeholders. The session took place during the 2024 Singapore International Cyber Week (SICW).
Dr. Regula Kurzbein, Deputy Head of Mission at the Embassy of Switzerland in Singapore, and Mr. Christopher Anthony, Director of the Critical Information Infrastructure Division at the Cyber Security Agency of Singapore (CSA), delivered opening remarks, emphasising the importance of international multistakeholder efforts in safeguarding critical infrastructure.

Following their remarks, a roundtable discussion was led by Mr. Benjamin Ang, Head of the Centre of Excellence for National Security (CENS), Future Issues in Technology (FIT) at the S. Rajaratnam School of International Studies (RSIS). The discussion focused on three key questions:

How can we effectively protect critical infrastructure, facilities, and assets with regional or international significance? What measures should be implemented, and which stakeholders should be engaged?
Can cyber operations avoid targeting critical infrastructure, or is that an unrealistic expectation?
How do we establish accountability for damage caused by threats to critical infrastructure, especially when established norms are violated?

To gain insights from various stakeholders (government, critical infrastructure industries, and the cybersecurity research community), the Geneva Dialogue organised a tabletop exercise. Participants were divided into three groups, each led by a team captain: Mr. Teo Xiang Zheng, Vice President of Advisory at Ensign InfoSecurity; Mr. Steven Sim Kok Leong, Chair of the Executive Committee at the Operational Technology Information Sharing and Analysis Centre (OT-ISAC); and Mr. Eugene EG Tan, Associate Research Fellow at RSIS.

Securing critical infrastructure in cyber: Who and how?
2024-12-18 11:45 - 13:15 | Riyadh
In an era where interdependencies stretch across borders and hybrid threats blur the lines between cyber and physical domains, a critical question emerges: Are states and key stakeholders truly prepared to protect critical infrastructure (CI)?
With the shifting nature of cyber threats, how can relationships between public and private actors evolve to better protect CI in both peacetime and conflict? How do advances in technology, from AI to IoT, influence strategies for critical infrastructure protection (CIP), and should there be a baseline of international cybersecurity standards for CIP?
Further, as the agreed UN cyber norms gain traction, what role can they play in approaching CIP? Is there sufficient clarity in the responsibilities of non-state stakeholders, and how might these stakeholders support states in fostering responsible behaviour in cyberspace?
On 18 December at the UN IGF, the Geneva Dialogue on Responsible Behaviour in Cyberspace will address these concerns in a multistakeholder approach, engaging representatives from the private sector, academia, civil society, and technical community for a regular dialogue. Established by Switzerland in 2018 and implemented by DiploFoundation with support of others, the Dialogue maps the roles and responsibilities of various actors in the implementation of agreed cyber norms and thus contributes to stability and security in cyberspace.
The outcomes are published in the Geneva Manual, offering a comprehensive guidance on non-state actors’ implementation of the normative framework agreed by states, in the context of the UN GGE/OEWG. The session will bring together actors, including those from the Global South, to discuss the issues identified above, provided also in a format of a scenario-based discussion, i.e. simulation exercise. The insights gathered during the session will contribute to the forthcoming chapter of the Geneva Manual, focusing on the implementation of CIP related norms and confidence-building measures (CBMs).
Participants will also learn best practices, develop ideas, and network with thought leaders in the field of cyber policy for critical infrastructure.
Speakers and facilitators:

Bushra AlBlooshi, Director of Cybersecurity Governance Risk Management Department, Dubai Electronic Security Center
Kazuo Noguchi, Senior Manager R&D, Hitachi America
Nicolas Grunder ,Global Lead Counsel Digital, Data & Cyber, ABB
Kaleem Usmani, Head of the CERT-MU, Mauritius
Klée Aiken, Director, Community & Capacity Building, the Forum of Incident Response and Security Teams (FIRST)
Melanie Kolbe-Guyot, Head of Digital Policy, C4DT – EPFL
Vladimir Radunović, Director, E-diplomacy and Cybersecurity Programmes, DiploFoundation
Anastasiya Kazakova, Cyber Diplomacy Knowledge Fellow, DiploFoundation

PROGRAMME

Geneva Dialogue session 'Critical infrastructure protection: Who is responsible?' during the WEF 2025
2025-01-21 16:00 - 18:00 | House of Switzerland in Davos
On 21 January from 16:00 to 18:00 pm CET the Geneva Dialogue on Responsible Behaviour in Cyberspace hosted the session at the Geneva Day at the House of Switzerland in Davos. The session has been organised in an interactive format, including a scenario-based discussion, and explored the roles and responsibilities of non-state actors, such as the private sector, technical community, and civil society in implementing agreed cyber norms related to critical infrastructure protection.
The Geneva Dialogue on Responsible Behaviour in Cyberspace is an international process initiated by the Swiss Federal Department of Foreign Affairs (FDFA), and implemented by DiploFoundation with support of the Republic and State of Geneva, Center for Digital Trust (C4DT) – EPFL, Swisscom and UBS. The initiative maps roles and responsibilities of relevant actors for implementing the agreed cyber norms, contributing to cyber-stability and security.
Ambassador Alexandre Fasel, State Secretary of the Swiss Federal Department of Foreign Affairs (FDFA), opened the event by highlighting how the Geneva Dialogue unites people from diverse countries, organizations, and cultures—bringing together large corporations and open-source authors, medical supply companies and academia, and actors from across the globe.
Maya Bundt, Chair of the Cyber Resilience Chapter at the Swiss Risk Association, and Serge Droz, Senior Technical Advisor at the Swiss Federal Department of Foreign Affairs (FDFA), introduced the topic of agreed cyber norms and the cyber-stability framework through a ‘Socratic dialogue.’ They challenged both the audience and each other with questions about the importance of these diplomatic agreements in today’s geopolitical environment.
Sofia Martinez Gomez, Cybersecurity Consultant at AlixPartners, echoed this message by addressing the challenges that various actors face in securing ICT networks and critical infrastructure. She emphasized the importance of collaboration as a key element in mitigating ongoing cyber risks.
During a scenario-based discussion, participants were invited to reflect on priority steps for critical infrastructure (CI) operators and owners in responding to cybersecurity incidents.
The group engaged in debates, sharing personal experiences that set the tone for the subsequent panel discussion, which featured four experts:

Alina Matyukhina, CSO and Global Head of Cybersecurity for Business Unit, Siemens AG
David Harland, Executive Director, Center for Humanitarian Dialogue (HD)
Olivier Crochat, Executive Director, C4DT-EPFL
Yoann Klein, Senior Cybersecurity Advisor, Huawei

While the panelists expressed both pessimistic and optimistic views on the current global cybersecurity outlook, they unanimously agreed that the multistakeholder nature of cyberspace demands action from all stakeholders to secure the digital environment.
In his concluding remarks, Florian Schütz, Director of NCSC.ch, emphasized that the Geneva Dialogue continues to focus on clarifying and implementing agreed cyber norms from a non-state stakeholder perspective. He invited interested experts to join the ongoing discussions.
The outcomes of this session and Geneva Dialogue will be published in the second chapter of the Geneva Manual – a comprehensive guidance on non-state actors’ implementation of existing norms. The second chapter will focus on critical infrastructure protection related norms and confidence-building measures (CBMs).The first chapter, announced in 2023, focuses on the implementation of the norms related to supply chain security and responsible reporting of ICT vulnerabilities.

From words to protection – how do cyber norms guide security of critical infrastructure? Announcing Chapter II of the Geneva Manual
2025-05-14 14:15 - 15:45 | Room 14, International Conference Centre Geneva, Rue de Varembé 17, 1211 Genève, Switzerland
From energy grids to hospital networks, the systems that sustain our lives are constantly under increasing pressure. As threats evolve, so must our defences – not just in code and hardware, but in principles and responsibility.
States have agreed on a global framework for responsible state behaviour in cyberspace. However, agreements alone do not protect critical infrastructure. It’s time to ask the question: how do these norms move from paper to practice? Who ensures that they are upheld, not just by governments, but by the operators, engineers, developers, and researchers behind the world’s most essential systems?
The session titled “From words to protection – how do cyber norms guide security of critical infrastructure?” took place on 14 May 2025 in Geneva, as part of the Global Conference on Cyber Capacity Building (GC3B) organised by the Global Forum on Cyber Expertise (GFCE). This session marked the launch of Chapter II of the Geneva Manual – a milestone in defining what the UN cyber norms mean for real-world protection of critical infrastructure. Built through the Geneva Dialogue’s global community of experts, this new chapter provides practical guidance for non-state stakeholders navigating a shared, high-stakes digital environment, and highlights challenges, including for states.
Organised by the Geneva Dialogue on Responsible Behaviour in Cyberspace, the session discussed these questions in a multistakeholder approach, engaging representatives from the private sector, academia, civil society, and technical community. Established by Switzerland in 2018 and implemented by DiploFoundation with support of the Republic and State of Geneva, C4DT, Swisscom, and UBS, the Dialogue maps the roles and responsibilities of various actors in the implementation of agreed cyber norms and confidence-building measures (CBMs), and thus contributes to stability and security in cyberspace. The Geneva Dialogue is a global process which engages over 69 organisations and experts representing different stakeholder groups from all over the world.
This session provided a unique opportunity for participants to engage with leading voices in cybersecurity and cyber diplomacy, explore best practices for the protection of critical infrastructure (CI), and contribute to shaping the future of global cybersecurity governance. Ambassador Benedikt Wechsler, Head of the Digital Division at the Swiss Federal Department of Foreign Affairs, opened the session by reaffirming Switzerland’s commitment to an open, stable, and secure cyberspace, as well as the importance of a multistakeholder approach to implementing the agreed framework for responsible state behaviour. He expressed appreciation to all contributors for their continued engagement in the Geneva Dialogue and their efforts to advance the understanding of how cyber norms and CBMs can enhance CI protection.

Ambassador Burhan Gafoor, Singapore’s Permanent Representative to the UN and Chair of the UN Open-Ended Working Group (OEWG), offered insights ahead of the OEWG’s concluding session under the 2021–2025 mandate. Returning for the second time to announce the next chapter of the Geneva Manual, he emphasized the value of multilateral cooperation and inclusive dialogue, highlighting the importance of integrating perspectives from across sectors to ensure a secure and resilient digital environment.

The session also featured an interactive segment, inviting participants to reflect on practical actions inspired by the Geneva Manual. Insights from the group work during the “Cyber Quest“ exercise sparked thoughtful discussion, moderated by Emmanuella Darkwah, Senior Manager for International Cooperation at Ghana’s Cyber Security Authority. Two expert commentators joined the conversation: Christina Rupp, Senior Policy Researcher at interface, presented a comprehensive analysis of the EU cybersecurity policy ecosystem, highlighting potential governance models for CI protection; and Xiang Zheng Teo, Vice President of Advisory at Ensign InfoSecurity, spoke on the implementation side of cybersecurity, stressing the importance of threat-informed defense strategies and the private sector’s role in national cyber resilience.

The session concluded by underscoring the pressing need for cross-sectoral and international collaboration to address the complex challenges facing global cybersecurity. Participants are warmly invited to continue contributing to the dialogue at genevadialogue.ch and stay informed about future updates and initiatives.

Geneva Dialogue at the African School of Internet Governance (AfriSIG)
2025-05-23 - 2025-05-28 | Es Salaam, Tanzania, United Republic of
The African School of Internet Governance is a regular pre-event training that takes place before the African IGF to create awareness and build practical skills in Internet, ICT and Data Governance for civil society, the public and private sectors. This year it was held in Dar Es Salaam, Tanzania from 23 to 28 May, 2025 and was attended by a wide variety of international and African stakeholders.

Dr Katherine Getao represented the DiploFoundation at the event and delivered a presentation titled “Cybersecurity and Cybercrime in Africa: Challenges and Opportunities.” In her remarks, she highlighted the rapid growth and penetration of digital technologies across Africa, underscoring the urgent need for robust cybersecurity measures and effective responses to the increasing risks of cybercrime. She further noted that these challenges also create opportunities—particularly in promoting youth employment and fostering dynamic businesses offering cybersecurity services.

Dr Getao emphasised the importance of African engagement in global policy processes, such as the Geneva Dialogue, which offer platforms for African stakeholders to engage with emerging issues, contribute regional perspectives, and help shape international policies to reflect the continent’s digital realities.

Previously, Dr Getao served as Kenya’s representative to the United Nations Group of Governmental Experts (UNGGE) on Developments in the Field of Information and Telecommunications in the Context of International Security, contributing to the negotiation of the UN norms for responsible State behaviour in cyberspace.

She also participated in a dynamic panel discussion on how the Internet Governance Forum (IGF) can be leveraged to advance African priorities. The African School on Internet Governance proved to be a valuable space for promoting the objectives of both the DiploFoundation and the Geneva Dialogue.

Geneva Dialogue at the OSCE Cross-regional Conference on Cyber/ICT Security
2025-05-27 - 2025-05-28 | Ulaanbaatar, Mongolia
The two-day workshop examined the nexus between CBMs and cyber norms, with a specific focus on identifying commonalities in their implementation. The Geneva Dialogue on Responsible Behaviour in Cyberspace was presented and further discussed as an example of good practice during the session on a multistakeholder approach to cyberspace.
Through expert-led discussions, the event showcased national and regional strategies and challenges, highlighting areas of possible future joint efforts. The conference was organized for policy-makers active in the field of international cybersecurity, particularly national representatives involved in cyber diplomacy negotiations.

Geneva Dialogue session at the Global Digital Collaboration Conference (GDCC 2025)
2025-07-02 10:50 - 11:50
Organised by the C4DT-EPFL, Swiss Federal Department of Foreign Affairs (FDFA) and DiploFoundation, the session brought together representatives from government, industry, and academia for an open discussion on the evolving relevance of cyber norms and the rules-based international order in safeguarding critical infrastructure. While states have endorsed norms for responsible state behaviour in cyberspace, the discussion highlighted persistent challenges in their implementation.
Serge Droz (Swiss FDFA), Roman Zhukov (RedHat), and Imad Aad (C4DT-EPFL) noted that states often lack effective mechanisms to operationalise norms and confidence-building measures (CBMs), placing disproportionate responsibility on the private sector, which owns and operates much of the infrastructure. The gap between commitments and practice—particularly evident in ongoing malicious cyber activities—raised concerns about accountability, especially in the context of armed conflict where roles can quickly shift.
The panel explored how various stakeholders interpret and apply these norms and discussed whether existing frameworks are still adequate for today’s complex and fragmented security environment.
At the same time, the session highlighted important areas of convergence and opportunity. While technical communities and open-source developers may not explicitly engage with UN cyber norms, their day-to-day priorities—security, stability, and resilience—are deeply aligned with the overarching goals of these frameworks.
The Geneva Dialogue was cited as a valuable platform for bridging this gap by translating state-led commitments into shared understanding and actionable practices across stakeholder groups. Positive remarks were made about the potential of cyber norms to support international cooperation on security, even as political, legal, and technical barriers continue to grow.
The conversation reaffirmed that while norms may originate in diplomatic forums, their effectiveness depends on broad-based engagement—from open-source communities to governments—especially as the threat landscape continues to evolve.

From Geneva to Abu Dhabi: Algorithms Redefining War and Peace
2025-09-09
The Hili Forum in Abu Dhabi (8–9 September 2025) has quickly become one of the UAE’s flagship spaces for global dialogue — a place where leaders, experts, and thinkers from around the world debate the big issues shaping our future. Mr Vladimir Radunovic, Diplo’s Director for Cybersecurity and E-diplomacy, will join the panel “Geneva vs Algorithms: Redefining Laws of War and Peace” — a conversation on how algorithmic systems and AI, diplomacy, and international law and norms collide in today’s shifting global security landscape.
With rapid advances in autonomous systems, algorithmic decision-making, and cyberwarfare, the session will explore the applicability and the need to update the global frameworks that govern armed conflict and peacekeeping. We will reflect on the role of international Geneva and the UN overall in shaping rules and norms that can help secure peace in the digital age, while highlighting Geneva’s unique ecosystem of institutions and stakeholders that enables dialogue, negotiation, and the implementation of agreements. Drawing on lessons from initiatives such as the Geneva Dialogue on Responsible Behaviour in Cyberspace, we pointed to what works — and what still needs to be done — in bridging the gap between diplomacy and the algorithmic realities of the modern security environment.
More information is available at: https://hiliforum.ae/en

Cyber Norms on the Ground: Who Is Responsible for Securing Critical Infrastructure?
2025-10-21 07:00 - 09:00
When everything is critical, who protects it? What do cyber norms actually tell us to do? And how, and by whom?
Dependence on digital infrastructures is continuously increasing, from energy grids to healthcare systems, making them an ever more attractive target for malicious cyber operations. As these risks intensify, the urgency grows to move beyond political declarations toward meaningful, coordinated action.
States have endorsed the UN framework for responsible State behaviour in cyberspace – including norms and CBMs that call for the protection of critical infrastructure. Regional organisations such as the OSCE and ASEAN have agreed to similar CBMs. But who implements these norms and CBMs? Who ensures they are upheld not only by governments, but also by the operators, engineers, developers, and researchers behind the world’s most essential systems?
These questions were discussed at the Geneva Dialogue’s session at the Singapore International Cyber Week (SICW) on 21 October. The session presented the Geneva Manual on Responsible Behaviour in Cyberspace exploring the evolving roles and responsibilities of all stakeholders in implementing cyber norms and confidence-building measures for critical infrastructure protection.
Through a multistakeholder interactive conversation, the session highlighted challenges, shared emerging good practices, and examined how diplomatic agreements are being interpreted, operationalised, and embedded into real-world decisions.
The session was opened by Mr Daniel Klingele, Senior Advisor, International Security Division, Swiss Federal Department of Foreign Affairs (FDFA), and Mr Christopher Anthony, Director, Critical Information Infrastructure (CII) Division, Cyber Security Agency of Singapore (CSA). They framed the discussion on critical infrastructure protection and challenges for international cooperation.

Ms Anastasiya Kazakova, Cyber Diplomacy Knowledge Fellow and Geneva Dialogue Project Coordinator, DiploFoundation, presented the newly launched Chapter 2 of the Geneva Manual (May 2025), which conveys seven key messages from non-state stakeholders on the protection of critical infrastructure. The chapter highlights:

The need to broaden the definition of damage in UN Norm F beyond physical destruction to include service disruptions, collateral effects, and other non-physical harms.
Calls for states to provide clear legal and policy guidance to private entities and CI operators.
The importance of harmonised, risk-based baseline cybersecurity requirements across jurisdictions.
Protection of responsible vulnerability disclosure and the preservation of trusted cross-border technical collaboration, even amid rising geopolitical tensions.

Participants then engaged in a scenario exercise on a hospital cyberattack, later revealed as a supply chain compromise requiring international cooperation.

The exercise was led by Mr Tan E Guang Eugene, Research Fellow, S. Rajaratnam School of International Studies (RSIS), Nanyang Technological University, Singapore, with contributions from:

Mr Teo Xiang Zheng, Vice President, Head of Advisory, Ensign Infosecurity

Ms Shariffah Rashidah Syed Othman, Deputy Director General, Personal Data Protection Department, Ministry of Digital, Malaysia
Mr Christopher Anthony, Director, Critical Information Infrastructure (CII) Division, Cyber Security Agency of Singapore (CSA)

The session concluded with a fireside chat moderated by Mr Vladimir Radunović, Director of Cybersecurity & E-diplomacy, DiploFoundation, featuring Mr Marc Henauer, Senior Political and International Affairs Officer, Swiss National Cyber Security Centre (NCSC), and Dr Bushra Al Blooshi, Director of Governance and Risk Management for Cybersecurity, Dubai Electronic Security Center. The experts discussed the implications of geopolitical fragmentation: the risks of competing digital ecosystems undermining global cybersecurity, but also the potential for resilience and innovation in a more diverse digital landscape.

From cooperation to fragmentation: Can technology and cybersecurity governance survive the age of geopolitical tension?
2025-11-25 08:30 - 17:15 | Centre International de Conférences Genève, Switzerland
On 25 November, Imad Aad, Technical Project Manager at C4DT – EPFL and member of the Geneva Dialogue Core Group, spoke on the challenges facing international cooperation in cybersecurity amid a rapidly evolving global order and intensifying geopolitical turbulence. The discussion took place during the 30th International Humanitarian & Security Conference, dedicated to “The New World (Dis)order: Global Governance, Institutions and Norms in an Age of Uncertainty.”
Today’s international environment is marked by rising geopolitical tensions, strategic rivalries, and growing fragmentation, all of which erode trust and complicate cooperation across regions. In this context, cyberspace has become increasingly complex and contested, with sophisticated threat actors, accelerated attack cycles, and emerging risks driven by artificial intelligence—ranging from hyper-realistic phishing to deepfake-enabled fraud.
Another significant development is the shift towards framing cybersecurity through the lens of national sovereignty. This trend is driving the emergence of governance models that blend security, economic, and strategic imperatives. It is reflected in regulatory practices focused on data governance, supply-chain resilience, and technology standards that now extend across physical, digital, and economic domains, reshaping how states and industries interact.
As part of his intervention, Imad highlighted the Geneva Dialogue as a concrete and effective case study of cross-regional, multistakeholder cooperation during a time of geopolitical volatility. He underscored how the Dialogue brings together governments, industry leaders, academia,civil society, and technical communities, including experts from open-source community, to build shared understanding, exchange practical experiences, and develop principled guidance for responsible behaviour in cyberspace. In an era where formal political channels are often strained, the Geneva Dialogue demonstrates that inclusive, trust-building platforms can still advance cooperation and create space for constructive engagement across geopolitical divides.
Stephanie Borg Psaila, Director of Digital Policy, Diplo also contributed to the panel discussion, emphasising the vital role of civil society in sustaining and strengthening collaboration among states, the private sector, academia, and other stakeholders despite deepening global uncertainties.

FIRST Good Practice Webinar Series Session 4 - Cyber Diplomacy: Strengthening Collaboration Among National CSIRTs Confirmation
2025-11-27 15:15 | Online Zoom
On 27 November, Anastasiya Kazakova, Cyber Diplomacy Knowledge Fellow at Diplo and Geneva Dialogue Project Coordinator, delivered a presentation on recent developments in the UN cyber negotiations and discussed practical avenues for African security teams to strengthen their engagement in cyber diplomacy. The session took place as part of the FIRST Good Practice Webinar Series (Season 4), a programme designed to explore how technical cooperation, information sharing, and diplomatic engagement can reinforce trust and operational collaboration among national and sectoral CSIRTs.
The series was delivered courtesy of the FIRST Africa Regional Liaison initiative, made possible through the generous support of UK International Development as part of the Africa Cyber Programme.
The Webinar Series, led by Lawrence Muchilwa, Africa Regional Liaison at FIRST, aimed to examine how cyber diplomacy is increasingly shaping effective CSIRT-to-CSIRT cooperation, as well as to identify the diplomatic and operational factors that enable trust, interoperability, and coordination among national CSIRTs. In doing so, the series also works to generate practical recommendations for strengthening regional and international partnerships in cyber incident management.
In her intervention, Anastasiya highlighted the key outcomes of the current UN Open-Ended Working Group negotiations and explained how African security teams can contribute more actively to cyber diplomacy processes. She emphasised the importance of bringing technical expertise into national deliberations on cyber norms, participating in international dialogue platforms, and using multistakeholder initiatives to support capacity-building and regional resilience.
The webinar also featured presentations from two additional speakers. Ellah Hamwaka, Incident Response Officer and former representative of Malawi to the UN OEWG on ICT security, shared insights from her involvement in shaping national positions on cyber stability, norms, and cooperation. Emmanuella Darkwah, Senior Manager for International Cooperation, drew on her experience participating in the UN OEWG on Developments in ICTs in the Context of International Security, highlighting the value of CSIRT perspectives in multilateral cybersecurity discussions. Together, the speakers underscored the growing need for stronger engagement between technical and diplomatic communities and stressed the potential for African CSIRTs to play a more influential role in shaping responsible state behaviour in cyberspace.

Shared code, shared risk: How are security responsibilities allocated?Security and governance of open source software: Geneva Dialogue Masterclass #1
2026-03-04 13:00 - 15:00 | Online Zoom
Cyber stability is increasingly tested by geopolitical fragmentation, rapid technological change, and tightly coupled digital supply chains. Open source software sits at the centre of these dynamics: widely embedded in critical digital infrastructure, globally developed, and governed through models that were not designed for today’s security, policy, and geopolitical pressures.
In 2026, the Geneva Dialogue will focus on stress-testing cybersecurity practices and agreed cyber norms under real-world conditions. Through a scenario-based engagement framework, the Dialogue brings together policymakers, private sector actors, technical communities, and civil society to examine how responsibilities, incentives, and governance arrangements hold up when systems are under strain, with insights from Costin G. Raiu, Mika Lauhde, and Roman Zhukov.
This masterclass opens the first thematic cycle of 2026, dedicated to the security and governance of open source software. Its purpose is to establish a shared analytical baseline: how OSS functions as a systemic dependency; how security responsibilities are distributed across maintainers, vendors, users, and public authorities; and where current governance approaches struggle to manage risk, accountability, and resilience at scale. The session is designed to bridge policy and technical perspectives and to frame the key questions that will be explored in depth during the subsequent scenario-based consultation.

Emerging technologies and cybersecurity: Can governance adapt to speed, scale, and uncertainty? Geneva Dialogue Masterclass #2
2026-05-04 14:00 - 16:00 | Online Zoom
Cyber stability faces growing pressure from geopolitical fragmentation, rapid technological change, and interconnected digital supply chains. Emerging technologies — AI, advanced automation, and quantum computing — are accelerating cyber capabilities, reshaping how vulnerabilities are discovered, defences are built, and operations conducted. Some compress decision timelines; others challenge foundational assumptions about encryption and systemic risk. As capabilities evolve, responsibilities across developers, deployers, infrastructure operators, and states become harder to delineate, and existing governance frameworks struggle to keep pace.
In 2026, the Geneva Dialogue stress-tests cybersecurity practices and agreed cyber norms under real-world conditions, bringing together policymakers, the private sector, technical communities, and civil society through a scenario-based engagement framework.
This masterclass is part of a series under the 2026 Geneva Dialogue work programme to stress-test cyber norms. It aims to establish a shared analytical baseline: how technological acceleration is reshaping capabilities and redistributing risk — and where existing governance approaches may fall short under conditions of systemic transformation.
It follows the first masterclass in the series, Shared Code, Shared Risk: How Are Security Responsibilities Allocated?, which examined security responsibilities in open-source software supply chains.
The session requires registration.
Its findings will directly inform the third chapter of the Geneva Manual on Responsible Behaviour in Cyberspace.

Cyber stability under pressure: A reality check for cyber norms in an era of AI-driven cyber risks
2026-05-08 10:00 - 12:30 | Online and Geneva
Time: 08:00-10:30 UTC / 10:00–12:30 CEST
On-site registration: RSVP to genevadialogue@diplomacy.edu, and also register for the Geneva Cyber Week, before 30 April
2026 Geneva Cyber Week
Cyber stability is under increasing strain — not only from more sophisticated attacks, but from the rapid integration of artificial intelligence into both the tools used to carry them out and those used to defend against them. The same technology that makes defenders faster also makes attackers faster. The same AI model that helps a security team identify weaknesses in their own systems can help an adversary find them first.
At the same time, several major AI providers have revised the terms governing how their models may be used, including in some cases terms that previously restricted military and national security applications. Governments in a number of jurisdictions have actively sought to expand their access to commercial AI capabilities for defence and intelligence purposes. There is evidence that criminal and APT groups — including those allegedly affiliated with states — are increasingly adopting commercial AI tools to automate cyber attacks at greater scale, while reducing the investment in time and human resources required. Commercial AI security products, including those being procured by critical infrastructure operators, are built on underlying models whose permitted uses and governance terms may not be fully visible to the organisations deploying them.
This raises fundamental questions: when the same AI tools serve both attack and defence, what does “responsible use” actually mean in practice? Who sets the boundaries, and what happens when those boundaries are moved? How do existing cyber norms hold up when the technology they are supposed to govern has changed faster than the norms themselves?This scenario-based session takes place during the Geneva Cyber Week and is open to both onsite and online participants. It brings together experts and decision-makers from across stakeholder groups — including public policymakers, critical infrastructure operators, technology providers, cybersecurity practitioners, AI governance specialists, compliance and risk professionals, and civil society and academic experts.
The session will be held under the Chatham House Rule.
Its findings will directly inform the third chapter of the Geneva Manual on Responsible Behaviour in Cyberspace. To join online, please RSVP at genevadialogue@diplomacy.edu.
