Geneva Dialogue

Geneva Dialogue masterclass:The role of regional organisations to facilitate the implementation of cyber norms and CBMs
2024-03-20 13:00 - 15:00 (Europe/Zurich)
On 20 March, the Geneva Dialogue on Responsible Behaviour in Cyberspace organised a masterclass, the first one in a series in 2024, to start analysing the implementation of the existing norms and confidence-building measures (CBMs) related to critical infrastructure protection. In particular, the masterclass focused on the work of regional organisations: their ongoing projects, priorities, and possible opportunities to engage relevant stakeholders to support states in the implementation of the existing norms and CBMs. The format of masterclasses allows active learning and knowledge sharing among the Geneva Dialogue experts and invited keynote speakers from different fields such as cyber diplomacy, technology, and cybersecurity. The online event took place under Chatham House rules. Below, we’re sharing some of the takeaways from the discussion.
The representatives of four regional organisations and unions such as the African Union, Association of Southeast Asian Nations (ASEAN), Organization of American States (OAS), and Organization for Security and Co-operation in Europe (OSCE), shared their experiences and initiatives in promoting the operationalisation of the UN cyber-stability framework. The four keynote presentations have demonstrated the growing maturity of regional approaches to enhance international cooperation, transparency, and trust building in cyberspace governance.
In particular, the OSCE is considered a pioneer in developing cyber CBMs, drawing on its experience in disarmament affairs. Since 2012, an informal working group has been drafting CBMs for cyberspace, leading to the adoption of 16 non-binding voluntary CBMs aimed at transparency, cooperation, and resilience. These 16 CBMs can be categorised into three main groups: posturing (increasing transparency of state posture in cyberspace), communication (facilitating timely communication and cooperation between states), and preparedness/resilience (promoting national preparedness and cyber resilience). One of the CBMs, i.e. CBM #8, involves the nomination of technical or policy points of contact for cybersecurity by participating states. These contacts facilitate communication, coordination, and exchange of information, contributing to cyber-stability.
The CBMs have also been an important pillar in the approach taken by the OAS in the Latin American and Caribbean region. The OAS cybersecurity program operates within the Inter-American Committee Against Terrorism (CICTE). In 2016, the OAS started to look at the non-traditional CBMs related to cyberspace. In 2018, the OAS adopted a resolution stressing the need to prepare and agree upon a set of CBMs for cyberspace in order to enhance interstate cooperation and transparency. One of the further successes for the OAS region was the establishment of the point of contacts directory, which currently includes over 82 cyber policy points of contacts, and 19 ministers of foreign affairs contacts. For those who may be wondering why there are no technical points of contacts, the OAS established the network of government cyber incident response teams (CSIRT) of OAS Member States. The CSIRTAmericas Network is now a cybersecurity community which includes over 47 CERTs from 22 countries along with 379 professionals.
When it comes to Africa, the countries are facing numerous challenges such as the lack of capacities, political will, and sufficient awareness among states. More specifically, the need for public–private partnerships to build capacities and means to gather up-to-date threat intelligence to promote collective responses to cyberthreats has been highlighted. Despite these challenges, the African Union has announced several important initiatives ( e.g. the establishment of the African Union Cyber Security Expert Group, aimed at providing guidance on cyber policies and strategies, as well as recents initiatives to establish cyberthreat information sharing platforms and capacity-building programs.
When discussing the developments in the ASEAN region, it was highlighted that the countries’ leaders first endorsed the voluntary cyber norms in 2015, with subsequent establishment of a working committee to develop a regional action plan. The major focus was on capacity building, i.e. the establishment of dedicated cybersecurity agencies in member states and ongoing efforts to develop regional action plans and metrics for implementing cyber norms. In 2021, the Member States also adopted the ASEAN Cybersecurity Cooperation Strategy, which outlines five focus areas for advancing cyber readiness, strengthening international cyber policy coordination, enhancing trust in cyberspace, and regional capacity building.
The ASEAN countries were also successful in advancing the regional action plan metrics developed to identify capabilities required for norm implementation and to facilitate cooperation and capacity-building activities within ASEAN.
During the session, the role of non-state actors was underscored as essential for the practical implementation of these norms and measures. Furthermore, it has been discussed that the implementation of cyber norms and CBMs is an ongoing and collaborative process requiring multistakeholder engagement. The need for improved communication, education, and institutional memory was highlighted to ensure sustained knowledge and engagement among diplomats and technical experts

The Geneva Manual side-event at the OSCE
2024-03-12 09:30 - 11:00
On 12 March in Vienna, the Geneva Dialogue organised the side-event: “The Geneva Manual on Responsible Behaviour in Cyberspace and its application in the OSCE region: The Role of Non-State Stakeholders in Enhancing Cybersecurity and Building Confidence”.
The side event discussed the roles and responsibilities of various stakeholders in promoting responsible behaviour in cyberspace, namely through the operationalisation of the 11 cyber norms, as agreed in the 2015 UN GGE report, and confidence-building measures (CBMs).

The discussion centred around the Geneva Manual, a comprehensive guide which documents the views of relevant stakeholders, in particular the technical community and the private sector, for the operationalisation of the agreed norms, CBMs, good practices, and their application in the Organization for Security and Co-operation in Europe (OSCE) region. In particular, the side event discussed how the Geneva Manual can facilitate the implementation of the relevant OSCE CBMs (including CBM 4, 14, 15, and 16).
Ambassador Raphael Nägeli, Permanent Representative of Switzerland to the OSCE welcomed participants, highlighting Switzerland’s commitment to a secure, free, and open cyberspace, in line with international law, human rights, and international humanitarian law.

Panellists, including Daniel Klingele, Senior Advisor, International Security Division, FDFA and Swiss representative to the UN OEWG; Sofia Martinez Gomez, Member of the Geneva Dialogue Core Group, and Anastasiya Kazakova, Cyber Diplomacy Knowledge Fellow, DiploFoundation discussed what challenges exist for relevant stakeholders to help effectively operationalise the OSCE CBMs and address the security of and in the use of ICTs, as well as what contribution the Geneva Manual makes to support the operationalisation of the OSCE CBMs. The roundtable was moderated by Serge Droz, Senior Adviser, FDFA.

The Geneva Manual side-event during the UN OEWG 7th substantive session
2024-03-07 13:15 - 14:45
On 7 March in New York, the Geneva Dialogue organised the side-event during the 7th substantive session of the UN Open-ended working group (OEWG). The event was co-sponsored by Switzerland, Canada, Chile, the Netherlands, and DiploFoundation, and gathered around 40 experts representing governments and non-state stakeholders.
Ambassador Adrian Hauri, Deputy Permanent Representative, Permanent Mission of Switzerland to the UN welcomed participants, highlighting Switzerland’s commitment to a secure, free, and open cyberspace, in line with international law, human rights, and international humanitarian law.

Vladimir Radunović, Director of E-diplomacy and Cybersecurity Programmes at Diplo provided a comprehensive overview of the first chapter of the Geneva Manual on Responsible Behaviour in Cyberspace, launched in December 2023.

Participants, including industry representatives and diplomats discussed how existing cyber norms assist each of us – representatives of various stakeholder groups and organisations – in promoting responsible behaviour in cyberspace, and what possible roles and responsibilities stakeholders shall implement to minimise security risks while producing digital products or when using them. An interactive tabletop exercise, based on the roles in the Geneva Manual, was organised after to discuss challenges related to responsible vulnerability disclosure and relevant roles and responsibilities of stakeholders to ensure the security of digital products and services.

The event underlined the need to translate cyber norms into actionable practices and the importance of capacity building. It was also announced that in 2024 the Geneva Dialogue will start a new phase discussing the norms and confidence-building measures (CBMs) related to critical infrastructure protection (CIP).

Side-event on “Sharing best practices for implementing responsible behavior in cyberspace” organized by the Mission of the Netherlands
2024-01-23
The Geneva Dialogue participated in the side event on “Sharing best practices for implementing responsible behavior in cyberspace” organized by the Mission of the Netherlands. Imad Add (Center For Digital Trust at EPFL) represented the Geneva Dialogue as a member of the Core Group and one of the most active experts of the Dialogue.

This event brought together different stakeholders and examined how the international community has been progressing in implementing the normative framework endorsed by the UN General Assembly and what still needs to be done. In this context, the first edition of the Geneva Manual was cited as an example of a multistakeholder effort to facilitate responsible behavior in cyberspace.

Cyber norms in action: How to translate diplomatic agreements into real security for us all?The launch of the Geneva Manual
2023-12-07 10:00 - 16:30
Vulnerabilities in digital products and networks leading to cyberthreats raise security concerns from individual users to international security and peace. While States hold primary responsibility, meaningful cooperation with non-state actors, such as the private sector, academia, civil society, and the technical community, is crucial to foster a secure, open, and peaceful cyberspace. However, what are those other actors expected to do? Where and how can they support states in ensuring the security and stability in cyberspace?
Join us on December 7th for the launch of the Geneva Manual – a comprehensive guide on non-state actors’ contributions to the implementation of cyber norms.
The Geneva Manual will undergo continuous development in the years ahead to encompass a wide range of cyber norms, guided by discussions with the multistakeholder community.
Established by the Swiss Federal Department of Foreign Affairs and led by DiploFoundation, with support of the Republic and State of Geneva, C4DT, Swisscom and UBS, the Geneva Dialogue particularly asks how the norms and confidence-building measures (CBMs) might be best operationalised (or implemented) by relevant actors as a means to contribute to international security and peace.
The inaugural edition of the Manual focuses on two norms related to supply chain security and responsible reporting of ICT vulnerabilities.
The event will take place in a hybrid format: to register to participate online, please follow this link.
Short videosSorry, your browser doesn't support embedded videos.Sorry, your browser doesn't support embedded videos.PROGRAMMEEvent recording

Vulnerabilities in digital products: How can humans decrease risks for humans?
2023-04-04 11:00 - 12:00
Who is responsible for vulnerabilities in digital products and supply chain security? Who is primarily expected to take action?
What can vendors, manufacturers, regulators, policymakers, diplomats, and users do to minimise risks in cases of such vulnerabilities?
In the first Geneva Dialogue webinar on software vulnerabilities, the aim was to set the scene on the risks brought about by vulnerabilities in digital products. In this second webinar, we dive deeper into the perspective of different actors and discuss recent initiatives such as the EU Cyber Resilience Act, and calls for shifting responsibility to manufacturers in the US National Cybersecurity Strategy.
To join and contribute to the discussion, register using the link below, and join us live on Tuesday, 4 April 09:00-10:00 UTC (11:00-12:00 CEST).
About the Geneva Dialogue
The Geneva Dialogue on Responsible Behaviour in Cyberspace is led by the Swiss Federal Department of Foreign Affairs (FDFA) and implemented by Diplo. It aims to map the roles and responsibilities of actors (states, the business sector, civil society, and the academic and tech communities ) in contributing to greater security and stability in cyberspace in the context of international peace and security, identify good practices and possible gaps in existing efforts, and, ideally, put forward recommendations for overcoming such gaps.
Event recording

Vulnerabilities in Digital Products: How Does This Impact the World Around Us?
2023-03-29 11:00 - 12:00
What do the SolarWinds hack, the use of Pegasus spyware, and the Colonial Pipeline ransomware attack have in common? Even though they have different targets, threat actors, and impacts, they all exploit software vulnerabilities.
Vulnerabilities in digital products remain an almost indispensable component of cyberattacks, especially high-impact ones.
In this Geneva Dialogue webinar, together with expert panellists, we will discuss:

How do vulnerabilities emerge, how are they exploited, and to what end?
What can we learn from these exploitations?
What role do software vulnerabilities play in today’s digitalised society?

About the Geneva Dialogue
The Geneva Dialogue on Responsible Behaviour in Cyberspace is led by the Swiss Federal Department of Foreign Affairs (FDFA) and implemented by Diplo. It aims to map the roles and responsibilities of actors (states, the business sector, civil society, and the academic and tech communities ) in contributing to greater security and stability in cyberspace in the context of international peace and security, identify good practices and possible gaps in existing efforts, and, ideally, put forward recommendations for overcoming such gaps.
Event recording

Digital Security and Economic Recovery
2020-11-26 08:30 - 10:00 | Online
The online high-level event ‘Digital Security and Economic Recovery: Boosting Confidence and Productivity through Secure Digital Technology’ is organised by DiploFoundation and the Swiss Confederation as part of the Geneva Dialogue on Responsible Behaviour in Cyberspace.
The majority of cyber-attacks exploit vulnerabilities in digital products and services. Although there is a lively international debate about the responsibility of governments to establish baseline requirements for cybersecurity, and for manufacturers and service suppliers to apply the available standards, there is currently no consensus about these issues. Hence, there is a risk that governments set widely different requirements, while businesses pursue divergent industry practices.
In this context, the Geneva Dialogue on Responsible Behavior in Cyberspace has been discussing industry roles and responsibilities throughout 2020, with the aim to establish globally shared best practices and baseline requirements for the security of digital products and services. An output document, which includes definitions of key concepts and a collection of good corporate practices about threat modelling, supply chain security, secure development, vulnerability management, and transforming internal processes to embrace security by design, has been published for comments.
This high-level event will discuss how the fragmented regulatory environment impacts the security of digital products and services, including those in supply chains. It aims to clarify possible collaborative responses from both industry and governments on how to facilitate financial and economic recovery through trusted digital technologies.
Speakers
Introduction:
Keynote speech by Federal Councillor Ueli Maurer, Head of the Federal Department of Finance FDF, Switzerland
Panel discussion:
Ms Sabine Keller-Busse, Member of the Group Executive Board, UBS AG
Mr Eugene Kaspersky, CEO, Kaspersky
Mr Jeremy Thompson, Executive Vice President, Huawei Western European Region
Mr Casper Klynge, Vice President, European Government Affairs, Microsoft Corporation
Moderator: Mr Jovan Kurbalija, DiploFoundation
Event recording

Geneva Dialogue workshop at the AfIGF 2020
2020-11-25 08:30 - 10:00 | Online
Vulnerabilities of digital products are rapidly being exploited by a wide range of actors for various purposes. This puts the stability of the digitalised world at risk, erodes user trust in digital services, and undermines digital development. To reduce these risks, businesses must increase the resilience of their digital products and services. Various baseline security requirements and product security certification schemes are being shaped by national, regional and international institutions and organisations around the world. Security-by-design may become a competitive market advantage, but will also add costs on the side of emerging digital industries – in particular in developing countries.
Building on the Geneva Dialogue on Responsible Behavior in Cyberspace, the workshop entitled ‘Security of digital products and services: A development perspective’ discussed best practices and examples of creating global, resilient, and ethical digital products, and their opportunities and challenges in the African context. The interactive workshop brought together perspectives of the industry, public authorities, technical community, and civil society, from all parts of the world.
Key messages from the Workshop discussion:

Vulnerabilities in digital products and services are exploited by cyber-attacks, which produces security risks, safety risks, and diminishing trust. This, in turn, endangers economic development.
Companies should embrace security by design and security by default approach. Geneva Dialogue on Responsible Behaviour in Cyberspace (https://genevadialogue.ch) gathers lead global companies to share good practices. African companies are invited to partner as well.
Companies in developing countries – and generally small companies and start-ups – might find focus on security as additional burden. It is important not to press them, but rather to incentivise them to embrace security by design.
Governments and local authorities also create numerous digital services for citizens, whose security is critical for security and safety of citizens (eg. with regards to national ID schemes).
There is a need to boost cooperation among governments and the private sector, as well as civil society, to enhance awareness about security of digital products, and explore regulatory and policy options to incentivise security by design.
We need more easily digested baseline security requirements and standards to be deployed by companies. The context and cultural specifics of the company/sector/country is also important in standards application. Certification schemes by regulators on African level (similar to those by Singapore or EU) may be helpful.
Capacity building will be crucial for security of digital products – for companies, but also for governments and regulators. Efforts and good practices by big(ger) companies are important to move forward. Geneva Dialogue will focus more on baseline requirements and capacity building in 2021.

Watch the recording of the session below.

IGF 2020 WS #234 Security of digital products: Industry and enhancing trust
2020-11-11 00:20 - 13:20 | Online
The Geneva Dialogue on Responsible Behaviour in Cyberspace organised a workshop at the Internet Governance Forum (IGF) 2020 entitled ‘Security of digital products: Industry and enhancing trust’. The interactive session discussed best practices for creating resilient and ethical digital products.
Read the summary and watch the recording below.
The session, co-moderated by Mr Vladimir Radunović (Director, E-diplomacy, DiploFoundation) and Ms Marília Maciel (Digital Policy Senior Researcher, DiploFoundation), addressed best practices and examples for creating global, resilient, and ethical digital products. This event drew on the Geneva Dialogue on Responsible Behaviour in Cyberspace, a project implemented by the Federal Department of Foreign Affairs of Switzerland and DiploFoundation.
The first part of the session tackled policy and regulatory approaches to increase the security of digital products from the perspective of governments. Mr David Koh (Commissioner of Cybersecurity and Chief Executive, Cyber Security Agency of Singapore) argued that the greater our reliance in digital technologies, the more trust needs to be enhanced. Trust is essential in the current context of accelerating digital transformation, and cybersecurity can be considered as its main driver.
Singapore implements cybersecurity best practices on various levels. Regionally, Singapore is active in the context of the Association of Southeast Asian Nations (ASEAN) in developing a long-term regional cybersecurity action plan for the implementation of new cyber norms. At the national level, Singapore developed a number of initiatives to work with the industry in strengthening cybersecurity. It launched the Safer Cyberspace Masterplan 2020 to strengthen cybersecurity among business communities, and small and medium-sized businesses and organisations. Singapore also published security-by-design guidelines, as well as a cybersecurity labelling scheme to raise the security levels of Internet of Things (IoT) devices. Mr Jon Albert Fanzun (Special Envoy for Cyber Foreign and Security Policy, Federal Department of Foreign Affairs of Switzerland) explained that, as technological competition intensifies and geopolitical tensions remain on the rise, the application of global norms and existing international laws to cyberspace is still uncertain and contested. This situation translates into a dramatic decline of trust. To address these challenges, Switzerland works to clarify the international rules in cyberspace, especially in the framework of the UN. Switzerland has also recently launched its new digital foreign policy strategy. Its four fields of action are: digital governance, prosperity and sustainable development, cybersecurity, and digital self-determination. The strategy highlights the importance of private actors in enhancing trust and security, and addressing current issues in digital governance, well-illustrated by the Geneva Dialogue on Responsible Behaviour in Cyberspace, which began in 2018.
The session addressed good corporate practices, especially in defining key terminologies, but also in building capacities and a security culture within the private sector. Ms Anastasiya Kazakova (Public Affairs Manager, Kaspersky) highlighted the role of the Geneva Dialogue in facilitating discussions on industry best practices and handling vulnerabilities, as well as offering a space to define a common terminology around the concepts of security-by-design, security-by-default, and trustworthiness. The Geneva Dialogue also provides an opportunity to exchange industry best practices, in an effort to enhance trust and avoid duplications. In terms of good practices, Mr Nestor Serravalle (Global Chief Sales Officer, VU) insisted on the need to develop and invest in the security culture of companies. This is not only a reputational problem, but also a matter of social responsibility. To enhance trust, the internal processes of businesses need to evolve in order to maintain the digital security of the people using their products. Mr Barrack Otieno (Trustee, Kenya ICT Action Network) explained that the majority of start-ups and small enterprises in the Global South usually face harsh economic environments and struggle to stay afloat. The issue of security-by-design can thus become secondary in their business operations. This also translates into a lack of adherence to non-mandatory security standards. Additionally, Otieno mentioned the fact that security is not understood similarly in all parts of the world. Koh agreed that cultural differences and nuances need to be taken into account to enhance trust, as was shown for instance in the recent debates around contact tracing in the context of the COVID-19 pandemic. Trust is not only a technical issue, but has also a human dimension.
The session was highly interactive, and several participants took the floor while number of participants exchanged reflections and discussed issues in the chat. The audience noted that public-private partnerships (PPP) is important to bridge trust gaps. A participant noted that governments should create collaborative environments. It was also noted that it is necessary to assess how new products and technologies can impact the society. The need for transparency in digital products by letting the community review codes were also highlighted.
In the chat, participants highlighted the interdependence between trust and security. Norms on cybersecurity were identified as building blocks of trust and collaboration among relevant actors. It was noted that trust it is not only about technology, it heavily depends on individual’s perceptions. Some preconditions for enhancing trust and security mentioned by the participants are accountability, predictability, transparency, consistency, reliability, dependability and awareness.
The role of standards in promoting security was also mentioned. There were discussions on how to strengthen the adoption of security standards. The recently launched IGF Dynamic Coalition on Internet Standards, Security and Safety (DC-ISSS) was identified as a hub to continue discussions on this topic.
Some participants mentioned the interplay between encryption technologies and trust. There were different views on whether encryption strengthens or undermines trust. Quantum was pointed out as a potential way to overcome the shortcomings of encryption technologies.
The session concluded with Radunović inviting participants to comment on the ouput document of the Geneva Dialogue.

Geneva Dialogue on Responsible Behaviour in Cyberspace at Singapore International Cyber Week
2020-10-08 10:00 - 11:00 | Online
The online panel ‘Implementing global norms by advancing multistakeholder collaboration: Lessons learned from the Geneva Dialogue on Responsible Behaviour in Cyberspace’ is organised by DiploFoundation and the Swiss Federal Department of Foreign Affairs (FDFA) as an event at the Singapore International Cyber Week 2020 (SICW 2020). The discussion will focus on global industry good practices on the security of digital products and services, and their impact on reducing vulnerabilities in cyberspace and implementing global cyber norms.
Ensuring the integrity of the supply chain and encouraging vulnerability management are among the 11 voluntary cyber norms that have been agreed in the 2015 report of the UN Group of Governmental Experts (GGE) on ICT security. At the same time, as has also been highlighted during the COVID-19 crisis, the vulnerabilities of digital products and services remain key elements for conducting cyber-attacks: from petty crimes, to advanced persistent threat attacks against critical systems. The introduction of security-by-design practices when designing and developing software, hardware, cloud-based services, or integrated systems, reduces exploitable vulnerabilities even before the products hit the markets or systems get implemented. The Geneva Dialogue on Responsible Behaviour in Cyberspace project gathered leading companies from around the world to discuss good practices, as well as ways to incentivise others to develop more secure products.
The online panel ‘Implementing global norms by advancing multistakeholder collaboration: Lessons learned from the Geneva Dialogue on Responsible Behaviour in Cyberspace’, which will be held during SICW 2020, will link the relevance of reducing vulnerabilities (particularly through deliberations within top-tier diplomatic discussions such as the UN GGE and the Open-ended Working Group (OEWG)) with good practices in security-by-design and open questions on defining and enforcing baseline requirements through increasing the demand for, and offer of, secure digital products and services.
The online panel will take place on Thursday 8 October 2020, 4-5pm SGT / 10-11am CEST / 8-9am UTC
Speakers:

Amb. Nadine Olivieri Lozano, Head, Division of Security Policy, Federal Department of Foreign Affairs, Switzerland
Ms Gwenda Fong, Assistant Chief Executive, Cyber Security Agency of Singapore
Mr Teo Xiang Zheng, Head of Advisory (Consulting), Ensign InfoSecurity
Mr Dmitry Samartsev, CEO, BI.ZONE
Mr Stefan Saatmann, Global Coordinator Cybersecurity Policy, Siemens

Moderator:
Mr Vladimir Radunovic, Director, E-diplomacy and Cybersecurity, DiploFoundation
Visit the event page at the SICW website.
Watch the recording of the session below.
