[GA - In Queue] International Cybersecurity Convention

International Cybersecurity Convention
Category: International Security | Strength: Significant
Proposed by: Lanias, Co-authored by: Haymarket Riot, Pathonia, Dushina | Onsite Topic​

The General Assembly,

Recognising that this esteemed body has not yet put restrictions on warfare as it is conducted over the interconnected technological medium, and the disastrous implications this could have on the lives of civilians in nations suffering from cyber warfare; and,

Noting the precedent set by this organ on safeguarding civilian lives in wartime situations;

Concerned by the growing danger of cyber warfare that disrupt infrastructure, threaten economies, and damage public safety;

Acknowledging the importance of respecting individual privacy while countering cyber threats and that smaller nations and under-resourced regions may lack sturdy cybersecurity frameworks, leaving them excessively endangered to cyber threats;

Determined to promote collaboration among member nations to enhance global cybersecurity;

Thus defines for the purposes of this resolution:

• "Critical infrastructure" as essential systems whose disruption would severely impact public safety or economic stability, covering both private and public sectors, energy (power grids, water, gas), telecommunications, healthcare, transportation, governance, finance, and food supply, military installations located in populated areas; and,
• "Cyberattacks targeting civilians" as any sort of hostile activity in which one entity aims to destroy or otherwise damage, partly or completely, civilian systems vital to daily life, or another entity's critical infrastructure, with the activity being conducted over either interconnected communication networks or otherwise interconnected technologies;

Mandates that member-states:

• Collaborate on cybersecurity efforts, including but not limited to;
  • [strike]sharing threat intel to prevent emerging cyber risks,[/strike]
  • developing standardized cybersecurity protocols best practices such as regular security audits,
  • incident response frameworks, encryption standards,
  • secure software development guidelines,
  • workforce cybersecurity training
  • establishing bilateral and multilateral agreements to improve cross-border collaboration in reducing cyber threats
  • investigating and countering cybersecurity breaches affecting or likely to affect those nations,
  • and reducing the rapid trade of practical enterprise resources;
• Develop national cybersecurity frameworks that respect privacy and adhere to domestic laws;

Encourages member-states to voluntarily sharing threat intel to prevent emerging cyber risks;
Further demands member-states:

• Create accessible platforms or tools to educate civilians and businesses on cybersecurity best practices;
• Impose sanctions, including freezing assets, on individuals or entities guilty of engaging in cyberattacks targeting civilians, provided such actions are subject to due process in national or international courts as defined under established international legal frameworks;
• Actively prevent the development, trade, and distribution of tools and technologies specifically designed for malicious cyber activities. This includes enforcing stricter export controls, promoting transparency in cybersecurity-related trade, and strengthening international cooperation to curb the proliferation of such technologies;

Reestablishes the Bureau for International Cybersecurity as a subcommittee of the World Assembly Scientific Programme, tasked with:

• Providing financial and technical assistance to under-resourced member states to help them develop and implement modern cybersecurity infrastructure, prioritising nations most in need through a council vote,
• Advising and assisting member-states in the creation of state-owned or private cybersecurity organisations or agencies, promoting job creation and industry growth.
• Addressing workforce shortages by helping member-states promote careers in cybersecurity, offering training programs, and facilitating the temporary deployment of cybersecurity personnel from other member states when local expertise is lacking,
• Facilitating international cooperation by acting as a medium for cybersecurity agreements, intelligence sharing, and joint defence efforts between member states,
• Monitoring and assessing global cybersecurity threats, issuing guidance on best practices, and assisting in response coordination during large-scale cyber incidents,
• Ethically developing cybersecurity tools to prevent misuse while ensuring accessibility to necessary defensive technologies for all member states; and

Expressly prohibits member nations from participating in any and all forms of cyberattacks targeting civilians, and the aiding or abetting thereof, or in assisting in the creation of tools or programmes intended to further the activities of cyberattacks targeting civilians, and criminalising the actions of all entities at or under the member-state government level from conducting the same.

Click to expand...

• Vote For if you want the Delegate to vote For the resolution.
• Vote Against if you want the Delegate to vote Against the resolution.
• Vote Abstain if you want the Delegate to abstain from voting on this resolution.
• Vote Present if you are personally abstaining from this vote.

There are several grammar errors in this proposal, but that's largely a non-issue compared to its flaws. I oppose this proposal on two grounds:

1. "Cyberattacks targeting civilians" include attacks on "another entity's critical infrastructure", which encompasses dual-use infrastructure like telecommunications and transportation networks. These are regularly used by armies to communicate their orders and transport their troops & equipments to the front. Banning member states from cyberattacking train stations to disrupt their tank supply convoys is simply absurd, and that's why the principle of proportionality is used instead.

2. The power to impose sanctions by member states are subject to "due process" by national and international courts under this proposal. That is not how RL sanctions work, and I do not support any attempt to take away one of the executive government's most potent tools for deterrence and compulsion and subject it to lengthy court proceedings before it can be used. Why should governments be asked to wait for the courts to conclusively convict someone, or a group, for cyberattacks before they can start going after them with economic sanctions?

Click to expand...