UN First Committee warns that weak cyber governance threatens international security

The UN General Assembly’s First Committee (Disarmament and International Security) addressed the implications of malicious information and communications technology (ICT) activities for international peace and security on 23 October 2026. Discussions focused on the application of international law, the implementation of responsible state behaviour and the need to strengthen national and collective cyber governance.

The debate highlighted a persistent challenge: although states have established a common framework for responsible behaviour in cyberspace, translating agreed principles into consistent practice remains difficult. Cyber incidents affecting essential services, critical infrastructure and government functions can have consequences beyond technical disruption, extending to diplomatic relations, political stability and international security.

The discussions take place as the UN transitions from successive Open-Ended Working Groups (OEWGs) to the Global Mechanism on developments in the field of ICTs in the context of international security and advancing responsible State behaviour. Following the OEWG’s work from 2021 to 2025, the new mechanism held its first substantive plenary session in July 2026.

Its work is organised around five areas: existing and potential threats; norms and principles of responsible state behaviour; international law; confidence-building measures; and capacity-building. The mechanism provides a continuing and inclusive forum for states to discuss implementation and practical cooperation. Dedicated thematic group meetings are scheduled for 7–11 December 2026.

A central issue remains the relationship between international law and the voluntary, non-binding norms developed specifically for state conduct in cyberspace. States have affirmed that international law applies to their use of ICTs, including the UN Charter and, where relevant, international humanitarian law and international human rights law.

The framework also includes 11 voluntary norms intended to encourage responsible state behaviour. These include protecting critical infrastructure, cooperating to address malicious ICT activity and taking appropriate measures to prevent the use of a state’s territory for internationally wrongful acts involving ICTs.

While these norms establish shared expectations, their effectiveness depends on implementation, transparency and states’ willingness to explain how they interpret and apply them. Differences remain over issues such as sovereignty, due diligence, attribution and the circumstances in which a cyber operation may constitute a prohibited use of force or an armed attack.

The debate also addressed the practical consequences of weak cyber governance. Operations targeting energy networks, telecommunications, financial services, healthcare and public administration can disrupt essential services and create wider security risks. State-sponsored operations, criminal groups and proxy actors further complicate the threat environment, particularly when states disagree over attribution and appropriate responses.

Implementation is also complicated by geopolitical competition and differences in national capabilities. Much of the infrastructure involved is owned or operated by private companies, while technical expertise is distributed across industry, academia and civil society.