UN norms of responsible state behavior in cyberspace

Since 2004, groups of governmental experts convened under the United Nations have worked to set rules for state behavior in cyberspace. Their 2015 report, endorsed by the General Assembly, established two points. First, existing international law, including the UN Charter, applies to cyberspace. Second, eleven voluntary, non-binding norms: do not conduct or knowingly support activity that damages critical infrastructure providing services to the public; do not target national incident response teams; do not allow one's territory to be used for wrongful acts; cooperate in investigations; preserve supply chain integrity; report vulnerabilities responsibly. An open-ended working group, open to all states, then continued this work, and in December 2024 the General Assembly adopted a convention on cybercrime, separate from these norms. Their reach remains political: no sanction attaches to breaching them, and the states that endorsed them are sometimes those that breach them. For insurance, they offer a vocabulary. A state attack on critical infrastructure in peacetime breaches a norm its author endorsed, which feeds public attribution and diplomatic response, and gives the underwriter a benchmark of what states themselves consider unacceptable.