The OEWG ends and a new UN cybersecurity permanent mechanism is born
Consensus at what cost?
The eleventh and final session of the UN Open-Ended Working Group (OEWG) on the security of and in the use of information and communications technologies concluded in July 2025 with consensus on the final draft of an annual progress report (APR). This report is important because it will help to establish a permanent mechanism within the United Nations (UN) to house multilateral discussions on responsible State behaviour in cyberspace. This is a major achievement and consensus was far from certain as the process until this point has been beset by deep divisions and geopolitical wrangling. However, while consensus was achieved, the price paid raises serious concerns for the future of global cyber governance. In addition to laying out details on the permanent mechanism, the report should have also reflected conversations over the past few years to ensure that the permanent mechanism builds on previous progress. However, in our estimation, this opportunity was missed.
Shaky foundations for the permanent mechanism
International law: a fight to the finish
Arguably the most divisive issue throughout the OEWG was international law. During the process, many states sought reaffirmation that existing international law, including international humanitarian and human rights law, applies in cyberspace and tried to move conversations forward on exactly how law applies. While conversations on this topic progressively deepened throughout the five years of the process, states and stakeholders struggled to secure the inclusion of language in annual progress reports–consensus documents–which reflected these conversations. Others, particularly Russia, Iran and their allies, used the OEWG as a venue to push for a new legally binding treaty. The final report reflects this disagreement and negotiations particularly focused on this topic. There were three versions of the report; the Zero Draft, Rev. 1, Rev. 2 and a final draft which was put forward for adoption. While there was scant language on the applicability of international law, and particularly international humanitarian law, in the Zero Draft, successive edits removed even these references. In the final version of the report, the Chair removed previous consensus language that reaffirmed the applicability of international law and references to a resolution “Protecting civilians and other protected persons and objects against the potential human cost of ICT activities during armed conflict” adopted by the 34th International Conference of the Red Cross and Red Crescent on 31 October 2024 which would have offered a basis for further discussion on international humanitarian law. This was an extremely worrying development, as is discussed further below.
Stakeholders as a bargaining chip
The role of non-governmental stakeholders throughout the OEWG process has remained contentious. States agreed to engage stakeholders in the process in a systematic, sustained, and substantive manner back in 2022. However, the modalities of the process also allowed for any State to veto the participation of a stakeholder unilaterally. Although some delegations were supportive of stakeholders and did a huge amount of work to increase their participation, both by making substantive proposals on modalities and by conducting outreach, others, led by Russia and China, persistently questioned their value and tried to block their participation. These repeated objections, which were unexplained and unchallengeable, undermined the substantive value stakeholders could bring. Even when stakeholder participation was allowed in dedicated sessions, some states chose not to attend.
During the final meeting, some states were even calling for a review of the participation of stakeholders who hold ECOSOC accreditation, which would substantially diverge from precedent set in this and other processes. Stakeholders were described more than once during the final session as being used as state proxies. As discussed below, little progress was made on this topic and the fight for stakeholders to be meaningfully included in the permanent mechanism will most likely continue. However, given the tone of discussions in the room, States needed to fight to maintain even the same modalities.
What kind of mechanism have we ended up with?
A sprawling and duplicative structure
The new Global Mechanism on Developments in the Field of ICTs in the Context of International Security and Advancing Responsible State Behaviour may become as expansive as its name. With plenaries, two thematic groups, optional ad hoc groups and roundtables, and a five-year review cycle, the process could collapse under its own weight. Without clear boundaries and coordination, the mechanism risks institutional sprawl and thematic duplication. At a resource-strapped time, when some states have expressed concern about their ability to follow the many conversations on digital technologies happening within the UN, this risks governments (and stakeholders) being unable to fully participate.
Thematic groups: dedicated to what?
The outcome document established two Dedicated Thematic Groups (DTGs): one aligned with the OEWG’s five pillars and one on cyber capacity building. Despite the appearance of structure, the thematic groups risk repeating plenary discussions. The overlap between the thematic groups and the plenary was flagged during negotiations, as was the risk of these becoming overextended and lacking in purpose. A proposal for a dedicated group on international law was removed from Rev. 2. Some like-minded states (particularly European states and the US) worried that a dedicated thematic group on international law (as proposed in Rev. 1 of the APR) would create a space for proposals on a binding treaty. However, a number of states, particularly those based in Africa, were keen to emphasize that having a space for further discussions did not pre-empt any specific outcome.
Stakeholders excluded again
The final draft established mechanisms for non-governmental stakeholder inclusion which are unlikely to improve anything in the permanent mechanism. The veto mechanism remains largely untouched, with the only change being a more concrete timeline for stakeholders to hear about their application. This means that the challenges experienced by stakeholders–vetoed participation, limited space and time for intervention, and difficulty being present during negotiations due to resources and time versus impact–during the OEWG will most likely persist.
What comes next?
Consensus on the final draft of the conference paper was reached by 11am on the final day, an unusually early finish compared to previous APRs. While this could be read as a success, with a final text that achieved balance between different points of view, it could also be seen as reflective of a text that was simply the lowest common denominator. In addition, there was a high level of process fatigue, with many States using the first two days to reiterate their long-standing positions. However, whatever the reasoning behind the early adoption of the conference paper, it holds significance for the future.
A backdoor to a treaty?
The absence of strong language in the conference report reaffirming the sufficiency of existing international law creates space for states to continue proposing a binding treaty. In an environment marked by deep geopolitical divisions and a lack of cooperation, the process to elaborate a treaty could be a long, bitter process. Such a trajectory would divert attention from the real work of practically applying international law, building international cooperation, and delivering capacity building. It could also create ambiguity. While the majority of states are clear that international law applies online, a treaty negotiation would potentially create uncertainty during negotiations which could be used to evade accountability. In the March 2023 session, Russia and Iran stated explicitly that accountability for peacetime attacks, such as those on critical infrastructure, is reliant on the establishment of a legally binding agreement. Worse, it could open the door to a treaty which, in the current geopolitical environment, risks undermining human rights protections and humanitarian law guarantees while genuine accountability remains elusive, particularly if like-minded states continue to shy away from confrontation.
Where were the like-minded?
Throughout the final session, too many like-minded states, by which we mean states committed to upholding international law and protecting human rights, failed to stand their ground. This raises serious concerns about what happens if proposals on a binding treaty gain momentum. If they wouldn’t insist on the inclusion of consensus language that reaffirms the application of international law in the final report of the OEWG, what will they do when the conversation turns to treaty drafting? The concern is not just about passivity. It is about precedent. A failure to insist on foundational language today increases the risk that any future treaty process will cede ground to states who would rather see human rights and humanitarian protections undermined. The process to elaborate a UN Convention on Cybercrime, which has been widely recognised as presenting grave threats to human rights, gives us a view of the kind of risks a binding treaty could raise.
Next steps
Before March 2026, there will be an organizational meeting which will further develop the scope, structure and timeline for the permanent mechanism. Given the lack of detail on the dedicated thematic groups, in particular, this conference represents an opportunity for stakeholders to begin advocating for an approach which will allow them to meaningfully participate on the topics which matter the most. Proactively reaching out to delegations to discuss the permanent mechanism and building stakeholder coalitions to support greater coordination in the face of limited modalities will be key.
The OEWG process helped to raise awareness of the importance of international cooperation on cybersecurity and helped countries to at least engage in dialogue on all five pillars of the OEWG’s mandate. However, it also highlights the limits of consensus when consensus is treated as an end in itself. Without greater clarity of purpose and stronger political will to uphold international law, the Global Mechanism risks becoming a platform for stalemate not progress.