UNGA First Committee: Weak cyber governance risks global peace and security
By R Anil Kumar
New York/ Bengaluru, Oct 26, 2026. Discussions over the eighty-first session of the UN General Assembly addressed the implications of malicious ICT activities for international peace and security.
During debates on October 23, 2026 at the eighty-first session of the UN General Assembly, the First Committee (Disarmament and International Security) addressed a central challenge in international cybersecurity: although states have developed a common framework for responsible behaviour in cyberspace, translating agreed principles into consistent practice remains difficult. These discussions addressed the implications of malicious information and communications technology (ICT) activities for international peace and security, including the application of international law, implementation of responsible state behaviour, and the need to strengthen national and collective governance and resilience.
The discussion reflects a growing recognition that cyber incidents cannot be assessed solely as technical disruptions: when they affect essential services, critical infrastructure or government functions, their consequences can extend into diplomatic relations, political stability and international security.
The debate takes place as the United Nations transitions from successive Open-Ended Working Groups (OEWGs) to the Global Mechanism on developments in the field of ICTs in the context of international security and advancing responsible State behaviour. Established following the OEWG’s 2021–2025 work, the mechanism began its first substantive plenary session in July 2026. Its agenda is organised around five pillars: existing and potential threats; norms and principles of responsible state behaviour; international law; confidence-building measures; and capacity-building. This institutional transition is significant because it provides a continuing, inclusive forum for states to discuss practical implementation rather than repeatedly renegotiating the foundations of international cyber diplomacy. The challenge now is to translate accumulated political agreement into concrete measures that reduce risks and strengthen cooperation, which shall be addressed over the dedicated thematic group meetings, scheduled for December 7-11, 2026.
The underlying governance problem concerns the relationship between established international law and the voluntary, non-binding norms developed specifically for state conduct in cyberspace. States have affirmed that international law applies to their use of ICTs, including the UN Charter and, where relevant, international humanitarian law and international human rights law. The framework also includes 11 voluntary norms intended to encourage responsible behaviour, such as protecting critical infrastructure, cooperating to address malicious ICT activity and taking appropriate measures to prevent the use of a state’s territory for internationally wrongful acts involving ICTs.
These norms help articulate expectations of conduct and provide a basis for cooperation. Their effectiveness, however, depends on implementation, transparency and states’ willingness to explain how they interpret and apply these principles. Disagreements persist over sovereignty, due diligence, attribution and the circumstances in which a cyber operation may constitute a prohibited use of force or an armed attack.
Operationally, weak governance can create opportunities for malicious activity to escalate into wider political and security crises. Cyber operations targeting energy networks, telecommunications, financial services, healthcare or public administration can disrupt essential services and generate consequences beyond the initially affected systems. State-sponsored operations, criminal groups and proxy actors further complicate the threat landscape, particularly when governments disagree over attribution or the appropriate response.
The principal obstacle is the difficulty of securing consistent implementation amid geopolitical competition and unequal national capabilities. States differ in their interpretations of responsible behaviour, the role of sovereignty in cyberspace and the appropriate balance between national security and an open, interoperable internet. Moreover, much of the infrastructure involved is owned or operated by private companies, while important technical expertise resides in industry, academia and civil society.
Why does it matter?
The First Committee’s debate highlights a central tension in global cyber governance: international agreement on responsible state behaviour has advanced, but implementation remains uneven in an increasingly contested digital environment. The Global Mechanism provides an institutional opportunity to close this gap by linking international law, voluntary norms, confidence-building and capacity-building within a continuing process.
Cybersecurity is not merely a technical or national-resilience concern; it is also a question of international stability, legal accountability and conflict prevention. Ultimately, responsible state behaviour must become operational practice, supported by functioning communication channels, stronger national capabilities and credible cooperation. Without these elements, cyberspace risks becoming another arena in which strategic rivalry, uncertainty and inadequate safeguards undermine international peace and security.
