3.3. Regional efforts

🎯 What are the major instruments developed on regional levels?

🎯 How can those instruments assist African developments?

3.3.1. OSCE

Diplomatic efforts within several regional organisations seek to formulate CBMs for cyberspace to enhance cooperation and prevent misunderstanding and possible conflicts. Of particular relevance is the set of CBMs to reduce the risk of conflict stemming from the use of ICTs, adopted in 2013 (Decision No. 1106) and extended in 2016 (Decision No. 1202), by the Organization for Security and Co-operation in Europe (OSCE). The decision outlines measures that participating states are invited to follow voluntarily, including sharing national views on threats and best practices; cooperating with competent national bodies; consulting to reduce risks of misperception and possible tension or conflict; building up of national legislation to allow information sharing; sharing and discussing national terminology related to cybersecurity; cooperating in critical infrastructure protection; disclosing vulnerabilities; promoting public-private partnerships; and involving the private sector, academia, centres of excellence, and civil society in cybersecurity measures.

3.3.2. ASEAN and the ARF

The ASEAN Regional Forum (ARF) has followed the OSCE example with its 2015 Work Plan on Security of and in the Use of Information and Communications Technologies, which came as a result of the 2012 statement by ASEAN ministers of foreign affairs. In 2018, the ASEAN countries agreed that a formal ASEAN cybersecurity mechanism for cyber diplomacy and policy and operational issues should be established. The ASEAN countries also decided to subscribe to the 11 voluntary, non-binding norms recommended in 2015 by the UN GGE, as well as to focus on regional capacity building in implementing these norms. The UN-Singapore Cyber Programme (UNSCP) was launched, focusing on cyber norms, awareness building, and cyber policy scenario planning. In 2020, the ASEAN ministers further agreed to develop a long-term regional cybersecurity action plan to implement the norms. Building on the norms chart that the ASEAN countries developed in 2019, Singapore and the UN Office for Disarmament Affairs (UNODA) agreed to establish a norms implementation checklist, making it applicable to a broader range of UN member states.

In Asia, the Association of Southeast Asian Nations (ASEAN) Regional Forum (ARF) also addresses cybersecurity confidence-building measures and combating cybercrime. In 2012, the ARF produced a ministerial statement intensifying regional cooperation on ICT security (ARF, 2012). In 2017, ASEAN adopted a Cybersecurity Cooperation Strategy, which guides the organisation and its member states in a coordinated approach to building their cybersecurity capacity. In addition, the ASEAN-Singapore Cybersecurity Centre of Excellence and the ASEAN-Japan Cybersecurity Capacity Building Centre were established to raise the level of cyber expertise.

3.3.3. OAS

In 2018, the Organization of American States (OAS) adopted a resolution stressing the need to prepare and agree on a set of CBMs for cyberspace, and starting with the two voluntary measures: sharing information on cybersecurity policies and identifying a national point of contact at the policy level. In 2019, four additional CBMs were recommended, including designating points of contact in ministries of foreign affairs and strengthening capacity building in cyber diplomacy.

The OAS established the Inter-American Cybersecurity Strategy in 2003. This strategy pools the efforts of three related groupings of the organisation: The Inter-American Committee against Terrorism (CICTE), Ministers of Justice or other Ministers or Attorneys General of the Americas (REMJA), and the Inter-American Telecommunication Commission (CITEL). These groups work with member states to implement programmes that prevent cybercrime and protect the CI by legislative and other procedural measures. REMJA fosters cooperation in combating cybercrime through its Working Group on Cybercrime and the Inter-American Cooperation Portal on Cybercrime. Further OAS declarations – Strengthening Cyber Security in the Americas in 2012 and the Declaration on the Protection of Critical Infrastructure from Emerging Threats in 2015 – and CICTE’s Declaration on Strengthening Hemispheric Cooperation and Development in Cybersecurity and Fighting Terrorism in the Americas, renewed the OAS’s commitment to regional cybersecurity.

3.3.4. Africa

The African Union’s Convention on Cyber Security and Personal Data Protection (known as a Malabo Convention), adopted in 2014, provides a legal framework for promoting cybersecurity, combating cybercrime, conducting electronic commerce, and protecting personal data. However, its influence on national legal frameworks remains limited so far, as only 19 of 55 member states had signed or ratified it by mid-2020.

While there are no regional CBMs, there are many cybersecurity and cyber diplomacy efforts on the regional and subregional levels: the Cybersecurity Expert Group (AUCSEG), the Cybersecurity flagship in the AU Agenda 2063, the Policy and Regulations Initiative for Digital Africa (PRIDA), the Programme for Infrastructure Development for Africa (PIDA), the Digital Transformation Strategy for Africa, the Smart Africa Alliance, the ECOWAS’ cybersecurity strategy and the SADC’s action plan on cybersecurity. “Africa as a Cyber Player”, a research conducted by the EU ISS under the EU Cyber Direct initiative, provides a good overview of main players and instruments in the continent, in the fields of cybersecurity and cyber diplomacy.