TIMELINE OF MAJOR EVENTS
2016
2018 2012
Ministerial Council Eleven Decision (No. 5/17) transparency agree to place a measures adopted specific focus (Permanent Council on CBM Decision No. 1106). implementation.
Open-ended Five co-operative “Adopt-a-CBM” 2013
2017 MARCH
Informal Working measures adopted initiative introduced Group (IWG) (Permanent Council by IWG Chair. established under Decision No. 1202). the auspices of the Security Committee (Permanent Council OSCE Secretariat NOVEMBER
Decision No. 1039). conducts first Communications Check for the CBM 8 Point of Contact network.
Foreign Ministers of DECEMBER
OSCE participating States endorse the CBMs at the Ministerial Council (Decision No. 5/16).
2 IN THE PAST 10 YEARS
2022 2020 CBM 14 report on “Emerging Practices in Cybersecurity- Related Public- Private Partnerships First meeting of the E-learning course and Collaboration in CBM 8 Points of on OSCE’s cyber/ICT OSCE participating Contact in Vienna. security CBMs. States”.
OSCE Secretariat E-learning course 2019
2021
2023 introduced online SEPTEMBER on CBM 16 expert sessions. Coordinated Vulnerability Disclosure.
CBM 15 report on NOVEMBER
“Cyber Incident Classification: A Report on Emerging Practices within the OSCE region”.
10 YEARS OF OSCE CYBER/ICT SECURITY CONFIDENCE-BUILDING MEASURES 3 Foreword by the OSCE Chairman-in-Office
In today’s interconnected world, where Information for co-operation, and facilitates communication and Communication Technologies (ICTs) have become through contact points and terminology sharing, the backbone of communication, commerce, and through the established Informal Working Group diplomacy, the need for a secure and co-operative under the PC Decision 1039. cyberspace cannot be understated. The Organization The 10th Anniversary of the first set of cyber/ICT for Security and Co-operation in Europe (OSCE) has security CBMs, as well as the current security circum- emerged as a pioneer in enhancing cyber/ICT security. stances in Europe remind us that we need to make OSCE, the largest regional security organization that more in meaningful implementation of CBMs for the has a rich history in traditional arms control, in addition benefit of people in the OSCE Region. As Chairman in has successfully adapted its expertise to the digital Office of the OSCE, I once again reiterate that our firm age, focusing on building confidence with the aim to commitment to consistent focus on cyber/ICT security reduce the risks of conflict arising from the use of ICTs will be added value in reaching the comprehensive by its participating States. security in Europe. These CBMs are probably one of the At the heart of these efforts are confidence-building most effective means that exist in the OSCE toolbox. measures (CBMs), practical and non-binding meas- This booklet explores collaborative efforts between ures aimed at enhancing transparency, co-operation, CBM adopters and the OSCE Secretariat, resulting in and stability in cyberspace. These measures have the development of valuable cyber capacity-building evolved to address emerging challenges, covering tools, including also insightful reports. areas in the scope of sharing cybersecurity-related In conclusion, this account of OSCE’s journey in information and critical infrastructure protection, thus enhancing cyber/ICT security through CBMs reflects creating cyber resilience in the participating States. the organization’s commitment to creating a safer and In December 2013, when OSCE participating States more stable cyberspace. As you explore these pages, adopted the first set of confidence-building measures you’ll gain an understanding for the co-operation which focus on increasing transparency through vol- driving this vital endeavour. OSCE has not only adapted untary exchange of information between participating to the digital age but has also embraced it, showing States, thus identifying common problems and seek- the way forward for regional and international organi ing joint solutions. zations in the pursuit of cyber stability. These measures include sharing national perspec- OSCE functionality and relevance lie in its tools. tives on ICT threats, fostering co-operation among CBMs on cyber/ICT security are important tools that relevant national bodies, conducting consultations have proved being one of the best in the list. There- to reduce misperception and protect critical ICT fore, we better implement them. It’s about people! infrastructure, and exchanging information on ensuring a secure internet. OSCE serves as a platform BUJAR OSMANI for dialogue, encourages modern national legislation Chairman-in-Office
4 Foreword by the OSCE Secretary General
2023 marks the 10th anniversary of the adoption of tation. They have made the enhancement of national the first set of cyber/ICT security confidence-building capacities and cybersecurity skills a top priority, measures (CBMs) at the Organization for Security and signalling that international co-operation remains Co-operation in Europe (OSCE). The adoption of the both possible and mutually beneficial. CBMs in 2013 signaled a breakthrough in international This publication takes stock of the work the OSCE has cyber policy negotiations, with the OSCE being the done over the past decade and marks the significant first regional security organization to adopt concrete achievements along the way. It serves as a reminder of measures in support of discussions at the United the importance of working together towards common Nations. goals and shared values, and as an inspiration to all The OSCE pioneered these efforts with the aim to of us to continue discussions on cyber/ICT security in reduce the risks stemming from the use of ICTs, and the OSCE, as well as in other international fora. We to foster transparency and co-operation in the OSCE have come a long way and look forward to continued area. CBMs may be voluntary and non-binding, but progress. participating States have made a political commit- ment to adhere to these measures and they are mak- HELGA MARIA SCHMID ing a real difference. Over the past decade, the OSCE OSCE Secretary General has become a global leader in the practical and mean- ingful implementation of cyber/ICT security CBMs, thanks to the active engagement of its participating States and with the support of the OSCE Secretariat. These efforts have paved the way for new partner- ships among states from various OSCE sub-regions and have fostered co-operation between neighbour- ing countries. The objective is to increase national cybersecurity resilience and thereby make the OSCE participating States more secure in cyberspace. The concrete results of these efforts include publicly available capacity-building tools that not only pro- mote the OSCE’s work in this field but also serve as inspiration for other regions when embarking on the path of confidence-building. OSCE participating States have affirmed the contin- ued relevance of cyber/ICT security CBMs and have intensified efforts towards their practical implemen-
10 YEARS OF OSCE CYBER/ICT SECURITY CONFIDENCE-BUILDING MEASURES 5 Introduction to CBMs The Organization for Security and Co-operation in pating States have developed and adopted a set of Europe (OSCE) is the largest regional security organi confidence-building measures (CBMs) to reduce the zation with a comprehensive approach to security risks of conflict stemming from the use of ICTs. and vast experience in traditional arms control. It is In 2012, an open-ended Informal Working Group a pioneer in enhancing cyber/ICT (Information and (IWG) was established under the auspices of the Communication Technologies) security, in particular Security Committee (Permanent Council Decision No. by reducing the risks of conflict stemming from the 1039) with the mandate to elaborate a set of CBMs to use of ICTs by its participating States. With States enhance interstate co-operation, transparency, pre- increasingly using ICTs to pursue their foreign policy dictability and stability, and to reduce the risks of objectives, these technologies add a complex dimen- misperception, escalation and conflict that may stem sion to inter-state relations. To address this, partici- from the use of ICTs.
Since then, participating States have adopted two sets of CBMs:
• Eleven transparency measures adopted in 2013 (Permanent Council Decision No. 1106), which promote cyber resilience and preparedness, encourage communication and increase transparency. • Five co-operative measures adopted in 2016 (Permanent Council Decision No. 1202), which further address effective communication channels, public-private partnerships (PPPs), critical infrastructure protection and the sharing of vulnerability information.
The 16 CBMs aim to build multi-layered relationships In 2016 and 2017, the foreign ministers of the OSCE based on openness and co-operation and lay a foun- participating States reaffirmed their commitment dation for the peaceful resolution of disputes in cyber to the CBMs and agreed to place a specific focus space. Whilst the measures are non-binding, all 57 on implementation, drawing attention to using the participating States made a political commitment to CBMs in practice (Ministerial Council Decision No. 5/16 adhere to them. and Ministerial Council Decision No. 5/17).
6 The role of the OSCE Secretariat The OSCE Secretariat’s Transnational Threats events on topics such as sub-regional co-operation, Department assists participating States in their the applicability of international law in cyberspace, efforts to implement cyber/ICT security CBMs cyber diplomacy and other specialized topics. both at national and regional levels. For example, To complement these in-person activities, the OSCE the Department organizes a range of activities also organizes a series of online events, which include designed to enhance states’ capacities to tackle dedicated expert sessions for the CBM 8 PoC network cybersecurity-related threats, with a key focus or the OSCE Cybersecurity Awareness Month. on regional co-operation. These include training
10 YEARS OF OSCE CYBER/ICT SECURITY CONFIDENCE-BUILDING MEASURES 7 NUMBER OF PARTICIPANTS IN OSCE EVENTS ON CYBER/ICT SECURITY
1455
1120
668 676 556
167
In-person Annual meeting Online expert E-learning Inter-regional CiO cyber/ICT training events of CBM 8 sessions courses conferences security conferences
In recent years, the exchanges and co-operation with other regional organizations that have already developed, or are in the process of negotiating, their own regional cybersecurity confidence-building measures, have also increased. The OSCE regularly contributes to inter-regional co-operation activities and shares lessons learned, while publications about OSCE’s good practices on implementing specific CBMs are publicly available to serve as an inspiration to other regions. In order to highlight the practical applicability of the cyber/ICT security CBMs, the OSCE Secretariat developed a general e-learning course featuring the diverse and extensive work in the OSCE region on operationalizing these measures.
Expected learning effort: Certificated offered: Language: OSCE e-learning platform: 2 hours (self-paced) Certificate of completion English, French, Russian https://elearning.osce.org/
As at 1 October 2023, there are more than 1240 learners enrolled in this course.
8 Chairpersonships-in-office Since the adoption of the first set of CBMs, OSCE Chairpersonships-in-O ffice (CiO) began organizing workshops and conferences dedicated to cyber/ICT security as one of their key priority areas:
Workshop on global, regional and sub-regional Workshop on Annual co-operation reducing the conference on Serbia to support the Germany risks of conflict Austria the protection implementations stemming from of critical 2015 of CBMs 2016 the use of ICTs 2017 infrastructure
Annual Annual conference Annual conference on Italy on cyber/ICT Slovakia conference on Albania multi-stakeholder security CBM multilateralism in co-operation in 2018 implementation 2019 cyber diplomacy 2020 cyberspace
Annual Annual conference Annual conference conference on a comprehensive on raising social awareness, promoting North on comprehensively addressing cyber Sweden approach to Poland cyber in education Macedonia security challenges and cyber/ICT and building cyber improving resilience 2021 security 2022 resilience 2023 across different sectors
10 YEARS OF OSCE CYBER/ICT SECURITY CONFIDENCE-BUILDING MEASURES 9 Implementation of cyber/ICT security CBMs Since 2015, the rate of CBM implementation has risen during the training events and workshops organized from 61% to 98%, measured as participating States by the OSCE Secretariat. On a voluntary basis, States implementing at least one of the 16 CBMs at national can also share information related to the implemen- level. Regular reporting of national developments in tation of CBMs on an online platform, thus making the field of cyber/ICT security related to the CBMs is the information available to the other participating encouraged in the IWG, but also in various activities States.
THE OSCE DEVELOPED A SERIES OF CONFIDENCE-BUILDING MEASURES (CBMs) TO REDUCE THE RISKS OF CONFLICT STEMMING FROM THE USE OF ICTs IN THE OSCE REGION:
Use of CBMs by participating States
Crisis Greater Communications Channels Co-operation 61% 90% 98%
2015 2016 2022
Understanding Critical Points of Contact Network States’ postures on infrastructure the use of ICTs Protection
56/57 Participating States Ready to Communicate
10 CBM 8 POINT OF CONTACT NETWORK
The most implemented CBM to this day is No. 8, with regular meetings and facilitating bilateral exchanges 56 participating States having nominated at least between them, the OSCE has transformed a list of one Point of Contact (PoC) and made that informa- names into a community of policymakers that work tion available to other States. The OSCE maintains together to promote cyber stability. an up-to-date directory of CBM 8 PoCs on an online To ensure that the CBM 8 PoC Network is up to date platform and supports the network’s further develop and functioning properly, the OSCE organizes regular ment into a community of cyber policy and technical communication checks—short exercises designed to experts on the basis of common experiences and check the relevance of the contact information as well practical interactions. as practice communication between PoCs in the event For a number of years, the OSCE Secretariat has of a real incident. These checks include tasks ranging worked with participating States to build a strong from responding to simple questions to complex network of technical and political PoCs, with the aim scenarios that require collaboration between PoCs of fostering trust and co-operation. By organizing from different participating States.
The “Adopt-a-CBM” initiative The national implementation of the CBMs is a volun- champion the implementation of specific CBMs. It in- tary commitment by each participating State, however vites them to explore concrete modalities for achieving the measures adopted at the political level need to national- and regional-level CBM implementation. Over be put into practice to be meaningful. With the aim of the years, it has proved fruitful and has substantially encouraging the OSCE-wide implementation of CBMs contributed to an increase in the practical implementa- and co-operation between participating States, the tion efforts, with a substantial number of participating 2018 Chair of the IWG inaugurated the “Adopt-a-CBM” States joining the initiative. So far, nine CBMs have initiative, which encourages participating States to been adopted by 23 participating States.
10 YEARS OF OSCE CYBER/ICT SECURITY CONFIDENCE-BUILDING MEASURES 11 “For over a decade, the OSCE Informal Working Group on cyber/ICT security has been working on confidence-building measures to increase interstate co-operation, transparency, predictability, and stability. The sixteen measures are not only relevant for the OSCE, but further support the United Nations framework for responsible state behavior in cyberspace. As key tools for strengthening international peace and security, we must continue working on their implementation. One such effort is the “Adopt-a-CBM” initiative, which has already gathered almost half of the OSCE participating States to share good practice examples. I am heartened by the active engagement of participating States and our shared commitment to continuing the practical focus of our work.”
Ambassador Christophe Kamp Permanent Representative of the Kingdom of the Netherlands in the OSCE and Chair of the Informal Working Group
CBM 8 and CBM 11 are not part of the “Adopt-a-CBM” initiative and can be considered as continuously implemented: CBM 8 through the OSCE Secretariat’s activities related to the PoC Network and CBM 11 by ensuring that the meetings of the Informal Working Group are convened at least three times a year. CBMs 3, 4, 5, 9, 12, 13, 14, 15 and 16 are championed through the “Adopt-a-CBM” initiative.
* championed through the “Adopt-a-CBM” initiative
12 Some of the CBMs have only been adopted by one CBM 9 – A GLOSSARY OF ICT-RELATED participating State, while other measures are cham- TERMINOLOGY IN THE OSCE REGION pioned by a group of countries, requiring additional co-operation and co-ordination. As a result of these Serbia decided to be an adopter of CBM 9, which refers efforts, a variety of activities have taken place, bene- to national terminologies and definitions of terms in fitting all participating States. Every group has issued the field of information security. A publicly available discussion papers, which lay down the vision for the website (cbm9.gov.rs) was set up to provide a glossary OSCE-wide implementation of the specific CBM, while of cyber/ICT security-related terminology derived other adopter groups have reached out to participating from official documents of the OSCE participating States through questionnaires, to map the national States and translated into the official languages of state of play and positions related to the specific the OSCE. There is currently no intention to develop CBMs. Organizing events with expert speakers on a consensus terminology, however Serbia plans to specific topics has also become a popular approach to undertake an analysis of the used terminology, as explore the modalities for implementing a CBM. The well as the similarities and differences in definitions. concrete results of such CBM adopter co-operation As at October 2023, the glossary comprises more are publicly available capacity-building tools, like than 2000 terms. a database of ICT-related terminology, an e-learning course and good practice reports.
Joint activities for CBM implementation Over the years, the OSCE Secretariat’s Transnational Threats Department has developed projects to support the implementation of CBMs and the activities of the adopter groups. Such support included the development of an e-learning course, conducting research and publishing good practice reports. These resulted in publicly available cyber capacity-building tools.
10 YEARS OF OSCE CYBER/ICT SECURITY CONFIDENCE-BUILDING MEASURES 13 E-LEARNING COURSE ON COORDINATED VULNERABILITY DISCLOSURE, CBM 16
To support the implementation of CBM 16, the OSCE in a way that minimizes their harm. The e-learning Secretariat has developed a specialized e-learning course provides an overview of coordinated vulner- course on the topic of coordinated vulnerability dis- ability disclosure as a tool to strengthen national, closure — a process on managing ICT vulnerabilities regional and international cybersecurity.
Expected learning effort: Certificated offered: Language: OSCE e-learning platform: 2 hours (self-paced) Certificate of completion English https://elearning.osce.org/
As at 1 October 2023, there are more than 260 learners enrolled in this course.
REPORT RELATED TO CBM 14 – EMERGING PRACTICES IN CYBERSECURITY-RELATED PUBLIC-PRIVATE PARTNERSHIPS AND COLLABORATION IN OSCE PARTICIPATING STATES, MARCH 2023
The report builds upon previous studies carried out by participating States, which gathered examples of public- private partnerships (PPPs) in cyber/ICT security. It is based on a series of interviews the OSCE Secretariat conducted with public sector representatives actively involved in co-operation with the private sector. The report highlights examples of existing practice from OSCE participating States and provides baseline re commendations to promote public-private collabora- tion as an important element in strengthening national cyber resilience and international cyber stability.
14 REPORT RELATED TO CBM 15 – CYBER INCIDENT CLASSIFICATION: A REPORT ON EMERGING PRACTICES WITHIN THE OSCE REGION, NOVEMBER 2022
The report highlights emerging practices in national classification of cyber incidents by underlining com- monalities in existing approaches among OSCE participating States and identifying the limitations of this process. Experiences in developing cyber incident classification systems might be diverse across participating States, however, exchanges about these experiences build trust and understanding on a regional and international level. The report contains recommendations for setting up national incident classif ication systems and serves as a capacity- building tool within the OSCE area and beyond.
OSCE Communities In order to promote greater transparency and explore edit their country profiles, add essential information, possible avenues of inter-state co-operation, CBM 1 like the names and contacts of their national Points and CBM 7 encourage OSCE participating States to of Contact, and share documents, including national share information on their national structures, strate legislation, cybersecurity strategies and cyber threat gies, policies and programmes responsible for cyber/ assessments. This information is accessible to other ICT security, as well as their national views on various participating States, allowing them to better under- aspects of national and transnational threats to and in stand each other’s policies and positions, and avoid the use of ICTs. To facilitate such exchanges, the OSCE misunderstandings. Furthermore, OSCE Communities provides a dedicated workspace on its website, the serves as a platform for the PoC network through OSCE Communities. There, participating States can which States can voluntarily share further information.
10 YEARS OF OSCE CYBER/ICT SECURITY CONFIDENCE-BUILDING MEASURES 15 Published by the Organization for Security and Co-operation in Europe Vienna, October 2023 © OSCE 2023
Layout and design by Rita Papp
All rights reserved. The contents of this publication may be freely used and copied for educational and other non-commercial purposes, provided that any such reproduction is accompanied by an acknowledgement of the OSCE as the source.
This publication is published in line with the mandate of the OSCE Transnational Threats Department. The views expressed in this publication are those of the authors and do not necessarily reflect the official position of the OSCE and its participating States.
ISBN 978-92-9271-249-5
Transnational Threats Department
OSCE Secretariat Wallnerstrasse 6, A-1010 Vienna, Austria https://www.osce.org/secretariat/cyber-ict-security