1. EXPLANATION OF THE NORM PACKAGE AND FOCUS OF THE GCSC From its very beginnings, cyberspace has been designed in a decentralized manner, and therefore relatively loosely governed. This helped encourage the fledging technology and was likely critical for its rapid growth. Cyberspace has created unprecedented social and economic benefits, but it also created real risks and challenges for international peace and stability. While cyberspace is no longer the “Wild West,” many nations still see it as an unconstrained arena for conflict. Dangerous actions by both state and nonstate actors produce a growing sense of concern in the international community and the public at large. These concerns have created widespread demand for better and more explicit governance structures for what has become an essential global infrastructure. Governance describes how individuals and both public and private institutions manage their shared interests and responsibilities. It can include both informal arrangements and formal institutions. Norms are foundational for agreement between stakeholders, better governance, and therefore the initial focus of our work. They also provide an apparent starting point for “what needs to be done” — a basic sensetest of what practical and operational steps need to be undertaken to achieve initial measures of “cyber stability” — and help us define what cyber stability actually is. Accordingly, the Global Commission on the Stability of Cyberspace (GCSC) has approached its deliberations in a “bottom-up to top-down” manner. Firstly, the Commission is to identify operational norms that meet the most obvious urgent international cybersecurity needs as expressed by its members and which have not been addressed elsewhere.1 1 The first two of these norms, the “Call to Protect the Public Core of the Internet” and the “Call to Protect Electoral Infrastructure,” have been published on the GCSC website https://cyberstability.org/research/. 6 NORM PACKAGE SINGAPORE Secondly, it will extrapolate from these and already existing norms a working definition of cyber stability and its underlying principles. Thirdly, it will use these principles to develop a clearer understanding of what the international peace and security architecture needs to do to meet that definition. Fourthly, it will offer recommendations to state and non-state stakeholders on how this can be accomplished. Taken together, the Commission aims to have a significant impact on the international peace and security architecture as it is relevant to cyberspace. Throughout its deliberations, the GCSC is guided by significant shared core beliefs. These include the importance of a democratic, multi-stakeholder approach to governance, the necessity to promote development and economic growth, the need to balance rights and responsibilities for both states and individuals, and the centrality of cyberspace remaining open and unimpeded in its operations. We aim to expand the global understanding of responsible behavior in cyberspace in the context of international peace and security for both state and non-state actors. We do not begin this work in a vacuum. Various stakeholder groups have identified possible norms and principles. These include the United Nations Group of Governmental Experts in the Field of Information and Telecommunications in the Context of International Security (UN GGE),2 the G20,3 the 2 See, for example, the 2013 (A/68/98) and 2015 (A/70/174) Report of the United Nations Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (UN GGE). 3 See G20 Leaders’ Communiqué, Antalya Summit, 15-16 November 2015; G20 Leaders’ Communiqué, Hangzhou Summit, 4-5 September 2016. GLOBAL COMMISSION ON THE STABILITY OF CYBERSPACE