 infrastructures of other states. States should increase exchanges on standards and best practices with regard to critical infrastructure protection and encourage enterprises to embark on such exchanges. Data security  States should take a balanced approach with regard to technical advancement, business development and safeguarding national security and public interests.  States have the rights and responsibilities to ensure the security of personal information and important data relevant to their national security, public security, economic security and social stability. States shall not conduct or support ICT-enabled espionage against other states, including mass surveillance and theft of important data and personal information. States should pay equal attention to both development and security, and push for the lawful, orderly and free flow of data. States should facilitate exchanges of best practices and cooperation in this regard.   16