have confidence in the security of ICT products. States should seek to prevent the proliferation of malicious ICT tools and techniques and the use of harmful hidden functions; Cyber Policy Centre Global Partners Digital - States conduct a national telecommunications supply chain review, like the UK in 2019 - States introduce an IT security certification scheme like the UK’s Cyber Essentials; and States’ participation in international arrangements for mutual recognition of certified products and service, like the Common Criteria initiative - States’ prohibiting the deliberate introduction of systemic weaknesses/vulnerabilities in ICT products; and States combating black markets in ICT products. - States’ participation in the Wassenaar Arrangement on the transparency of dual-use goods and technologies - States have national bodies technically able and mandated to advice, assess and certify industry products and consumer goods, like a national cybersecurity centre, universities of national scientific organisations. - States’ emerging practice of considering ICT products and services as critical national (security) infrastructure, like the decisions of various States in regard to 5G infrastructure providers or cybersecurity service providers. - States’ ability to access Industry transparency centres, like Huawei’s centre in the UK, Microsoft’s in Singapore, and Kaspersky’s in Switzerland.  Ensuring the integrity of the supply chain requires that states refrain from mandating backdoor access to ICT products (hardware and software) and in popular communication platforms. Additionally, this norm is about preventing the proliferation of malicious ICTs and techniques.xliii Malware and software vulnerabilities which are used to target HRDs have been disseminated through app stores and software updates. As mentioned above in relation to norm (a), it is crucial for the peace and stability of cyberspace that states promote measures which increase the stability and security of ICTs. This requires measures which protect, instead of weaken, strong encryption as weak encryption can introduce vulnerabilities into the supply chain, and contribute to the proliferation of malicious ICT tools and techniques. States should support privacy by design in the supply chain including via multistakeholder initiatives such as the Online Trust Alliance to develop and advance best practices to protect users’ security, privacy, and identity.xliv  Other steps states can take to support supply chain integrity include the conduct of human rights impact assessmentsxlv and the inclusion of supply chain security and steps taken to mitigate against the proliferation of malicious ICT tools and techniques in National Action Plans (NAPs).xlvi ICRC & Australian Red Cross  Those who develop cyber capabilities should consider creating obstacles to make repurposing difficult and expensive. While it is hardly possible from a technical standpoint to guarantee that malware cannot be repurposed, methods like encrypting its payload and including obstacles in different components of the code, for example, could raise the bar in terms of the expertise required to reengineer malicious tools.xlvii Kaspersky  Supply chain attacks remain the most destructive and difficult to prevent. Therefore, for the implementation of this norm is crucial to develop frameworks for technical and institutional evaluation of the trustworthiness of supply chain vendors. From the vendor side, it is important to ensure the integrity of the supply chain through the publicly communicated policies and practices. Our Global Transparency Initiativexlviii (GTI) as a set of practical measures to increase transparency and accountability in cybersecurity could be a guiding example for the private sector.  Practically speaking, the GTI includes framework to build trust and confidence of users in cybersecurity: - Data Care: relocation of data processing and data storage to Switzerland – a state with long famous neutrality and strict data protection regulation; - Dedicated Transparency Centersxlix for accessing Kaspersky’s source code, software updates and threat detection rules, along with other activities, for external review. There we also provide access to review types of information @DFAT DFAT.GOV.AU