 States should consider the recommendations from CERT networks on how to best support CERT activities, including the contribution of FIRST, the global network of CERTs, to the OEWG.lxxvii Institute for International Cyber Stability  States should articulate what level of harm that this norm is focused on. International law already prohibits action by one State within the territory of another State (whether this is harm against the government, private sector like critical infrastructure or a combination like a CERT may be) that rises to a certain level of harm (i.e., a use of force). In developing clarity on what level of harm this norm is prohibiting then it may be grounded in or another of international legal principles. This would improve the likelihood of this norm being implemented. This would also serve to deter those States that violate this norm since the victim State would be allowed to conducted responses to the violator therefore raising the costs to those States that chose to violate this norm.  States should pass domestic law or policy that identifies CERTs as critical infrastructure. Microsoft  We believe that digital activities central to daily life deserve protection from cyberattacks. The GGE and the OEWG can and should declare that everyday activities — such as access to food, water, energy, housing, mass transit and other transportation infrastructure, basic functions of civil government (e.g., voting, issuing licenses), health care, and core elements needed for the internet itself to function — should be off-limits to cyberattacks by governments and non-governmental actors. Such declarations would contribute to a process of building expectations and rules governing cyberspace. Tech Accord  As with norm f), we believe that increased transparency around state activity online will help increase the stability and security of our common online environment. The Cybersecurity Tech Accord signatories therefore urge states to issue commitments that they will act in accordance with international law as well as norms of responsible state behavior agreed at the UN.  Secondly, we encourage states to go a step further and be transparent around how they interpret and implement international law and norms. This will not only help solidify these frameworks, but also allow other stakeholders to understand what cyber operations might be seen as permissible and which ones might draw consequences.  Finally, we encourage states to develop effective accountability frameworks, which would allow perpetrators to be punished, and at the same time act as a deterrent against future violations. https://dfat.gov.au/international-relations/themes/cyber-affairs/Documents/ungge-2015-a70174.pdf https://dfat.gov.au/international-relations/themes/cyber-affairs/Documents/ungge-2015-a-res-70-237.pdf iii https://www.dfat.gov.au/international-relations/themes/cyber-affairs/Pages/public-consultation-responsible-state-behaviour-in-cyberspace-in-thecontext-of-international-security-at-the-united-nation iv https://www.dfat.gov.au/sites/default/files/how-australia-implements-the-ungge-norms.pdf i ii v https://www.dfat.gov.au/international-relations/themes/cyber-affairs/Pages/international-security-and-cyberspace vi States which have done this in their national cybersecurity strategies include: Canada (2018), Chile (2017), Costa Rica (2017), France (2015), Greece (2018) and Sweden (2017). National strategies can also include objectives or principles, to respect, protect and promote the human rights of persons, include a definition of cybersecurity which is consistent with human rights and international best practice, and if they include a definition of cybercrime, that definition should be consistent with human rights and international best practice. vii Association of Progressive Communications and Global Partners Digital, “Unpacking the GGE’s framework on responsible state behaviour: Cyber norms” viii Ibid ix https://edpb.europa.eu/sites/edpb/files/webform/public_consultation_reply/kasperskys_submission_on_the_guidelines_on_article_25_data_ protection_by_design_and _by_default.pdf x Association of Progressive Communications and Global Partners Digital, “Unpacking the GGE’s framework on responsible state behaviour: Cyber norms” xi Egloff, Florian J. (2019) “Contested public attributions of cyber incidents and the role of academia” @DFAT DFAT.GOV.AU