xii https://opentip.kaspersky.com/ xiii https://media.kaspersky.com/en/enterprise-security/supporting-law-enforcement-agencies.pdf xiv Association of Progressive Communications and Global Partners Digital, Unpacking the GGE’s framework on responsible state behaviour: Cyber norms xv Information Commissioner’s Office (ICO) “Investigation into data analytics for political purposes” xvi Kaye, David, Surveillance and human rights “Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression”, A/HRC/41/35 xvii Ibid xviii Open-ended intergovernmental expert group to conduct a comprehensive study of the problem of cybercrime xix https://www.kaspersky.com/about/press-releases/2019_kaspersky-extends-cooperation-with-interpol-in-joint-fight-against-cybercrime xx https://www.christchurchcall.com/ xxi In particular, states can explicitly recognise the role that cybersecurity plays in protecting human rights in national cybersecurity strategies. See footnote 1 for examples. xxii https://www.dfat.gov.au/sites/default/files/cyber-submission-microsoft.pdf xxiii https://www.dfat.gov.au/sites/default/files/cyber-submission-microsoft.pdf xxiv GFCE, “Global Good Practices - Critical Information Infrastructure Protection”; the GFCEMERIDIAN Good Practice Guide on Critical Information Infrastructure Protection for governmental policy-makers; Companion Document to the GFCE-MERIDIAN Guide on CIIP xxv GFCE, Companion Document to the GFCE-MERIDIAN Guide on CIIP xxvi OECD (2019) “Recommendation on Digital Security of Critical Activities” xxvii ICRC, ‘The potential human cost of cyber operations’ (L. Gisel and L. Olejnik, eds), Expert Meeting Report ('Human Cost Report'), May 2019, p9 xxviii Human Cost Report pp 9 and 39-40. xxix Position Paper, p. 6; ICRC, ‘International Humanitarian Law and the Challenges of Contemporary Armed Conflicts’, October 2015, p. 43; https://www.icrc.org/en/download/file/15061/32ic-report-on-ihl-and-challenges-of-armed-conflicts.pdf. xxx Human Cost Report, pp. 39-42 and 75-77. xxxi Human Cost Report, pp. 9 and 40 - 41. xxxii https://ec.europa.eu/digital-single-market/en/network-and-information-security-nis-directive xxxiii https://www.gov.uk/government/collections/nis-directive-and-nis-regulations-2018 xxxiv http://download.microsoft.com/download/4/6/0/46041159-48FB-464A-B92A-80A2E30B78F3/MS-riskmanagement-securitybaselines-WEB.pdf xxxv https://www.crx2.org/ xxxvi https://www.iso.org/standard/72437.html xxxvii https://www.nist.gov/cyberframework xxxviii xxxix https://www.iso.org/standard/72437.html https://www.nist.gov/cyberframework xl https://www.intgovforum.org/multilingual/content/igf-2019-–-day-3-–-saal-europa-–-ws-63-usual-suspects-questioning-the-cybernorm-making xli OECD (2019) “Recommendation on Digital Security of Critical Activities”, xlii European Commission, “The Directive on security of network and information systems (NIS Directive)” xliii Association of Progressive Communications and Global Partners Digital, “Unpacking the GGE’s framework on responsible state behaviour: Cyber norms” xliv Internet Society, Online Trust Alliance xlv Article 19, “Assessing the Human Rights Impact of Internet Registries” xlvi Some examples of states that have included reference to the mitigation options for avoiding or reducing human rights risks associated with ICTs in their NAPs include Luxembourg and the UK, National Action Plans on Business and Human Rights xlvii Human Cost Report, p. 9. xlviii xlix https://www.kaspersky.com/transparency-center https://www.kaspersky.com/transparency-center-offices l https://www.kaspersky.com/about/compliance-soc2 li https://www.iiconsortium.org/pdf/Software_Trustworthiness_Best_Practices_Whitepaper_2020_03_23.pdf lii https://www.gov.uk/government/publications/code-of-practice-for-consumer-iot-security liii https://www.enisa.europa.eu/publications/good-practices-for-security-of-iot-1 liv CEPs (2018) “Software Vulnerability Disclosure in Europe: Technology, Policies and Legal Challenges”; ENISA (2016) “Good Practice Guide on Vulnerability Disclosure: From Challenges to recommendations”; Global Forum on Cyber Expertise (2017) “Global Good Practices - Coordinated Vulnerability Disclosure (CVD)” lv Examples include: Australia, Responsible Release Principles for Cyber Security Vulnerabilities, United Kingdom Government Communications Headquarters, the Equities Process; United States, Vulnerabilities Equities Policy and Process for the United States Government lvi CEPs (2018) “Software Vulnerability Disclosure in Europe: Technology, Policies and Legal Challenges” lvii United Kingdom, National Cyber Security Centre, Vulnerability Reporting, “How to report a vulnerability in a UK government website or system” lviii ISO/IEC 29147:2014 [ISO/IEC 29147:2014], Information technology — Security techniques — Vulnerability disclosure; ISO/IEC 30111:2013 [ISO/IEC 30111:2013] Information technology — Security techniques — Vulnerability handling processes lix The Netherlands provides an example of a regulatory framework for vulnerability reporting which provides legal certainty to researchers, CEPs (2018) “Software Vulnerability Disclosure in Europe: Technology, Policies and Legal Challenges” @DFAT DFAT.GOV.AU