 Finally, we encourage governments to participate in regional initiatives that aim to develop and implement confidence building measures, such as the work of the Organization for Security and Co-operation in Europe. Similarly, bilateral initiatives that aim to build trust between partners in cyberspace should be welcomed. (b) In case of ICT incidents, States should consider all relevant information, including the larger context of the event, the challenges of attribution in the ICT environment and the nature and extent of the consequences; Australian Strategic Policy Institute, International Cyber Policy Centre Global Partners Digital  Implementation of norms are demonstrated by states’ actions, capabilities, and strategic policy direction. As this norm deals with means and methods to consider all relevant information in case of attributing an ICT incident, examples of implementation include: - States’ practice of publishing regular cyber threat reports like Australia’s Cyber Threat Report, Singapore’s Cyber Landscape, Indonesia’s HoneyNet project and The Netherlands’ Cybersecurity Security Assessment. - States’ use of frameworks like the UK’s incident categorisation framework, Australia’s governance framework for federal cyber crisis management, the US’ impact assessment framework, and Singapore’s response with a Commission of Inquiry following the SingHealth data breach - States’ ability to follow a whole-of-government approach in reaching an informed position on an incident, i.e. having a process in place that links technical forensics with broader policy considerations. - States’ ability to mobilise and deploy a variety of sources of national power across the spectrum of crisis response (prevention, diplomacy, incident management, and recovery), like the EU’s Cyber Diplomacy Toolbox - States declaring policies and positions on attribution, like whether attributions will be made, publicly or privately, and how States will apply international law.  Although there is currently little available ‘best practice’ with regards to this norm, attribution in cyberspace is a multidimensional activity and therefore requires interdisciplinary research and multistakeholder engagement. Efforts in this regard, which engage all stakeholders including the technical community and civil society, should be supported.  The escalation of tensions between states can harm human rights by leading to increased cyber attacks, which can reduce access to essential services and compromise the integrity of sensitive and personal data.x However, attribution in cyberspace is also contested, and processes which occur before public attribution by governments lack transparency, partly due to a reluctance to reveal methods.xi This contributes to uncertainty, supports deniability and can therefore make deterrence difficult. As a result, independent and trust-building attribution efforts are required. Institute for International Cyber Stability  States should establish a clearing house type of information sharing center (fusion center) where the information from all stakeholders (cybersecurity firms, intelligence agencies, other government agencies with authorities to collect and analyse this type of data, civil society, academics) can be collected and analysed at the unclassified level. As states create such a center for national information sharing the government leaders can use this analyse to become more informed about ALL the relevant information in making attribution decisions. Kaspersky  To overcome the lack of attribution or misattribution which can lead to escalation of tensions between states, it is necessary to develop transparent and trusted platforms for exchange of threat information between private actors and government agencies, including CERTs.  As an example of the private sector’s approach, Kaspersky developed its Threat Intelligence Portalxii to provide access to technical descriptions of the very latest threats during an ongoing investigation; insight into non-public investigations; detailed supporting technical data and access to our YARA rules; continuous campaign monitoring; and access to actionable intelligence during an investigation (information on campaign distribution, IOCs, C&C infrastructure). As a support to cyber capacity building in the fight against cybercrime, we provide freemuim access to the Portal within our free package for Law Enforcement Agencies.xiii @DFAT DFAT.GOV.AU