on surveillance and other investigatory powers, consistent with international standards and best practice, and which include independent oversight, grievance mechanisms and access to remedy (UNGA 68/167).  States should adopt a comprehensive legislative framework on data protection with international standards and best practice such as Council of Europe’s Convention No. 108 and the OECD Privacy Guidelines, and which include independent oversight, grievance mechanisms and access to remedy (UNGA 68/167). Institute for International Cyber Stability  States should clarify what human rights they interpret to be part of binding international law. Where there is a common understanding on this then from that point a more specific and focused approach could be developed re human rights related to ICTs. Microsoft  Considering the broader context, we recommend focusing on the promotion of common understandings of specific rules of international law, as outlined in our response to Question #4 below.xxii Tech Accord  Cybersecurity Tech Accord signatories believe that the same rights that people have offline must also be protected online, and that this includes the right to freedom of expression and privacy. We urge states to ensure these are upheld, in line with their international commitments to human rights.  To this end, we encourage states to ensure human rights are at the heart of all their cybersecurity efforts, starting with national cybersecurity strategies, highlighted above. States should also consider institutionalizing offices charged with protecting human rights online, for example around online safety, information, or privacy.  Multistakeholder dialogue and engagement in pivotal in understanding how particular polices might impact the ability of individuals to exercise their human rights. With that in mind we urge states to consult with industry, and in particular with civil society, when adopting cybersecurity policies and approaches domestically; and engage with groups such as Freedom Online Coalition internationally. (f) A State should not conduct or knowingly support ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public Australian Strategic Policy Institute, International Cyber Policy Centre  Implementation of norms are demonstrated by states’ actions, capabilities, and strategic policy direction. As this norm deals with the prohibition to damage critical infrastructure of other States, examples of implementation include: - States’ acknowledgement of their sovereign cyber capabilities, including their mandate - States’ sovereign cyber capabilities participate in national and international exercises - States develop, enact and publish operational policies or doctrines guiding their sovereign cyber capabilities - States make public statements on the application of international law and its commitment to upholding international obligations in the conduct of cyber operations - States provide transparency about the conduct and use of sovereign cyber capabilities. Global Partners Digital  See recommendations with regards to critical infrastructure protection below. Institute for International Cyber Stability  First, States should provide a list of what they consider to be critical infrastructure. Second, States should provide their interpretation of international law that focuses on the responses that would be lawful under international law if a State or its proxy were to violate this norm. Seeking a common understanding on what countermeasures under international law would be acceptable if critical infrastructure was intentionally damaged by a State or it proxy that has been attributed to a State would be very useful in the implementation of this norm. Microsoft  We believe that the key step here will be to establish common standards — both technical and legal — for attributing internationally wrongful acts to states and @DFAT DFAT.GOV.AU