A/75/123 France has also promoted the use of third-party certification principles, under the authority of the National Cybersecurity Agency, to ensure that the market provides the highest level of security. This process is being piloted at the Agency by the National Certification Centre. France has also promoted the establishment of such certificates at the European Union level. In order to strengthen efforts to counter the proliferation of malicious tools and techniques, France has also supported the inclusion of intrusion software in the list of dual-use goods of the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies. Norm (j): States should encourage responsible reporting of ICT vulnerabilities and share associated information on available remedies to such vulnerabilities to limit and possibly eliminate potential threats to ICTs and ICT-dependent infrastructure. As stated above, France has taken various steps to allow the responsible disclosure of computer vulnerabilities and has developed cooperation at the technical level through the National Cybersecurity Agency, which regularly exchanges information on vulnerabilities and available solutions with its counterparts and partners. Norm (k): States should not conduct or knowingly support activity to harm the information systems of the authorized emergency response teams (sometimes known as computer emergency response teams or cybersecurity incident response teams) of another State. A State should not use authorized emergency response teams to engage in malicious international activity. Act No. 88-19 of 5 January 1988 on computer fraud, known as the Godfrain Act, was the first French law to punish computer crime and hacking. It criminalizes the act of fraudulently accessing or remaining in all or part of an automated data processing system. The French governance model, under which offensive capabilities are distinguished from defensive capabilities and missions, ensures that that principle is respected. The missions of the government computer emergency response team include the coordination and investigation of responses to cyberincidents, not only for the Government but also for operators of critical infrastructure and essential services as defined in law, by helping those operators to establish the necessary level of protection, detect vulnerabilities in networks and systems, organize the response to incidents, with the help of partners if necessary, and participate in a trusted network of computer security incident response teams. Application of international law, including the Charter of the United Nations, to cyberspace: another principle recognized by the Group of Governmental Experts France believes that the emergence of a collective cybersecurity framework can be based only on compliance with the rules of international law. It therefore does not believe that a new legally binding international instrument dedicated to the challenges of cybersecurity needs to be established at this stage. Existing international law applies to cyberspace, as it does to other spheres, and must be respected. As the Group of Governmental Experts concluded in its 2013 report, the principles and rules of international law apply to the behaviour of States in cyberspace. Even given the specific characteristics of cyberspace, such as anonymity and the role of private actors, international law provides the means necessary to responsibly control the behaviour of States in that environment. 20-08285 37/84