G74 and regional organizations,5 as well as non-state norms developed by Microsoft6 and ISOC,7 to name but a few. It has also greatly benefited from the work done within the Internet governance ecosystem, including the work of the NETmundial Initiative8 as well as the many initiatives occurring within the wider Internet Governance Forum (IGF) ecosystem.9 The GCSC’s first task is therefore to examine how existing norms can be better supported and accompanied, where new norms are needed, and how to put these norms into operation and use. A norm works best when the international community is seized by it, when it shapes both the behavior of public and private institutions and the decisions of national leaders, and when it makes clear to all that some actions fall outside the bounds of what is acceptable. There are precedents for our work. The Brundtland Commission created norms for Sustainable Development. A Carnegie Commission on Preventing Deadly Conflict led to the International Commission on Intervention and State Sovereignty and a 4 See G7 Taormina Leaders’ Communiqué, Taormina Summit, 26-27 May 2017. 5 Including but not limited to the work of ASEAN, AU, EU, OSCE and SCO. 6 See, for example, Microsoft, International Cybersecurity Norms: Reducing Conflict in an Internet-Dependent World, from https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/ REVroA; The case for International Cybersecurity Norms, from https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/ REY05a. 7 For example, MANRS, Mutually Agreed Norms for Routing Security, from https://www.manrs.org. 8 See the statement from the NETmundial Initiative here: http://netmundial.br/netmundial-multistakeholder-statement/ 9 See, for example, the work of the IGF Best Practice Forum on Cybersecurity and the Dynamic Collation on Core Internet Values, to name but two examples. commitment by all UN Member States on the duty to prevent and protect against war crimes, genocide, ethnic cleansing and other crimes against humanity. The Ilves Commission helped set the framework for the NETmundial Initiative. The Brandt and Palme Commissions represented important steps both in development and disarmament, respectively. These nongovernmental groups reshaped global discussion of responsible behavior and created new norms for unprecedented international problems. We hope to do the same. While the UN GGE Reports have set a framework on the applicability of existing international norms, law and practices, we have sought to amplify and expand this initial normative structure in ways intended to complement and reinforce existing areas of agreement and point the way to new opportunities for increasing the stability of cyberspace. Our proposed norms are therefore intended to accompany and reinforce the eleven norms identified in the 2013-2015 UN GGE reports. The norms developed both within and outside of the GCSC are foundational for our overall definition of cyber stability, as well as its guiding principles. First and foremost, these norms are based on the principle that no state or non-state actor should take actions that impair the stability of cyberspace, including inserting vulnerabilities into products and services, commandeering ICT devices to create botnets, and allowing non-state actors to conduct offensive cyber operations. Furthermore, the norms also urge state and non-state actors to take action when doing so is necessary to preserve the stability of cyberspace, including establishing vulnerabilities equities processes and enacting basic cyber hygiene. These norms are by necessity not complete. Instead, they provide an indication of what is needed to support the key principles of cyber stability. Other steps may be necessary as well. GLOBAL COMMISSION ON THE STABILITY OF CYBERSPACE NOVEMBER 2018 7