Key Takeaways
- Fifty of the 92 NGOs that sought accreditation for the UN’s new Global Mechanism on ICT security were blocked, with most objections coming from a single state and no reasons given.
- The blocked groups include incident responders, cybersecurity firms, digital‑rights organizations, and academic researchers—actors who actually operate and defend cyberspace.
- Excluding these stakeholders risks detaching the rule‑making process from the technical expertise it needs, widening the gap between wealthy and less‑resourced states.
- While informal channels such as the Dedicated Thematic Groups remain open, they cannot replace a seat at the table where the treaty text is negotiated.
- Supportive governments must push for transparency, demand explanations for objections, protect existing stakeholder forums, and fund broader participation, especially from the Global Majority.
- The multistakeholder community itself should coordinate across regions, continue contributing to agreed frameworks, and treat engagement as an ongoing obligation rather than a one‑off favor.
- Ultimately, the credibility of the UN cybersecurity process hinges on whether states uphold their consensus‑based commitment to include non‑governmental experts in a systematic, sustained manner.
Overview of the UN cybersecurity mechanism and accreditation issue
The United Nations is establishing a Global Mechanism on ICT security to negotiate norms for responsible state behavior in cyberspace. Recognizing that governments alone do not build, run, or defend the internet, the mechanism’s founding documents explicitly invite non‑state actors—researchers, technical communities, civil society groups, and private‑sector experts—to participate as a multistakeholder community. For the current accreditation cycle, 92 NGOs applied, but half were denied entry before the first substantive session even begins. This mass exclusion threatens to undermine the very premise of the process, which relies on diverse expertise to shape effective, globally accepted cyber rules.
Scale of blocked organizations and lack of transparency
Of the 92 applicants, 50 were barred. Russia alone objected to 43 organizations, a list that spans think tanks, universities, cybersecurity firms, and civil society groups across Europe, the Americas, Asia, and Oceania. A handful of other states added further objections. Crucially, the accreditation rules require only that an objecting state voluntarily inform the Chair of the general basis for its objection; no detailed justification, evidence, or threshold of support from other states is needed. Consequently, a single state’s objection can outright block an organization, with no formal appeal process and limited opportunity for reversal. The Chair has attempted informal consultations, but these are capped at three months and lack any binding force, leaving most blocks in place as the session opens.
Impact on incident responders, technical community, and civil society
The excluded organizations are not passive observers; they are the frontline defenders of digital infrastructure. Incident responders work through the night when hospital systems are crippled by ransomware; network operators and standards bodies keep the internet running; threat‑intelligence firms share real‑time data about attacks before many governments even notice them; researchers and advocacy groups document how cyber capabilities harm ordinary people and hold both states and corporations accountable. Removing these voices from the negotiation table means the resulting norms risk being detached from the practical realities of detecting, mitigating, and attributing cyber threats, reducing the likelihood that the rules will be workable or effective in the field.
Geopolitical dimensions and unequal access for less‑resourced states
The pattern of objections reflects broader geopolitical tensions and differing views on who should govern cyberspace. Wealthy governments can compensate for the loss of multilateral input by relying on their own national companies, research labs, and diplomatic channels. In contrast, less‑resourced states depend heavily on the UN process to access the expertise and best practices that more affluent nations generate domestically. Each blocked organization therefore widens the gap between those who can independently shape cyber policy and those who must rely on multilateral forums, exacerbating global inequities in cyber resilience and influencing the legitimacy of any eventual norms.
Remaining channels for stakeholder input and their limitations
Although formal accreditation was denied for many groups, some avenues for participation remain. The Dedicated Thematic Groups (DTGs)—two informal working groups focused on cyberspace challenges and capacity‑building—were agreed by consensus to include experts and continue to serve as a genuine channel for technical input. Stakeholders can also submit written contributions, host side events, and engage with delegations outside the plenary. However, these mechanisms operate alongside or after the core negotiations, not within them. Input offered after a treaty text has already taken shape is generally less able to influence its substance than contributions made while the draft is still being formed. Consequently, while valuable, these channels cannot fully substitute for a direct seat at the table where the final language is negotiated and agreed.
What supportive governments must do to uphold multistakeholder commitments
Governments that endorse the multistakeholder model must move beyond rhetorical support. At the opening session they should:
- Make clear, on‑the‑record statements demanding that objecting states explain their reasons for blocking NGOs, thereby creating a testable record.
- Use the accreditation exchange of views to press for transparency in how decisions are made and potentially reversed.
- Protect existing stakeholder forums such as the DTGs, ensuring that objections raised in the plenary do not spill over into those spaces.
- Nominate diverse, independent experts to briefings and open their own delegations to broader participation where accreditation has been denied.
- Fund stakeholder coordination and travel, especially for organizations from the Global Majority, rather than assuming that engagement will self‑sustain in a demanding process.
- Strategically direct their own domestic companies and civil‑society groups toward where their expertise can most benefit the negotiations, instead of assuming those actors already know how to contribute.
These actions would help prevent the current round of blocks from becoming a permanent template and would reinforce the consensus‑based pledge to involve non‑state actors in a systematic, sustained, and substantive manner.
Roles of the multistakeholder community itself
The excluded NGOs and other stakeholders also bear responsibility for sustaining their influence. They should coordinate across regions, pool evidence, and align messaging so that any input they do provide carries maximum weight. Continuing to contribute to the framework already agreed upon by states—whether through research papers, technical standards, or advocacy—keeps the conversation alive and demonstrates the value of their expertise. By treating engagement as an ongoing obligation rather than a fleeting favor, the community can help ensure that the UN process remains grounded in the technical and operational realities of cyberspace, even when formal accreditation is withheld.
Conclusion: obligation to preserve inclusive cyber governance
The heart of the matter is a principle of pluralistic governance: the most consequential decisions about how cyber power is used should not rest with states alone. Many nations that have built prosperous, secure digital economies have spoken out against a model where governments dictate every rule at the UN, yet their objections have not halted the drift toward exclusivity. The current blocking of fifty organizations tests whether those states will fulfill their obligation to make the multistakeholder model work—not as a courtesy to NGOs, but because rules crafted solely by governments are likely to fail on their own merits. Whether this session’s outcome becomes a temporary setback or the new norm will determine the future legitimacy and effectiveness of global cyber governance. The answer will hinge on the willingness of supportive governments to demand transparency, protect existing participation channels, and fund broader inclusion, while the stakeholder community persists in contributing its indispensable expertise. Only then can the UN’s cybersecurity process remain both credible and capable of addressing the fast‑evolving threats that shape war, peace, and everyday life.