Category: Newsletter

By Constance Bommelaer, Senior Director, Global Policy Partnerships, Internet Society  and Nicolas Seidler, Policy Advisor,  Internet Society

 As we head towards the New Year, the issue of government surveillance continues to ignite intense debate among stakeholders across all regions of the globe. In this context, there could be a temptation for some governments to close their digital frontiers and seek to exercise greater control over their local Internet economies. This would have chilling effects on the global Internet and its ability to spur economic benefits and social progress.

In this regard, the work undertaken by the OECD’s Information, Computer and Communications Policy Committee (ICCP) is critical as it focuses on how to enable innovation and growth – based on a robust, stable and open Internet infrastructure – while preserving users’ privacy and security.

Over the past year, the Internet Technical Advisory Committee (ITAC) has been fully engaged in supporting this objective. Here are recent examples of the technical community’s successful cooperation with the ICCP Committee: the adoption of the Revised Privacy Guidelines, the finalization of the ITAC-sponsored study on “Cables, Gateways and IXPs”, and participation in a volunteer group on the implementation of the OECD Internet Policy Making Principles which will be instrumental in preparing for the next Ministerial meeting in 2016.

Also, in the spirit of openness and collaboration, the Asia Pacific Network Information Center (APNIC) and the Internet Society (ISOC) co-chaired an IPv6 volunteer group, paving the way for future OECD work in support of the new Internet protocol – a key enabler for the development of the Internet economy.

These achievements were facilitated by the multistakeholder approach of the ICCP, in which groups from business, civil society and the technical community all bring their own special expertise and knowledge to the table.

In this newsletter, ICCP Chair Jorgen C. Abild Andersen testifies to the value of this open model by stating that “ITAC is now a regular and highly appreciated contributor to the work of the ICCP, weighing in on a range of issues that are essential to the healthy development of the Internet, to the benefit of our economy and society.”

Indeed, building bridges across different stakeholders is essential as we get closer to 2015 – an important milestone for both the review of the World Summit on the Information Society (WSIS) process and the UN Millennium Development Goals (MDGs).

With this deadline in sight, it is now the international community’s collective responsibility to tackle an essential question: following the Digital Revolution, will the Information Age live up to its potential for inclusive growth and development?

There are often discussions at the OECD about the importance to maintain an Open Internet to reach this goal, while understandings of what it really means may differ. In our view, the various manifestations of openness have to be considered as interdependent and mutually reinforcing. Over the past 40 years, the Internet has become a multi-faceted reality: technical, economic, societal and political. These realities are closely intertwined and interrelated. For example, Open standards lay the foundation for an open and borderless economy, which in turn supports the development of a free and global society. As such, the Internet must remain unequivocally open in its universality and global reach.

More than ever, now is the time to lay these foundations and to continue working in a collaborative way towards a successful 2014!

______________________________________________________________

Constance Bommelaer is the Senior Director of Global Policy Partnerships and helps developing partnerships with international organizations as well as strategic positions on key Internet issues. In this role, she founded and now coordinates the Internet Technical Advisory Committee (ITAC) to the OECD. She also leads ISOC’s engagement with UNESCO, WIPO, the G8, the G20 and the IGF. In 2010 and 2011 she was responsible for the strategic development of the Internet Society’s Next Generation Leaders program, a youth program designed to help prepare young professionals from around the world to become the next generation of Internet technology, policy, and business leaders.

Nicolas Seidler is a Policy Advisor at the Internet Society. He joined the organization in February 2010. One of his current areas of work concerns Internet and Human Rights, in particular freedom of expression online.  Nicolas contributes to developing partnerships with international and regional organizations, engaging with global policy makers and non-governmental stakeholders on key Internet issues. In this role he contributes to ISOC’s engagement with a variety of organizations such as the ITU, the Human Rights Council or the Council of Europe. He also contributes to coordinating the Internet Technical Advisory Committee to the OECD.

By Jørgen Abild Andersen, Chair of the ICCP Committee

Given the rapidly changing technological, economic and social environment surrounding the Internet, multi-stakeholder processes have demonstrated the flexibility and global scalability required to address Internet policy challenges. The importance of effective participation by non-governmental stakeholders in policy work on the Internet economy was first highlighted in the OECD’s Ottawa Ministerial Conference on electronic commerce in 1998.

In June 2008, it was echoed in the Seoul Declaration, in which Ministers committed to “working collectively with all stakeholders.” The OECD Secretary-General highlighted the issue in his closing remarks in Seoul, where he called for a “process of formalising the participation of civil society and the technical community in the work of the OECD on the Internet economy.” And in its 2011 Recommendation on Principles for Internet Policy Making, the OECD Council called upon members to “Encourage multi-stakeholder co-operation in the policy development process.”

Through a process concluding in 2009 the Internet technical community joined civil society, business and labour representatives at the ICCP Committee meetings to assist government officials in grappling with many of the key policy issues raised by the Internet and new and emerging digital technologies.

ITAC is now a regular and highly appreciated contributor to the work of the ICCP,  weighing in on a range of issues that are essential to the healthy development of the Internet to the benefit of our economy and society, including the role of Internet intermediaries, cloud computing, ICTs and the environment, privacy, cybersecurity, identity management, and digital content, among others.

Recently ITAC has further increased its engagement with the work of the ICCP Committee, including by organising a roundtable discussion on cryptography policy at a meeting of the Working Party on Information Security and Privacy meeting in April 2013. It also co-organised with OECD a session on “Cybersecurity: throwing out preconceptions” at the 2013 Internet Governance Forum annual meeting in Bali.

The ICCP Committee and myself, as Chair of the Committee, look forward to a continued close working relationship and engagement with ITAC. This close working relationship will be especially crucial in the lead-up to the OECD Ministerial Conference on Internet issues being planned for 2016.

______________________________________________

Jørgen Abild Andersen is among the World’s most experienced government officials within the ICT area.

From 1991-2012 Mr Abild Andersen served as national telecom regulator in Denmark and he has in this capacity been responsible for implementing the liberalisation of the Danish telecoms market.

Prior to this he worked as Deputy Permanent Secretary in the Danish General Directorate of Posts and Telegraphs. During that period, he played a key role in the restructuring and privatisation of the Danish telecoms sector and in the establishment of competition within mobile communications.

With the establishment of the National IT and Telecom Agency in 2002, the portfolio of Jørgen Abild Andersen was extended to cover the whole policy range within the ICT area. His policy responsibilities included i.a. privacy, trust and security in the Information Society, eBusiness, eGovernment, eSkills, green ICTs, the national digital signature as well as broadband, DNS and radio spectrum.

Mr Abild Andersen gained a Masters of Law from the University of Copenhagen in 1975. He started his professional career as a civil servant in the Ministry of Public Works and for a three-year period he served as Private Secretary to the Minister.

From 2003 to 2004 Mr. Abild Andersen was chairing the European Commission’s Radio Spectrum Policy Group. In 2005, he served as Chair for European Regulators Group (ERG) and the Independent Regulators Group (IRG). From 2006 to 2012 he was Denmark’s representative at the European Commission’s i2010 High Level Group and the Commission’s Digital Agenda High Level Group respectively. In October 2009 he was elected Chair of OECD’s Committee for Information, Computer and Communications Policy (ICCP).

By Dave Piscitello, ICANN and Lara Pace, Commonwealth Secretariat.

Addressing cybercrime on the Internet is a key requirement to ensure that the Internet remains a trusted space for interactions and growth in the digital economy. A multistakeholder approach is key to successfully address this challenge.  For example, The Commonwealth Cybercrime Initiative (CCI) is a collaborative effort of international organisations, governments, and the private sector to address cybercrime. Developed collaboratively with the COMNET Foundation for ICT Development, Commonwealth Telecom Organization, Council of Europe, Government of UK, and International Telecommunications Union CCI assists Commonwealth member states in building capacity to fight cybercrime.

CCI has adopted a unique and sustainable formula for operation:

• Upon receiving a formal request from a Commonwealth member state, CCI sends a needs assessment team to conduct an in-country assessment. A typical team is composed of subject matter experts in criminal justice systems and information security, who assess the legal, technical, institutional and human capacity present in the requesting state.
• The needs assessment team meets with a broad range of in-country agencies, private sector actors, and infrastructure operators and produces a thematic report that identifies areas where capability building is needed.
• The requesting state reviews the thematic report and submits a further letter of request to COMSEC to help “fill the gaps” (assist in-country for the areas where capability building is needed).
• CCI members cooperate to plan and execute on capability building. In this Phase two program, initiative members who have volunteered resources will work in-country to increase capabilities across a range of cybercrime-affected areas or operations, including national strategy and policy, legislative framework, criminal justice system capacity (including the training of law enforcement, judiciary, and prosecution), ICT infrastructure, establishment of Centres of Excellence and computer emergency response teams, public awareness campaigns, and facilitation of strategic partnerships with the private sector.

More than 30 organisations participate in CCI to coordinate available international resources, to extend assistance to member states, and to overcome mandate restrictions and funding limitations member states may encounter.  To date, CCI has carried out five needs assessments in the Caribbean and African Regions. Five governments have approved the thematic reports.

“Phase 2” programs are excellent examples of multi-stakeholder collaboration and contribution. For the Phase 2 program of work underway in West Africa, for example, the UK National Crime Agency is coordinating the delivery by Initiative members for criminal justice system capacity building, a public awareness program, preparation of ICT infrastructure to support cybercrime investigations, and legislative framework needs.

Consultations are currently underway in another four Commonwealth countries. It is expected that these will be launched in the first quarter of 2014.

_________________________________________________

Dave Piscitello has been involved in Internet technology for over 39 years. Dave serves as Vice president, Security and ICT Coordination, at ICANN, where he collaborates with the information security, DNS, and law enforcement communities on a diverse range of security issues related to the Domain Name System and domain name registration processes, including phishing, pharming, DDoS attacks, domain hijacking and other registration abuses. Dave serves on the Executive Management Committee for the Commonwealth Cybercrime Initiative.

Lara Pace is Projects Coordinator for the Commonwealth Cybercrime Initiative. Previously, she served as coordinator of the Commonwealth Internet Governance Forum through which the Commonwealth Cybercrime Initiative was developed. Lara has been involved with (CCI) since inception and has formed part of the team that has driven the Initiative from concept to implementation. Currently Lara, coordinates all Country projects of CCI, liaising with both governments and Consortium organisations. She also facilitates the development of the Initiative into an established programme of the Commonwealth Secretariat.

By Christine Willett, Vice President, gTLD Operations, ICANN

On October 23, 2013, ICANN delegated the first four new generic Top Level Domains (gTLDs) created under the New gTLD Program. This historic day marked the beginning of what will be the biggest change to the Internet since its inception. The day also represented the culmination of eight years of study, with extensive engagement with the Internet’s global, multi-stakeholder community, to bring these new gTLDs to market.

With the rollout, the Domain Name System (DNS) will expand from 22 gTLDs to possibly 1,300. These additional gTLDs will enhance competition, innovation and choice in the Domain Name space, providing a wider variety of organizations, communities, brands and Internet users with new ways to communicate and express themselves. The large number of applications received is testament to the enthusiasm for an expanded DNS.

The first four gTLDs delegated or introduced into the Internet’s Root Zone, the central authoritative database for the DNS, were:

• شبكة (xn--ngbc5azd) – Arabic for “web/network”
• онлайн (xn--80asehdb) – Cyrillic for “online”
• сайт (xn--80aswg) – Cyrillic for “site”
• 游戏(xn--unup4y) – Chinese for “game(s)”

Significantly, this first batch consisted entirely of Internationalized Domain Names (IDNs), which means they are written scripts other than the basic Latin alphabet. Delegating IDN gTLDs in the first wave was deliberate and a demonstration of ICANN’s efforts to create a globally-inclusive Internet, regardless of language or region.

At the time of writing, the number of new gTLDs delegated exceeds 30, with more domains being added each week in a measured rollout designed to avoid disruption of the DNS. The gTLDs from the Program will be introduced into the Internet securely and steadily over the next few years.

All Registries that operate these new gTLDs must pass a rigorous evaluation process and technical preparations and assessments to ensure the security and stability of the DNS is preserved. In addition, before the general public will be able to access these new gTLDs on the Internet, Registries still need to complete a final process built into the Program to protect trademark rights holders. Following this mandatory period, a Registry can make the new gTLD available to the general public at its discretion.

It is expected that the first gTLDs will become publicly available by the end of the year. For the latest information on the Program, please visit: http://newgtlds.icann.org/en/

___________________________________________________

Christine Willett is vice president of gTLD Operations for ICANN. With more than 20-years of experience in system integration, operations and client management, Willett joined ICANN in 2012 to oversee the operational rollout of the New gTLD Program.

Prior to ICANN, Willett co-founded and operated cobalt Professional Associates, a consulting firm in Southern California. Willett provided hands on consulting expertise on range systems implementation, internal audit, process reengineering, operational improvement, and other business needs.

Willett previously held positions in Program Management and Product Management at Viacore, Inc., delivering leading B2B process integration services. Christine launched her career by spending 11 year at Andersen Consulting (Accenture) where she specialized in large-scale, finance systems development and integration.

Willett has a bachelor’s degree in Materials Science Engineering from Northwest University.

By Robert P. LaBelle, Senior Director, Strategic Innovation and Standards Solutions, IEEE Standards Association

For centuries, global standards have helped humanity achieve essential goals–enhanced public health and safety; technology innovation; market expansion and job growth; and the rollout of more sound and interoperable products at lower cost, among them. Global standards are underpinnings of innovation and social well being, and their value and necessity are coming into even sharper focus in the age of globalization.

Standards open new markets and applications and make broadly available proprietary knowledge for current and future innovative technologies. Globally open standards development forums help promote solutions and provide networking opportunities with and among cross national communities, creating vibrant, open ecosystems that provide multiple sources of readily available information and expertise.

As the global community strives to keep pace with technology expansion and to anticipate the technological, societal and cultural implications of this expansion, and as it faces the increasing intersection of technology with economic, political and policy drivers, embracing a market driven standards development paradigm that produces open standards and is inclusive of multi-stakeholders will help ensure strong integration, interoperability and increased synergies along the innovation chain.

The open standardization paradigm that enabled the success of the Internet provides a solid platform that enables participants involved and that addresses the challenges associated with increasing growth of a global marketplace, including the role that standards play in international trade and the inherent unpredictability of converging and emerging technologies on a global scale.

The globally open standards approach includes developing standards in communities that are grounded in universal openness and produced in a process that is open to the society of world experts without territorial restrictions. This open paradigm is driven by technical merit and harnesses global creativity and expertise through bottom-up collaboration. The approach results in the advancement of cutting-edge technology and empowers the rapid economic implementation of high-value, high-demand products and services with societal benefits. It drives technical innovation via processes that ensure direct, open participation, and which embrace different perspectives and interests to reach common goals. It produces standards developed according to accepted WTO principles, without borders to ensure a better future for all.

Working within a set of principles that advocates global cooperation and openness, provides for global interoperability and the building blocks for further innovation, and contributes to the creation of global benefit for humanity is core to unbounded market and trade growth and success through innovation. Globally open standardization processes and standards produced through a collective of standards bodies adhering to such principles are essential for technology advancement to ultimately benefit humanity, as the global expert communities address directly, in an open and collaborative way, such global issues of sustainability, cyber-security, privacy, education and capacity building.

_______________________________________________________

Robert LaBelle is a Senior Director of Strategic Innovation and Standards Solutions at the IEEE, where he provides executive leadership to an elite team focused on technology ecosystems, technology lifecycles and emergent technologies and related strategic and innovation initiatives; providing a best-in-class portfolio of solutions to standards-related collaboration and consensus building communities; and dedicated to a superior experience for the diverse, global and multi-stakeholder constituency. Robert works to advance the technology and solutions footprint for the IEEE and drives efforts that result in a deep knowledge of and expansion of the organization into technology spaces, as well as related technology governance venues like those of the OECD.

By Robin Berjon, HTML Editor, W3C

Over the past handful of years, the mobile application ecosystem has grown from a niche environment to become an integral part of the lives of many people. This opens up questions as to the value and place of the Web when so much apparent momentum seems to be directed at a competing set of solutions. Within this context, I was kindly invited last June to present on Open Web Standards at the OECD. I was happy to report there that news of the Web’s decline appear to have been largely overhyped.

To begin with, Web applications are very much with us. The HTML5 standard is on track to be finished in 2014 but is already massively deployed both on terminals and in content, and Web technology overall has benefited from impressive innovation velocity and high-paced competition between vendors.

In fact, Web applications are so mainstream that we have ceased to notice them. Facebook and GMail, to name just two of many, are undoubtedly applications and for the vast majority of their users accessed over the Web. Additionally, many mobile applications are, unbeknown to the user, built using Web technology. While that does not fully integrate them with the Web — for instance one cannot openly link into them — it does show how core the Web has become to our technological stack. It has matured to the point where major vendors such as Mozilla, Samsung, or Intel are now shipping operating systems entirely built on Web technology (FirefoxOS and Tizen).

On their side, mobile apps suffer from a number of issues. As described by GOV.UK in “We’re not ‘appy. Not ‘appy at all” (http://digital.cabinetoffice.gov.uk/2013/03/12/were-not-appy-not-appy-at-all/), while citizens massively use mobile services, mobile apps are rarely justified. The smartphone marketshare is such that even when going to the trouble (and cost) of targeting multiple phone systems, over half of the population remains excluded from information delivered through mobile apps. This makes them a particularly poor choice for PSI. Releasing an app has a higher cost for lower return, and the way app stores function distorts the market by instituting a tax on switching operating systems and enables privatised censorship.

That said, mobile apps do have an edge in specific areas. Some of those are rooted in regulatory issues, an example being the tangled mess that is the national and international payment regulations. It makes it far easier to funnel all application sales through a small number of large players and much harder to deploy an open payments system to counterbalance monopolistic accretion.

Other areas are more strongly technological. For those, the W3C is pushing to close the gap with mobile apps so as to continue advancing a Web for all, accessible and fully internationalized; a Web on everything, be it mobile, TV, automotive, or beyond; and a Web society supporting privacy and security for users and a level playing field of fair technology for innovative business of all sizes.

______________________________________________________________

Robin Berjon is a freelance expert in Web technology with over a decade’s experience in contributing to standards and open source projects. He currently works for W3C where he edits the HTML5 standard.

By Geoff Huston, Chief Scientist, APNIC

It was always intended that IPv6 would be fully deployed before we ever ran out of IPv4 addresses. We’ve managed to deviate from this plan. The regions of Asia, Oceania, and Europe have effectively exhausted their supply of IPv4 addresses, and we anticipate that North and South America will be in a similar position by the end of 2014.

Instead of deploying IPv6, we appear to increasing our reliance on what was intended at the time to be a short term mitigation.  Much of the recent growth of the Internet has been supported using Carrier Grade Network Address Translators (CGNs) in IPv4, where IPv4 addresses are shared across a number of customer connections.  There are some serious concerns about the long term implications of an Internet that increases its reliance on CGNs in this manner. A recent study from OFCOM in the UK points to risks of an emerging picture of incumbent dominance and decreasing competitive pressure in the Internet Service Provider sector, and an emerging ability for access carriage providers to decide what applications and services that will be accessed by their users, and the consequent ability for the access sector to impose terms and conditions on content providers in order to reach their customers.[1]

Were we to actually experience these outcomes, it would pose some serious questions for public regulators and policy makers. The risks of a failure in the ability of the Internet to maintain its essential openness and decentralized nature could lead to the contemplation of the prospect of a market failure in the larger Internet economy itself. The risks inherent in such a scenario underline the importance of the commitment made by OECD Member Country Ministers in the Seoul Declaration on the Future of the Internet Economy on the need to: “Encourage the adoption of the new version of the Internet protocol (IPv6), in particular through its timely adoption by governments as well as large private sector users of IPv4 addresses, in view of the ongoing IPv4 depletion.” [2]

We have been active within the OECD’s Working Party on Communication Infrastructures and Services Policy (CISP) in highlighting the risks associated with a failure to complete a timely transition of the Internet to IPv6. We have prepared material for the Working Party that describes in some detail the current state of the Internet’s transition to IPv6, and provides a commentary on this situation. We have also taken the lead in drafting recommendations to the OECD on possible actions by OECD Member Countries, and others, that would hasten the deployment of IPv6.

GEOFF HUSTON, B.Sc., M.Sc., is the Chief Scientist at APNIC, the Regional Internet Registry serving the Asia Pacific region. He has been closely involved with the development of the Internet for many years, particularly within Australia, where he was responsible for the initial build of the Internet within the Australian academic and research sector. He is author of numerous Internet-related books,. He served on the Board of Trustees of the Internet Society from 1992 until 2001, and was inducted into the Internet Hall of Fame in 2012. He was a member of the Internet Architecture Board from 1999 until 2005, and remains an active member of the Internet Engineering Task Force. His current research interests include Inter-Domain Routing, the DNS and Security. His blog can be found at www.potaroo.net

By Christine Runnegar, Director, Public Policy , Internet Society

2013 marks the 33^rd anniversary of the OECD Privacy Guidelines. It is also the year that the OECD adopted the Revised Privacy Guidelines[1]. Much has changed in 33 years. Even the OECD has changed in that time. Since 1980, the OECD community has grown to include new members: Chile, Czech Republic, Estonia, Hungary, Israel, South Korea, Mexico, Poland, Slovakia, Slovenia; and two new advisory committees: CSISAC and ITAC.

In 2010, the OECD recognised that it was time to revisit the Guidelines, and after careful research and consideration as to how the privacy landscape has evolved[2], consultation with privacy experts, and thorough deliberation, the OECD adopted the Revised Privacy Guidelines in 2013.

How have the Guidelines evolved?

A new part has been added explaining how the “Accountability Principle” should be implemented. In particular, the Guidelines provide that data controllers should have in place a privacy management programme, be prepared to demonstrate that their respective privacy management programmes are appropriate, and provide notifications of significant data breaches.[3] Additionally, the guidelines make it clear that the data controller remains accountable without regard to the data’s location.[4]

Accountability-based approaches to legal compliance are likely to continue to gain popularity as they offer the potential of a more flexible approach, as well as a way to bridge diverse legal regimes and shift the resource burden from enforcement to compliance.

The changes to the principles governing transborder data flows seem subtle, but they are significant. Firstly, they now cover flows to non-OECD member countries. Secondly, although the text is still framed as “refrain from restricting transborder flows of personal data” the circumstances in which flows are not restricted are, arguably, narrower. Member countries now need to be satisfied that the recipient substantially observes the guidelines or that sufficient safeguards exist before they refrain from restricting transborder data flows.[5] However, the restrictions that may be imposed have been confined by the introduction of a requirement that they be proportionate to the risks presented[6]. How this works in practice remains to be seen.

The revisions regarding national implementation reflect the changing perspective on how best to achieve privacy protection. For example, they underline the importance of effective enforcement authorities. They also introduce the notion of a national privacy strategy and the idea of complementary measures such as the promotion of privacy-protecting technical measures.[7]

International cooperation has been expanded to specifically incorporate the concept of “interoperability”, strengthen cross-border enforcement cooperation, and encourage the development of internationally comparable metrics.[8]

One significant area that remains essentially untouched is “exceptions” (including, for national security). With different timing, this might not have been the case. However, as it presently stands, the guidance is minimal, i.e. that exceptions to the Guidelines should be: “as few as possible” and “made known to the public”[9]. It is abundantly clear that more work is needed to ensure that there are truly effective constraints and safeguards, plus a commitment to follow them. Here is a clear opportunity for the OECD to lead the way.

Keisha’s interests lies in the use of technology and data for development, data communications, digital inclusion, and also data privacy and protection. She is currently Senior Manager, Business Planning and Research for TechSoup Global’s Global Data Services Programme. She was an Internet Society Fellow to the 2012 OECD Technology Foresight Forum, “Harnessing data as a new source of growth: Big data analytics and policies” and successfully completed the DiploFoundation’s 2010/2011 Internet Governance Capacity Building Programme. Data privacy and protection was one of the ICT policy areas which held her focus for the programme, during which time she wrote about “Intergovernmental organisations’ (IGOs) sharing and linking open and real time data for inclusive governance; development effectiveness and protection of privacy and security”. She has an MA in International Relations from the Universiteit van Amsterdam in the Netherlands and a BSc. in Sociology from the University of the West Indies in Trinidad and Tobago.

By Roger Clarke, Principal of Xamax Consultancy Pty Ltd, CSISAC member

The OECD is revisiting the Security Guidelines[1] that it first published over a decade ago. The Security Expert Group that is helping with the review of the Guidelines includes public interest advocates, coordinated through the Civil Society Information Society Advisory Council (CSISAC). Advocates have access to documents in advance, and at least some voice. On the other hand, physical participation in meetings is hampered by a lack of budget for the time and travel costs of the professionals who represent the interests of civil society.

To understand the OECD’s current security work, it is important to appreciate that many different scope definitions exist.  As explained in [2], security discussions can be carried on at the level of data, of an IT artefact, or of an organisation;  or they can take much broader views, including those of people affected by an IT artefact, industry sectors and segments (as occurs in discussions of critical information infrastructure), a local or national or regional economy, or a society – or indeed they can reflect the needs of the biosphere (thereby encompassing carbon markets and global warming).

The OECD’s 2002 Security Guidelines addressed only the lowest level of those alternative scope definitions. The revision is intended to have broader scope “by realigning their perspective and language with the high-level economic and social objectives pursued by governments, businesses and individuals in the development of cybersecurity policies”. But is the OECD moving far enough? Will its new approach have sufficient scope to serve the world’s needs for the next decade?

A meaningful dialogue cannot be achieved if each stakeholder clings to their own perspective, and insists on their security being paramount and everyone else’s security being secondary or even illegitimate. A particular concern during discussions has been the failure of the corporate and government participants to recognise the significance of the perspective of external users and usees. That stakeholder group lacks either institutional or market power, and its interests have suffered greatly during the period of national security extremism that has followed 9/11.

If the OECD’s revision of its Security Guidelines is to satisfy social as well as economic needs, it must:

• reflect the many alternative scope definitions applicable to security discussions
• recognise the complete set of stakeholders
• recognise the legitimacy of each of their perspectives
• ensure that each stakeholder group is empowered

Further, the process, and the product, need to respect the meta-principles of evaluation, consultation, transparency, justification, proportionality, mitigation, controls, and audit[3]. Current negotiations around the world variously fail all eight meta-principles (e.g. the Trans-Pacific Partnership process),  fall badly short on most of them (e.g. the Internet Governance processes within the International Telecommunication Union), and address all or at least most of them quite well (e.g. the Internet Governance Forum).

Where will the new OECD Security Guidelines lie on that scale? Will the OECD seek to sustain the dominance of governments and corporations over policy agendas, or will it point towards a better future in which the eight meta-principles are applied, and security’s many scope-definitions and stakeholder perspectives are reflected?