Responsible cyber behaviour in the Indo-Pacific: Views from Cambodia, Fiji, India, Indonesia, Japan, Pakistan and Taiwan
What’s the problem?
In July 2025, the mandate of the United Nations Open-Ended Working Group on the security and use of information and communications technologies (hereafter OEWG) ends. This marks the latest chapter of international discussions on responsible behaviour in cyberspace. Throughout a 20-year period, a corpus of reports has been delivered that outline standards of behaviour.1 Taken together, this is referred to as the ‘UN framework of responsible state behaviour’ and includes an acceptance that international law applies to state conduct in cyberspace and a commitment to observe a set of norms (see Figure 1).2
Figure 1: UN Norms of Responsible State Behaviour in Cyberspace
These international norms are generally considered the benchmark for the notion of ‘responsibility’ in cyberspace, and one of the components of this ‘framework’. However, the UN framework is fraught for several reasons:
- It suffers from a narrow application. The UN framework relates principally to cyber issues that affect international peace and security. This sets a high-security threshold for what should be considered part of the responsible cyber agenda.
- The UN framework focuses—almost exclusively—on the obligations of states under international law.
- It largely applies to externalities as it directs how states ought to behave towards each other, and not to how states should act domestically.
- The UN framework amplifies a perspective on responsible behaviour that’s been spearheaded by the earliest and most mature cyber nations, in particular the P5 members of the UN Security Council.
This has resulted in a lopsided but dominant perspective on responsible cyber behaviour—one that overlooks states’ domestic responsibilities in terms of the use of cyberspace for domestic and internal security purposes; practices of good governance for cyber capabilities and operational controls; and one that has overlooked perspectives from developing and emerging economies.
What’s the solution?
As cyberspace has become a ubiquitous dimension of social, economic, political and military activities, there’s a need to expand the notion of responsibility in cyberspace. While this has become common language in national and international cybersecurity strategies and practices in Australia, Europe, the UK and the US, it’s less evidently articulated in most other parts of the world, including in most of the Indo-Pacific.3
This report introduces a more comprehensive framework to explore the concept of responsible cyber behaviour and additionally offers perspectives from seven Indo-Pacific countries on what constitutes ‘responsible’ cyber behaviour. The selected countries are less represented and examined in global and regional cyber policy conversations, in both Track 1 and Track 2 settings. These countries vary in size, economic development, systems of government and strategic outlook—and so provide much-needed validation and challenge to established thinking and norms.
The insights presented in this report should provide policymakers, negotiators, civil society and researchers in the fields of cyber policy, cyber diplomacy and the non-proliferation of dual-use technologies with a better understanding of various national perspectives. In doing so, it will help to inform the scope of work for the next chapter of international cyber negotiations.
Full Report
For the full report, please download here.
29 Jan 2025
Sukumar, Responsible behaviour in cyberspace: global narratives and practice, Publications Office of the European Union, Luxembourg, 2023.
Open-Ended Working Group on ICT: rules, norms and principles of responsible behaviour of states’, Delegation of the EU to the UN in New York, 30 March
2022, online; National Cyber Force, ‘Responsible cyber power in practice’, UK Government, 4 April 2023, online; State Department, ‘United States
International Cyberspace & Digital Policy Strategy’, US Government, 6 May 2024, online.
Author
Contributors
Ilaitia B Tuisawau, Cybersecurity Advisor, Fijian Government.
Anushka Saxena, Research Analyst, The Takshashila Institution.
Dr Wilhelm Vosse, Professor of Political Science and International Relations, International Christian University.
Dr Rabia Akhtar, Director for Centre for Security, Strategy, and Policy Research, University of Lahore.
Dr Yisuo Tzeng, A/Director, Institute for National Defense and Security Research (Taiwan).
Acknowledgements
ASPI and RUSI would like to thank the authors of this compendium for their contributions, and also thank Arindrajit Basu, Bart Hogeveen, Eugene EG Tan, Nori Katagiri, Rogier Creemers, Bart Voogt, James Boorman, Raoul Heinrichs, Chris Taylor, Siriwat Chhem and many others for their feedback, comments, and contributions throughout the development of this publication—all of which were of great value in ensuring the proper balance between detail and nuance when approaching responsible cyber behaviour through a national lens.
.png?VersionId=M6kDCS08IgBqfbv8QMlQz7ieFhpYYc_h)
About the report
This publication is produced by ASPI. It’s part of the Responsible Cyber Behaviour project, an initiative led by the Royal United Services Institute in partnership with ASPI, to map understandings of responsible cyber behaviour through national and regional case studies and to connect experts from different sectors and regions through the Global Partnership for Responsible Cyber Behaviour.
About ASPI
The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally. ASPI’s sources of funding are identified in our annual report, online at www.aspi.org.au and in the acknowledgements section of individual publications. ASPI remains independent in the content of the research and in all editorial judgements. It is incorporated as a company, and is governed by a Council with broad membership. ASPI’s core values are collegiality, originality and innovation, quality and excellence, and independence.
ASPI’s publications—including this paper—are not intended in any way to express or reflect the views of the Australian Government. The opinions and recommendations in this paper are published by ASPI to promote public debate and understanding of strategic and defence issues. They reflect the personal views of the authors and should not be seen as representing the formal position of ASPI on any particular issue.
ASPI Cyber, Technology and Security
ASPI’s Cyber, Technology and Security (CTS) analysts inform policy debates in the Indo-Pacific through original, rigorous and data-driven research. CTS is a leading voice in global debates on cyber, emerging and critical technologies, foreign interference and issues related to information operations and disinformation. CTS has a growing mixture of expertise and skills with teams of researchers who concentrate on policy, technical analysis, information operations and disinformation, critical and emerging technologies, cyber capacity building and internet safety, satellite analysis, surveillance and China-related issues. To develop capability in Australia and across the Indo-Pacific region, CTS has a capacity-building team that conducts workshops, training programs and large-scale exercises for the public, private and civil-society sectors. CTS enriches regional debate by collaborating with civil-society groups from around the world and by bringing leading global experts to Australia through our international fellowship program. We thank all of those who support and contribute to CTS with their time, intellect and passion for the topics we work on. If you would like to support the work of the CTS, contact: ctspartnerships@aspi.org.au.
Funding
This publication is funded with support from the UK Foreign, Commonwealth and Development Office.
Important disclaimer
This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services.
© The Australian Strategic Policy Institute Limited 2025
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.
First published January 2025
Published in Australia by the Australian Strategic Policy Institute