In January, the Coalition to Reduce Cyber Risk (CR2) held a briefing at the World Trade Organization (WTO) in Geneva, Switzerland focused on our forthcoming research around the inclusion of digital trade and cybersecurity components in trade agreements. The briefing was attended by 40+ countries, including the U.S., Spain, Australia, Germany, Kazakhstan, Brazil, Japan, and China. 

Cybersecurity provisions have been incorporated in 11 trade agreements to date. These provisions revolve around establishing a cyber-trade link, government capacity building efforts, operational collaboration efforts, and the use of risk-based approaches and consensus standards. 

We focused on:

  • The nature of these existing cyber-trade provisions.
  • The steps taken by governments to implement them.
  • The capacity-building resources available to assist with implementation. 

The session was followed by a Q&A, with questions around defining cybersecurity versus information security, as well around best practices for incident/vulnerability reporting and capacity-building. 

The briefing landed right in the middle of the ongoing negotiations for the  90-country Joint Statement Initiative (JSI) on Electronic Commerce, and in advance of the 13th WTO ministerial conference next week in Abu Dhabi. The JSI has been in development since 2017, and the negotiations have been marked by controversy, including most recently by the withdrawal of United States support for objectives around cross-border data flows, data localization, and source code transfer. Nonetheless, the JSI contains harmonized rules for a number of issues including e-signatures, e-contracts, open government data, consumer protection, unsolicited commercial messages, and crucially, foundational cybersecurity language. 

While there was hope that the JSI could be finalized by Abu Dhabi, it now appears highly unlikely. Negotiations have been further impeded by debate around the temporary WTO Moratorium on Customs Duties on Electronic Transmissions. 

CR2 recently co-signed a letter calling for the renewal of the moratorium with over 170 global business associations. As the negotiations continue, trade optimists hope for a finalization of the text towards the fall of 2024. Despite controversies over other topics, the proposed cybersecurity language in the draft seems relatively uncontentious. 

Ines Jordan-Zoob

Read Next

CISA Proposes Sweeping Cyber Incident Reporting for U.S. Companies

The federal government is one step closer to requiring approximately 315,000 businesses to report cyber incidents and ransomware payments. 

Event Recap: Spring Into Privacy with the NIST Privacy Engineering Program

The NIST Privacy Framework is getting a little "Spring Cleaning." Officials from NIST's Privacy Engineering Program updated participants on updated to the Privacy Framework and other projects at an event last week.

Multiple Organizations Request 30-day Extension on CIRCIA Comments

The Cybersecurity Coalition, U.S. Chamber of Commerce, and 23 other organizations have requested a 30-day extension to the comment period for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) from CISA.