The UK and Australia enjoy a historic relationship and modern partnership. It is a unique and enduring bond built on friendship and shared values; one underpinned by strong security, prosperity and people-to-people links; one more relevant than ever as we work together advancing common interests and tackling global issues, including in cyberspace. We recognise that the pace and development of new technologies and applications, in conjunction with greater access, is delivering significant opportunities for both economic and social development. While bringing great advantages, the reliance on increasingly interconnected networks also exposes states to new vulnerabilities. Irresponsible or illegal exploitation of those vulnerabilities can have both profound impact on the victim and, in the most egregious cases, risk international stability.
We confirm our joint commitment to promoting an international stability framework for cyberspace based on the application of existing international law, agreed voluntary norms of responsible state behaviour and confidence building measures, supported by co-ordinated capacity building programmes.
Australia and the UK will co-operate to deter, mitigate and attribute malicious cyber attacks by criminals, state actors and their proxies, including those that seek to interfere in the internal democratic processes of states.
We will work with industry to implement resilient cyber security solutions for their products and services. We will also share lessons learned as we develop measures to provide defences across our governments, and make it easier for individuals and organisations to stay safe online.
We reaffirm our commitment to a free, open, peaceful and secure cyberspace. The foundation for responsible state behaviour in cyberspace is our mutual commitment to existing international law, including the respect for human rights and fundamental freedoms, and the application of international humanitarian law to cyber operations in armed conflict. We reaffirm that the UN Charter applies in its entirety to state actions in cyberspace, including the prohibition of the use of force (Article 2(4)), the peaceful settlement of disputes (Article 33), and the inherent right of states to act in self-defence in response to an armed attack (Article 51). The law of state responsibility applies to cyber operations in peacetime, including the availability of the doctrine of countermeasures in response to internationally wrongful acts.
We recognise that an increasing number of states are developing operational cyber capabilities. We assert states’ legitimate right to develop these capabilities, and emphasise their obligation to ensure their use is governed in accordance with international law. Acknowledgement of these capabilities does not encourage aggression, or contradict our common commitment to maintaining a peaceful ICT environment. Rather, acknowledging the existence of these capabilities fosters the understanding that, just like in the physical domains, states’ activities in cyberspace do not occur in a vacuum - states have rights - but they also have obligations.
We will promote operationalisation of norms of responsible state behaviour recommended in the 2015 report of the UN Group of Governmental Experts on developments in the field of information and telecommunications in the context of international security. We will focus on positive practical measures that states can take to put these voluntary norms into practice. We will also implement confidence building measures that can build trust between responsible states. In doing so we recognise that transparency is the first step to establishing mutual trust and provides a foundation for measures available to all states, whatever their stage of development. We are committed to working through the OSCE and ASEAN Regional Forum as a way of contributing to peace and understanding in cyberspace.
We confirm our mutual commitment to cyber security capacity building that directly contributes to international stability: recognising the importance to all our security of states developing responsible legal and governance frameworks, overcoming the barriers to implementing agreed norms, building resilience to cyber threats, and strengthening law enforcement responses in line with the Budapest Convention on Cybercrime. As the next 1 billion people access the economic and social benefits of cyberspace, it is in all of our interests to ensure that cybersecurity is understood as a key part of the development agenda.