Framework for Rule-based International Cyberspace Governance

As for governance, cyberspace exhibits complexity. From a technological point of view, cyberspace is layered: it can be roughly divided into the physical layer, the logical layer, and the content layer. From the perspective of governance, these strata are interrelated and interlinked. The difficulty of international governance of cyberspace lies in the disharmony between the logic of technological layering and the logic of governance connectivity. Information technology, however, demarcated the boundaries of governance and coevolves with governance structure. In the IPv4 era, regulations on DNS resource allocation, as the core issue, is characterized by unclear governance subject, weak rules and chaotic mechanism. In the IPv6 era, technological progress has brought new opportunities and new perspectives for improving governance. International cyberspace governance requires the participation of various parties, each performing its own duties and making full use of its capabilities, and making concerted efforts to build a new system of rules. This draft tries to outline a new, rule-based international cyberspace governance regime in the context of IPv6 application, which looks into the future international cooperation of cyberspace governance.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

Data: any electronic or other means of information on the record. Data Processing: the collection, storage, use, processing, transmission, provision, and disclosure of data. Data Security: taking the required steps to ensure that data is effectively protected and used lawfully, as well as having the ability to guarantee a continual state of security. Network Data Processing: the collection, storage, use, processing, transmission, provision, and disclosure of network data. Personal Information: a variety of information related to identified or identifiable natural persons recorded mainly in electronic form, not limited to the use of the network generated or processed in the personal information, but does not include the anonymization of the information after processing. Network Credit: an IP address (hereinafter referred to as the credit subject), in the cyberspace activities to comply with the legal obligations, the state of fulfilling the agreed obligations. Network Credit Information: the objective data and information that can be used to identify, analyze and judge the credit status of the credit subject.

In accordance with the basic spirit of the Charter of the United Nations and the fundamental principles of international law, the following rules are formulated so as to safeguard state sovereignty and promote human rights protection in cyberspace, improve the security and credibility of the global Internet and capacities of comprehensive governance, encourage innovation and change in network information technology, industry and applications, and promote, encourage governance in cyberspace sharing and cooperation among countries as well as high-quality Internet development in each country, and to strengthen the orderly open sharing of data resources and the level of information security protection.

Cyberspace governance SHOULD follow principles of sovereign equality, peace and cooperation, fairness and justice, openness and inclusiveness, mutual benefit and progress; and SHOULD aim to create a community of common destiny, interests and responsibilities based on mutual political trust, economic integration, and cultural integration, and endeavor to construct a well order in which mankind shares the achievements of global development.

Governance in cyberspace SHOULD respect the sovereignty of all countries. State sovereignty in cyberspace is independent and equal. Rights of jurisdiction and defense are the embodiments of a country's sovereignty and SHOULD be respected and maintained by all countries. Countries MUST obey the fundamental principles and general rules of international law, refrain from infringing on the sovereignty of other countries through the Internet and interfering in the internal affairs of other countries, and bear the responsibility for prudent prevention and security of cyber activities within the scope of sovereign control.

Governance in cyberspace SHOULD fully protect human rights. Countries SHOULD protect the security of personal information and privacy, and cooperate to combat cyber attacks, cybercrimes and cyber terrorism. They SHOULD guarantee equal access and smooth communication in the Internet, prohibit discrimination and other unreasonable differential treatments. They SHOULD jointly promote the development of Internet infrastructure, ensure the safe flow of data, aim to close the digital divide, and protect and promote the rights and interests of the broadest range of Internet development.

All activities and acts in cyberspace MUST comply with the law and MUST NOT contravene the regulations, principles, and basic spirit of international law. Governments SHOULD NOT use their dominating position in the cyber domain in terms of facilities, technology, systems, and data to interfere with other countries' exercise of cyber sovereignty and to pursue cyber hegemony, cyber isolation, and other unfair activities.

Countries exercising cyber sovereignty SHOULD follow the principles of self-restraint, comity and reciprocity, so as to reduce friction and confrontation, avoid mutual constraints, and promote economic cooperation and security collaboration.

Countries SHOULD strengthen mutual trust, actively collaborate, comprehensively improve Internet governance capacity, cooperate to establish a credit-based flexible governance system, achieve incentives for trustworthiness and constraints for breach of trust, and establish a secure, good faith, and honest cyberspace.

Governments SHOULD actively engage in dialogues and encourage multi-field, multi-level, and multi-faceted cooperation to improve the overall security and defense capability of the cyberspace, as well as to promote socio-economic development.

Countries SHALL intensify their cooperation in the fields of information network technology, product and service innovation, and talent training, as well as to collaborate to overcome technical problems that threaten cybersecurity, develop cybersecurity products collaboratively, innovate network economic development models, and build a high-level, high-quality network talent team. Countries SHALL encourage collaboration in developing a network security alerting platform and the establishment of a shared security alerting mechanism to compensate for disparities in network management capacities. Countries SHALL enhance research and development of inclusive health care, inclusive education, and inclusive network products and services that promote minors' healthy development.

Countries SHALL endorse multi-field, multi-level, and multi-faceted exchanges and collaboration, support trade organizations, enterprises, educational and scientific research institutions, relevant professional institutions and personnel of various countries to carry out exchanges and sharing activities on the development and utilization of network data security technologies, and promote education and training on cybersecurity.

Countries SHOULD actively promote the formation of a well environment for governments, enterprises, relevant social organizations, and the public to participate in governance, and promote mutual recognition of cybersecurity and data processing rules and standards made by other countries and international organizations.

On the premise of ensuring data security and protecting personal information , privacy rights and interests, countries SHALL promote the safe and orderly flow of data, jointly explore the new growth of data economy, promote the innovation and development of network information technology, and facilitate the establishment of cross-border factor flow rules and risk prevention mechanisms.

Governance in cyberspace SHOULD respect and adapt to the objective patterns of technological development, and promote the coexistence and progress of mankind and technology. Countries SHOULD respect the nature of connectivity in cyberspace, maintain the unity of the Internet and avoid fragmentation of the Internet. Countries SHOULD NOT maliciously exclude other countries' suppliers, information technology and products, fiber optic cables and other facilities, nor SHOULD they take advantage of their own technological, economic, or political advantages to unfairly distribute or block important cyber resources and jeopardize the security of global supply chains. Countries SHOULD strive to overcome the problems of Internet Protocol Version 4 (IPv4), such as the depletion of network addresses, the difficulty of ensuring service quality, and the inefficiency of transnational collaborative governance, and give full play to the advantages of Internet Protocol Version 6 (IPv6) in network addresses, innovation space and governance, so as to improve the carrying capacity and service level of their own network. Countries with technological advantages MAY provide necessary assistance to countries in need.

Countries have the right to protect their network infrastructure in accordance with domestic laws. No country, military, government, government-authorized organizations or individuals SHALL attack or damage network infrastructure of other countries. An attack on another country's network infrastructure constitutes a violation of that country's sovereignty. A state MAY restrict or protect Internet access in accordance with the principle of sovereignty. Access to the Internet does not mean that the country gives up its sovereignty. In case of damage, loss of function or data leakage, key information infrastructure that MAY seriously endanger national security and public interests, a country MAY carry out critical measures of protection and defense, and MAY request assistance from other countries when necessary.

Internet root servers, communication protocols and IP addresses and other key Internet resources are global public resources. Countries SHOULD actively promote the fair allocation and management of Internet key resources and the international reform of the Internet name and digital address allocation authority, and effectively improve its representativeness and the openness and transparency of its decision-making and operation.

Network eavesdropping and wiretapping activities are prohibited among countries. To ensure the safe operation of the Internet in each country, countries have the right to regulate their networks, impose access licenses for unlawful websites, and discontinue providing services to websites that do not conform to management, etc.

Launching of cyber attacks and cyber war are prohibited. Consultations, discussions, and other peaceful methods of resolving disputes SHALL be sought first, and if necessary, relevant agencies and organizations established by these rules MAY be requested to collaborate in order to resolve disputes at the minimum cost.

Countries SHOULD punish according to law the use of the Internet to engage in activities that endanger the physical and mental health of minors, and provide a safe and healthy Internet environment for minors. They SHOULD cooperate to combat Internet use of child pornography and violent crime. Where an online data processor processes the personal information or other online data of a minor under the age of 14, it SHALL obtain the consent of the minor's parents or other guardians. Where there are provisions in the domestic laws of each country, such provisions SHALL prevail. Cyberspace governance bodies of all countries MAY, in accordance with domestic laws, consciously undertake the obligation to review, screen and intercept content that harms or MAY harm the physical and mental development of minors, and punish the production, dissemination and provider of harmful information according to law. If conditions permit, channels for reporting illegal content SHOULD also be provided to individuals and organizations in their own countries and other countries.

For cybercrimes committed within the territory of a country or against that country, if the law enforcement authorities of that country request the public authorities, enterprises or individuals of another country to provide relevant electronic evidence for assistance, the country requested MAY, in accordance with the provisions of its domestic law, provide necessary assistance on the premise of not harming its national security, public interests and significant rights and interests of individuals.

Data conveying a country's economy, culture, national defense security, and other key public interests, as well as citizens' rights and interests, SHOULD be processed under the premise of data security. Data processing activities SHOULD adhere to international treaties, norms, and legal principles, and SHALL NOT jeopardize national security, public interest, or the legitimate rights and interests of citizens of other nations. Countries SHOULD urge domestic data processors to consciously assume international and domestic social responsibilities, respect social justice, business ethics and professional ethics, and fulfill the corresponding data security protection obligations in their network data processing activities.

If it is truly necessary for states to collect personal information of citizens of other countries in the course of commercial cooperation, judicial cooperation or other processes, they SHALL do so for clear and reasonable purposes and in accordance with the principles of legality, legitimacy, necessity and good faith. On the basis of obtaining the consent of the relevant subject, the obligation of protection SHALL be properly fulfilled in respect of the collection, storage, use, processing, transmission, provision, disclosure, deletion and other links of personal information. If the country where the data is collected has relevant regulations, such regulations SHALL be complied with.

Countries SHALL explore to establish a new cybercrime convention that is more inclusive and transparent. To address the new threats posed by new technologies such as artificial intelligence and cloud computing, and to take aim at new forms of complex and diverse cybercrimes and new threats of cyber terrorism, countries SHALL explore to establish a new convention that covers the legitimate appeals and major concerns of all contracting parties, with transparent procedures and reasonable mechanisms.

Countries SHOULD cooperate in establishing a credit system in cyberspace, comprehensively improve the network credit information management capabilities, promote the unification of credit status determination standards, realize credit-based prior risk prevention and security warning mechanism, create a safe and reliable cyberspace for economic development and provide guarantee for economic development and information exchange.

Countries SHALL, in accordance with the principles of legality, objectivity, prudence and relevance, identify the credit status of the credit subject and load it into the credit file according to the network credit information directory and network credit status identification criteria. The network credit information directory aims to standardize the credit information included in the scope. The collection of credit information SHALL NOT exceed the scope stipulated in the catalogue of network credit information. The standard of network credit status identification aims at standardizing the principle, basis and rating standard of credit status identification and credit file recording. The identification of network credit status and the recording of credit files SHALL strictly comply with the identification standards of network credit status. The catalogue of network credit information and the standards for the identification of network credit status SHALL be determined by the countries through consultation. Each country MAY, in accordance with its domestic laws and regulations, compile supplementary catalogues of online credit information and detailed rules on standards for the identification of online credit status applicable to its own country.

Countries SHALL establish credit files of credit subjects with a uniform or mutually identifiable logo and open the inquiry portal to member countries within rules stipulated in this Framework Rules. Sharing of credit files and other credit information is encouraged. Credit exchange of information SHALL respect each country's sovereignty and protect basic human rights, not to jeopardize national security or to breach personal rights to information or privacy.

Countries SHALL jointly establish a unified credit early alert platform. Countries SHOULD take the initiative to conduct early risk alert on that platform for the credit subjects with serious trust-breaking behaviors in their own countries. If a country finds that a credit subject of another country has committed serious dishonesty, it SHALL submit the relevant information to the credit early warning coordinating body, which SHALL decide to issue the early alert information.

Countries MAY give incentives to credit subjects with good credit standing in accordance with their domestic laws. Countries MAY, in accordance with their domestic laws, impose credit punishments on credit subjects that break faith. The subject of credit who receives incentives to keep faith and punishments for breaking faith SHALL be recorded in credit files. Countries MAY impose restrictions on other countries' seriously dishonest credit subjects, and the restrictive measures SHALL be determined by consensus of all countries through consultation. Binding measures SHOULD NOT violate the Charter of the United Nations and the basic principles of international law.

Credit information recorded in error SHOULD be corrected. Countries SHOULD make credit repair legislations, implement credit repair procedures, and provide credit subjects with feedback, complaints, and other forms of relief. If the credit information on the credit alert platform is erroneous, it is the responsibility of the credit warning coordinating agency to fix it. The credit alert coordination body SHALL establish remedies and corrective standards.

Countries SHOULD actively formulate rules for cyberspace governance that are inclusive, feasible and developable on the basis of respecting cyber sovereignty and consultations on an equal footing. Under the guidance of this Framework Rules, countries SHOULD actively formulate rules on cyberspace security, rules on digital economy cooperation, rules on credit information evaluation and sharing, and rules on consultation and mediation of cyberspace disputes.

Countries SHOULD cooperate in establishing a network security alert platform and credit alert platform, and explore for a digital economy cooperation platform and a cyberspace technology research, development and exchange platform.

Countries SHOULD establish a cybersecurity early warning institutions on the basis of respect for national sovereignty, in accordance with the principles of equality, justice, democracy, openness and scientificity. An advisory committee to provide assistance to alert institutions on decision-making SHALL be established. Members of that committee SHALL comprise of Scientific and technological institutes, commercial institutions, other organizations and relevant experts. A decision-making committee to exercise final decision-making authority based on advisory opinions SHALL be established. The members of that committee SHALL be composed of governments from all countries.

The funds required for activities such as the formulation of normative documents, the establishment of platforms and the establishment of institutions under this Framework Rules SHALL be prepared by all countries through consultation in accordance with the principle of equity. The share of funds MAY be reasonably adjusted according to the actual situation such as the level of economic development of each country.

This memo includes no request to IANA.

This document only defines a framework for network resources categorization. This document itself does not directly introduce security issues.