IGF 2017 - Best Practice Forum on Cybersecurity

Part I: Framing the 2017 IGF Best Practice Forum Cybersecurity

Introduction

The Best Practice Forum (BPF) on Cybersecurity is part of the 2017 intersessional work programme feeding into the 12th annual meeting of the Internet Governance Forum (IGF) held in Geneva, Switzerland from 18 to 21 December 2017.

The BPF aims to both produce a tangible output^[1] and provide a broad multistakeholder platform for engagement on cybersecurity policy matters, which increases existing cooperation and builds new synergies amongst cybersecurity initiatives and processes. The BPF Cybersecurity as such fits well under the overall theme of the 2017 IGF, Shape Your Digital Future! .

The BPF on Cybersecurity grew out of the BPF Establishing and supporting Computer Security Incident Response Teams (CSIRTs) for Internet security, and the BPF Regulation and Mitigation of unsolicited Communications, both of which ran during 2014 and 2015.^[2]

As an outcome of both groups, it was identified that the topics they had tackled were somewhat limiting, and there was no existing forum within the inter-sessional work to discuss other cybersecurity related challenges and to look more holistically at cybersecurity challenges. In addition, "cybersecurity" as a term was ill defined within our community, and could benefit from deeper investigation and definition[1] .

In 2016, the first Best Practices Forum on Cybersecurity hence started off with discussions enabling participants to understand the wider context of the word "cybersecurity" for each stakeholder group. The BPF made it clear right from the beginning that this work needed to be conceived as a multi-year project. It then worked to:

• Identify the communications mechanisms between stakeholder groups to discuss cybersecurity issues;
• Understand the typical roles and responsibilities of each group in making sure the internet is a secure and safe place;
• Identify common problem areas in cooperation, and good best practices for doing so.

A set of 10 conclusions were drawn, which broadly echoed multi-stakeholder cooperation as critical, and put particular stress on how stakeholders must understand, respect and trust each other's expertise and competences. The final outcome, including all findings, can be found on the IGF web site^[3].

The proposal^[4] for the 2017 BPF Cybersecurity was approved by the IGF’s Multistakeholder Advisory Group (MAG) on 11 April 2017^[5]. The BPF Cybersecurity reports into the 2017 Main session on cybersecurity at the 12th IGF meeting in Geneva and the BPF document is published as part of the official output of 12th IGF meeting.

Methodology & community input

The approval of the project proposal for BPF Cybersecurity by the 2017 MAG kicked off the BPF’s open and iterative process^[1]. The BPF Cybersecurity convened regular virtual meetings open to all interested stakeholders and discussed progress on an open mailing list. Draft versions of the output document were posted for community comment on the IGF website and presented at a dedicated workshop during the 2017 IGF meeting in Geneva.

The BPF Cybersecurity launched a call for contributions^[2] to collect substantial community input on the BPF’s subject matter. Drawing primarily from an analysis of the potential cybersecurity implications of the policy suggestions for enabling connectivity and supporting the SDGs formulated by the IGF Policy Options for Connecting and Enabling the Next Billion(s)^[3], the BPF invited community input to identify these and additional cybersecurity risks and collect recommendations on how to mitigate them.

In addition to its focus on the SDGs, the BPF asked the community to weigh in on the responsibilities of different stakeholders for mitigating risks, and on what critical cybersecurity issues would benefit from a multistakeholder approach.

The BPF made an effort to seek input from National and Regional IGF Initiatives (NRIs) via an NRI-specific questionnaire.

All contributions are collected on the IGF website, a summary can be found in Annexe 1.

1.1. Trust and Confidence in ICTs and the Internet

‘The Internet needs a solid foundation in trust for its full potential to be realized.’^[1] Well-developed cybersecurity contributes to building trust and feeds the confidence in ICTs and Internet technologies enabling them to become instruments used by people and organisations in pursuing their goals.

‘Civil and political rights are clearly boosted by internet access, but the internet also positively impacts economic development when societies can trust in internet-connected systems and robustly interact, and transact online.’^[2] Good cybersecurity stimulates growth in users and usage of Internet technologies, which help to accelerate business, make economies grow and increase the wealth that becomes available for distribution, they contribute to the reduction of transaction costs, increase transparency and accelerate knowledge and information transfer. Good cybersecurity stimulates the use of technologies that have the potential to contribute to achieving the SDGs.^[3]

In short, cybersecurity helps to build the confidence needed to motivate the use of ICTs and the Internet, and the SDGs drive that energy towards achieving the goals to end poverty, protect the planet and ensure prosperity for all.^[4]

1.3. The different faces of cybersecurity

Cybersecurity is a broad concept that covers many aspects. A discussion on different definitions of the term ‘cybersecurity’ can be found in the output document of the 2016 BPF Cybersecurity^[1].

ICTs and Internet technologies increasingly underpin society, economy, and polity. Cyberspace faces new challenges such as security and stability, infringement on privacy and intellectual property, cyber terrorism and cyber surveillance activities.^[2] The submissions to the BPF reflect different expectations, priorities, and perspectives on how cybersecurity can contribute to the growth and trust in ICTs and Internet technologies, and their ability to support achieving the SDGs.  This sections aims to give an overview of the different facets of cybersecurity.

Trade, commerce, industry and production

‘Good cyber security is a means of achieving and sustaining the credibility of the Internet as a safe environment for businesses to thrive and sustain economic value.’^[1] Effective cybersecurity is essential ‘to engage fully in the increasingly cyber-dependant trade and commerce. Robust cybersecurity frameworks enable individuals, companies and nations to realise the full potentials of the cyberspace, without fear or reservation, promoting cross-border delivery of services and free flow of labour in a multilateral trading system.’^[2]

Cyber attacks, vulnerabilities and security breaches break trust of businesses online, which directly impacts productivity and economic growth in developing countries where ICTs are more adopted for the delivery of services.^[3] Small and medium enterprises (SMEs) face the challenge to secure themselves from cyber attacks and to promote confidence and trust in their online services.^[4]

Human Rights, Rule-of-law and Democracy

Good cybersecurity contributes to the ‘protection of human rights, democracy and rule of law.’^[1] Certain security measures, however, might as well pose a serious threat to these democratic values, in particular where governments are increasingly asserting control over the Internet and stigmatize security measures, such as encryption.^[2] ‘Cybersecurity and human rights are complementary, mutually reinforcing and interdependent.’ To avoid that cybersercurity policies have a negative impact, they should incorporate human rights by design^[3], states should work together to curb trade of spyware, respecting human rights^[4], and actively participate in discussion forums with the other stakeholders^[5].

Poor cybersecurity and information breaches might, for example, have an impact on the ability of civil society to campaign against political decisions or weaken the voice of activists.^[6]

2.1.2. An analysis of the CENB & SDG cybersecurity implications

The BPF performed a cybersecurity assessment of the CENB output documents to identify potential risks and security challenges emerging from the CENB policy recommendations. The BPF focused in particular on the CENB II recommendations, which are directly linked to the SDGs.

The BPF came up with a list of 10 identified threats and cybersecurity challenges:

1. Denial of Service attacks and other cybersecurity issues that may impact the reliability and access to Internet services;
2. The security of mobile devices, which are the vehicle of Internet growth in many countries, and fulfill critical goals such as payments or self-identification;
3. Potential abuse by authorities, including surveillance of Internet usage, or the use of user-provided data for different purposes than intended;
4. The confidentiality and availability of sensitive information, in particular in medical and health services;
5. Online abuse and gender-based violence;
6. Security risks of shared critical services that support Internet access, such as the Domain Name System (DNS) and Internet Exchange Point (IXP) communities;
7. Vulnerabilities in the technologies supporting industrial control systems;
8. Use of information collected for a particular purpose, being repurposed for other, inappropriate purposes. For instance, theft of information from smart meters, smart grids and Internet of Things devices for competitive reasons, or the de-anonymization of improperly anonymized citizen data
9. The lack of Secure Development Processes combined with an immense growth in the technologies being created and used on a daily basis
10. Unauthorized access to devices that play an increasingly important role in people's daily lives

The detailed analysis of the CENB cybersecurity implications can be found in annexe 2. The CENB II analysis dives deeper into the connection between risks and the SDGs.

2.1.4. Additional concerns and challenges

In addition to the cybersecurity challenges related to the CENB policy options, the BPF identified a number of additional cybersecurity concerns that could impact the potential contribution of ICTs and Internet Technologies to achieving the SDGs.

1. Mitigate a current lack of cybersecurity awareness through awareness building and capacity development
   1. States must become aware of security risks to their and their citizen’s activities. Awareness should be raised by developing best practices and guidelines and sharing them among entities.
   2. Focus on user education
2. Policy and processes should be developed to improve the cyber resiliency of cities
3. Number of women in cybersecurity
   1. Diversity in the cybersecurity workforce should be promoted.
   2. The Internet governance forum and other policy forums should provide mechanisms to ensure women's participation in policy discussion and decision making.
4. Cryptocurrency
   1. Laws should account for the existence of cryptocurrencies and their use in cybercrime, such as acts of ransom, which can be less traceable.
5. Stakeholders should invest in studying the security implications and influence of social media on cybersecurity
6. Whistleblower legislation and implementation, administered with excellent judgement.

Multistakeholder cooperation on cybersecurity - a shared responsibility

‘All stakeholders have a positive role to play in nurturing a trusted and open Internet. We need to work to secure core aspects of Internet infrastructure, to protect the confidentiality and integrity of data that flows over it, and to ensure the right policies are in place to support the technologies, networks and actors that make the Internet work. We do this through collective responsibility and collaboration.’^[1]

Each stakeholder community has a responsibility in helping to ensure that cybersecurity does not hinder future internet development. New technologies may be insufficiently secure and cause harm when deployed, while stringent security requirements may prevent the development, deployment, or widespread use of technologies that would generate unforeseen benefits. Stakeholders have the responsibility to foster open inter-stakeholder collaboration and trust relationships, and to infuse a culture of cybersecurity among all stakeholder groups.^[2]

Complexity is the reason why multistakeholder efforts are important.^[3] There is no one-size fits all solution, and pro-internet policies can take many different shapes.^[4] A multi-stakeholder approach to develop future policies on the strengthening of the rule of law in cyberspace, should involve the relevant stakeholders, so that future policies will represent commonly accepted solutions to make the cyberspace more secure.^[5] To succeed, it may be necessary to develop strategies to actively reach out to stakeholders and involve them in discussions on common issues.^[6]

From the way internet was constituted and works, it follows that ‘each party needs to take a collaborative security approach to foster confidence and protect opportunities. Since every stakeholder has different incentives and different economic interests and different logics (regarding security/privacy/DP), only a good multistakeholder process would bridge these differences.’^[7] Cybersecurity is a collective responsibility, and a culture of cybersecurity should be encouraged. ^[8] “Cybersecurity should be considered a ‘public good’, which promotes collective responsibility for shared benefit.”^[9]

On the topic of multistakeholder cooperation on cybersecurity the Internet Society published Principles of collaborative security^[10] and a Policy framework for an open and trusted internet^[11], and the Commonwealth Telecommunications Organisation (CTO) developed the Commonwealth cybergovernance model^[12].

Governments (and International organisations)

The governments should take ‘a leading role in driving a national and international cybersecurity agenda and setting regulatory and policy priorities’.^[1] ‘They play a fundamental role in developing policy and legal frameworks for a secure cyberspace, data protection, protecting critical information infrastructure and enforcing the law against cybercrime, online abuse and gender based violence.’^[2] Governments play an essential role in protecting critical infrastructure and prosecuting cybercriminals,^[3] and should support and cooperate with banks, credit card companies, insurance companies cell phone companies and other businesses vulnerable to fraud. Governments can facilitate, initiate and/or (financially) support processes that lead to a better cybersecurity environment. E.g. through initiating (discussions on) ISACs, anti-abuse mechanisms, anti-ddos facilities, etc., that industry can then take the lead in.

Nations must become serious about putting in place a robust risk management system, driven by a common cybersecurity strategy. A country-wide vulnerability management strategy is needed. Policies should be in place to ensure stakeholder transparency and accountability in ISP, DNS and IXP communities.^[4] Governments could take initiatives for  business, SMEs and entrepreneurs to inform about cybersecurity risks and support by sharing advise and best practice examples.^[5]

In terms of policy, governments must encourage solid technology practices such as bug bounties^[6], and not exacerbate the problem by hoarding vulnerabilities, or creating backdoors in secure communications tech. Governments must regulate private sector through data protection laws, and other consumer protection. They must pursue policies or treaty options that compel signatories to abide by international principles, norms and standards that ensure cybersecurity and national security measures that employ digital technology are necessary and proportionate. Governments and private sector should cooperate in private sector-government partnerships to improve transparency and to protect disclosures.^[7]

The fact that often different government branches are responsible for ICTs, intelligence and national security, and sustainable development poses an extra challenge.^[8] When taking on their role, governments should be cautious not to ‘undermine the collaborative approaches and the role of the technical community and industry in identifying risks, providing security of networks and customers, and the role of civil society in safeguarding transparency, accountability, due process and human rights. They should not ‘fuel competition for creating insecurity (...) and not undermine user’s data protection,’^[9] for example by stimulating offensive security research to expose vulnerabilities without an intent to fix.

Modern methods of attack may require tackling of cybercrime internationally through aligning legislative initiatives,^[10] and International organisations should ensure ‘that all governments do adopt conventions and agreements’^[11], at the same time and at the same level.

Governments have the responsibility to reach out and engage with other stakeholders in seeking multistakeholder solutions to cybersecurity challenges as noted and recommended in the prior section on multistakeholder approaches.

Technical community

It is the responsibility of the technical community and industry to identify risks, provide security of networks, devices and people.^[1]

It is important to support efforts to mitigate DoS and other attacks at the technology level, rather than with policy such as criminalisation. Proactive solutions to find, mitigate and disclose vulnerabilities are key to addressing reliability and access. The technical community must develop protocols to prevent their use for exploits such as DDoS[1] .^[2]

Technical organisations, such as the IETF, should consider broadening their membership to include all stakeholders, and involve NGOs and stakeholders in their discussions before designing the technical solutions.^[3]

Multistakeholder cooperation within the IETF and other standardising bodies could on the one hand focus on swift implementation of standards developed with the technical community as to ensure a safer environment based on the offered solutions, on the other on identifying urgent issues together.

Academia

The Academics’ main responsibility is to guide with scientific research.^[1] To avoid a knowledge gap, There’s a considerable lack of knowledge of what is really going,[1] [2]  which is seen by some as problematic. Therefore it is important that also the most recently developed and adopted technologies are included in academic curriculums and research programmes.^[2] Academics and security experts should monitor^[3] best practices implementation.^[4] Policy protections must exist for researchers that seek out vulnerabilities in technology.

Part III:  Conclusions and way forward

Well-developed cybersecurity helps contribute to meeting the SDGs. Poor cybersecurity can reduce the effectiveness of these technologies, and thus limit the opportunities to achieve the SDGs.

[ text for Part III to be based on discussion at the BPF Cybersecurity workshop at the IGF]

Non-exhaustive list of regular contributors to the BPF discussions

[to be added]

Annex 2:  CENB Phase I & II Cybersecurity-focused policy analysis

CENB Phase II - Cybersecurity-focused policy analysis

Analysis contributed by Andrew Cormack

Notes on how cyber-security can affect the achievement of the Sustainable Development Goals (SDGs). Derived from the IGG Policy Options for Connecting and Enabling the Next Billion(s): Phase II. Many of the cyber-security issues affect several SDGs: the connections selected here are chosen as perhaps the best examples of these dependencies.

SDG1 (No Poverty) depends on individuals being able to access information over the Internet. Thus it can be disrupted by weaknesses in, and attacks on, the availability of information services and the networks that individuals use in connecting to them. Issues such as denial of service attacks and services that can act as amplifiers for them could therefore affect progress towards this goal. Similar issues arise in SDGs 4 (Quality Education), 10 (Reduced Inequalities), 14 (Life below water) & 15 (Life on Land), and the overall aim of providing “meaningful access”.

SDG2 (Zero Hunger) includes farmers seeking information, reporting on local conditions, applying for grants etc. Since such activities may involve implicit or explicit criticism of public authorities, they will be hindered by any perception that those authorities are engaged in surveillance of internet usage.

SDG3 (Good Health) includes telemedicine, disease monitoring and the storage of patient data. Developed countries have already experienced setbacks in these areas as a result of incidents affecting the confidentiality and availability of sensitive information held by medical and health services.

SDG5 (Gender Equality) is harmed by individuals or organisations using communications technologies to engage in online abuse and gender-based violence.

SDG6 (Clean Water) involves using communications technologies for the remote monitoring and control of treatment and pumping equipment. Vulnerabilities in SCADA (Supervisory Control and Data Acquisition) equipment that is connected to shared networks are a major concern that can turn such automation from a benefit into a serious pollution and health threat.

SDG7 (Affordable and Clean Energy) depends on the widespread acceptance of smart meters and smart grids. Loss of trust in these systems can easily be caused if monitoring equipment and systems do not keep information confidential, or if information is used for inappropriate purposes.

SDG8 (Decent Work and Economic Growth) highlights the importance of mobile payment systems, which are critically dependent on the security of mobile devices such as phones and tablets.

SDG9 (Industry, Innovation and Infrastructure) suggests that developing countries may find opportunities to develop disruptive industries in the area of IoT (Internet of Things). However lack of secure development processes are already causing concerns for IoT and any industry based on them could be severely damaged by a security failure in its products.

SDG11 (Sustainable Cities and Communities). Many of the technical tools suggested as supporting this aim can also become serious threats to individuals and communities if they are not secure. Criminals, neighbours, governments or even family members with unauthorised access to internet-monitored home security, traffic monitoring or CCTV systems can cause serious privacy, material, physical or emotional harm.

SDG16 (Peace and Justice) concerns citizen engagement in government, but also notes that these tools can be used for repression and the spread of prejudice. Either will strongly discourage engagement. Systems used to hold authorities to account must be protected from abuse by those authorities.

Appendix A: Policy options identified from the Phase I document

http://www.intgovforum.org/cms/documents/policy-options/654-igf-policy-options-for-connecting-the-next-billion-compilation/file

1.     Deploying infrastructure

a.     Physical, interconnection layers and enabling technologies

1. Promote broadband infrastructure (Africa IGF)
2. Promote power grid capacity (Africa IGF)
3. Explore creation of continental common toll-free Internet platform to preserve the identity and cultural heritage of Africa (Africa IGF)
4. Stabilize pricing for internet access service (Ministry of Comm. Brazil)
5. Improve transcontinental submarine cabling (Ministry of Comm. Brazil)
6. Groups with major market power are obliged to connect to traffic exchanges, offer full peering, paid peering and traffic (Ministry of Comm. Brazil)
7. Stimulate investments for broadband roll-out (EuroDig)
8. Provide public funds where private investment is not enough (EuroDig)
9. Development of public-private partnerships (EuroDig)
10. Open access and spectrum for Wi-Fi development (APrIGF)
11. Spectrum is a common good, policy should be inspired by criteria of public and general interest (EBU)
12. Pro-competitive broadband policy (ICC Basis)
13. Policy initiative targeted at specific socio-demographic groups (Annenberg School for Communication)

b.     Mobile

1. Half of the world’s population has a mobile subscription – mobile helps to provide underserved regions with the opportunity to overcome socio-economic challenges (GSMA)
2. Making prepaid mobile services available to non-elites, increasing mobile competition to reduce prices (ICT Africa)
3. Stimulate 3G networks in Niger – mobile credited for nearly all progress on connectivity (IGF Niger)
4. Promote wireless in areas with reduced electricity coverage (Movimento de Espectro Livre)
5. Spectrum is finite, ITU estimates 1340-1960 Mhz of spectrum required for 2020 demand (GSMA)

c.     Funding sources: Universal service funds, Public Private partnerships

1. Universal Service Provision Funds should be used to engender infrastructure into underserved areas and enable affordability (African Regional IGF)
2. USAF should address institutional environment: oper. Independence, legal clarity, internal capacity + support broadband supply. Successful funds are targeted to address affordability and gaps (Alliance for Affordable Internet)
3. Investments are currently typically redirected to urban and semi-urban areas (Universal Access Fund and ICT Infrastructure Investment Africa)

d.     Deployment

1. Development of IXPs and IPv6/IDN deployment play a crucial role (EuroDig)

2.     Increasing usability

a.     Applications

1. Causal relationship between low usage of mobile media tools and internet literacy – even when people have access to the internet, they lack the understanding of it (World Bank)

b.     Services

1. Citizens need to have information on what governments and private sector are doing to increase access and connectivity, especially in rural areas. Geography and culture must be taken into account (civil society)
2. Digital content and services are important to drive internet adoption and usage (World Economic Forum)

c.     Local Content, Multilingualism

1. Content in local languages is important – accessible, cheap and interesting are content requirements (EuroDig)
2. Representation and participation are uneven, many people are left out of the debate (IGF local content 2014)
3. Encourage locally relevant content, including protections for freedom of expression, press, privacy and intellectual property, e-commerce infrastructure, consumer protection, trusted online payment systems. Policies must be market driven and based on voluntary commercial arrangements (ICC Basis)
4. Promote local content (Iberoamerican federation of IT associations)
5. Local content promotion in Spanish and native American languages (Paraguay IGF)

d.     Media

1. Most traffic is driven by professionally produced quality content. Local content promoters are now in competition with global content industry (EBU)

e.     Accessibility

1. Legislative framework on accessibility exists, but awareness raising, education and training of specialists is needed. (Swiss IGF)
2. Items paid for by the public must be accessible for the public – open access to publicly funded research (Swiss IGF)

3.     Enabling users

a.     Human Rights

1. States and private sector must commit to developing clear standards, procedures for protection and transparency to strengthen human rights on the internet in the region (Asia Pacific Regional IGF)
2. African IGF session on Human Rights on the Internet:

1.  Establish mechanisms to promote, monitor and popularize African Declaration on Internet Rights and Freedoms and UNESCO’s concept of internet universality

2. Self regulatory, independent objective oversight and sanctioning mechanisms

3.  Meaningful access to ICT includes control over ICTs as a key resource towards advancing status of women and girls and their human rights

4.  Address emerging issue of violence against women

b.     Inclusiveness (Gender, Youth)

1. Issues: unequal access to internet infrastructure, affordability, gender disparity in education, digital literacy, uneven capacity to use internet for needs and priorities, specific gender-based challenges and barriers (relevant content, gender-based harassment and violence) (2015 IGF BPF on Countering Abuse against Women online)

c.     User literacy

1. Support open data models, local content development, eLearning initiatives (African Regional IGF)
2. Principles on Public Access in Libraries (IGF DCPAL)

d.     Digital Citizenship

1. Fostering public access points in public libraries and community centers, and promoting content creation and digital literacy activities in those places (LAC IGF)
2. Accessible voting machines, supporting school for blind students, working with low income populations. Promoting access to information. (Microsoft)

e.     Entrepreneurship

1. Those formerly excluded from economic opportunity can use the internet for all phases of starting their own companies (WEF 2015)

4.     Ensuring affordability

a.     Digital divide

1. Improve investment in R&D to allow Brazil to compete with foreign-produced goods. Otherwise the country does not fully benefit from the internet economy (Movimento de Espectro Livre – Brazil)
2. Focus on increasing supply and lowering cost of access (Internet Society)
3. Address spectrum availability for 3G and 4G (Arab IGF)
4. Increase IXPs at national and regional levels (Arab IGF)
5. Educate on computer literacy and reduce device cost, which will drive internet use and support establishment of local content (Arab IGF)

b.     Costs of Access per Capita

1. Infrastructure sharing (e.g. independent tower companies) lowers industry costs (Alliance for Affordable Internet)
2. Identify appropriate balance between taxation revenue and long-term socio-economic growth. Develop evidence based policies (Alliance for Affordable Internet)
3. Develop firmware for devices already on the market, so existing devices can be re-used (e.g. OpenWRT) (Movimento de Espectro Livre – Brazil)

5.     Creating an enabling environment

a.     Government, Regulatory Authorities and IGO frameworks, laws and regulations

1. Connecting the next billions should be driven as a project (African Regional IGF)
2. Ministries of Communications should review plans through multistakeholder cooperation (African Regional IGF)
3. Governments should demonstrate ability to implement viable policies already in place (do not replace previous govt projects) (African Regional IGF)
4. Deploy government services using open data model (African Regional IGF)
5. Effective monitoring of projects and online reporting (African Regional IGF)
6. Regional multistakeholder approach at the AU-level (African Regional IGF)
7. Infrastructure sharing at the backbone level and open access to cut costs (Mozambique IGF)                
8. Fiscal policy and taxation (Mozambique IGF)
9. Research and Data Collection (Mozambique IGF)
10. National broadband strategies require extensive public consultation with all stakeholder groups (APC)
11. Eliminate market protections for incumbent operators (APC)
12. Increase government investment in public access facilities and awareness raising, focused on disenfranchised groups (APC)
13. Allow innovative uses of spectrum and new spectrum sharing techniques (APC)
14. Promote local ownership of small-scale communications infrastructure (APC)
15. Using public funds and utility infrastructure to ensure national fibre networks move into sparsely populated areas (APC)
16. Adopt effective infrastructure sharing (APC)
17. Reduce taxes on ICT goods and services (APC)
18. Established broadband targets in Digital Agenda for Europe (EC)
19. Creation of ad-hoc funds to stimulate investment (EC)
20. Improve digital skills and literacy (Coding week, networks of Digital champions) (EC)
21. International organizations should show benefits of investments in access, high capacity connectivity, promote healthy, competitive and stable market environments, develop private-public partnerships for non-commercially viable areas, transfer expertise and share best practices (EC)
22. Promote corporate social responsibilities (Nigeria IGF)
23. Broadband policy, ICT Policy encouraging investment and Local Content Policy (Nigeria IGF)

b.     Private sector-led initiatives and market strategies

1. Alliance for affordable internet:

                                    1.  Liberalized market with open, competitive environment

2.  Nurture healthy market competition

3.  Streamline licensing process with no barriers to market entry

4.  Ensure competitive market structure, with no govt ownership of end user providers

5.  Available access at market rates to international gateway or cable

6.  Transparent disclosure of pricing and service options

7.  Permit pre-paid and tiered pricing

8.  Remove barriers to crossing national borders with infrastructure or traffic

1.  ICC Basis:

1. Open and competitive markets, fair, investment-friendly, comparable regulatory intervention for all actors

2.  Strong reliance on voluntary commercial arrangements

3.  Policies that promote efficiency through engineering-driven design (creation of IXPs)

4.  Policies that promote growth of products and services provided over broadband

1. Run localized networking initiative with solar backup (Kenya IGF)
2. Social enterprise that makes broadband available at low cost, based on national fiber optic network (Kenya IGF)

c.     Non-profit, Public-Private partnerships and Other initiatives

1. Arab IGF:

1.  Foster private-public partnerships to invest in telecom infrastructure to reach out to disadvantaged areas

2.  Establish national and local dialogues on benefits of internet and how it improves economic situation of individuals

3.  Develop policies and regulations that cater for competitive access-price strategy, macro-level affordability

4.  Engage with CSOs to reinforce their role in mobilizing communities they work with

1. Facilitiate deployment of telecoms infrastructure to facilitate access to spectrum and lower taxes (LACIGF)
2. Companies must develop business models to break restriction income. Universalize through mobile telephony (LACIGF)
3. Digital inclusion programs such as distributing computers to children in schools (LACIGF)
4. Invest in  network services in order to close coverage gap (LACIGF)
5. Roll-out of optic cables throughout country (Benin IGF)
6. Promote national TLD (Benin IGF)
7. Federal Telecommunications Institute of Mexico:

                                    1.  Promote access for persons with disabilities

2.  Make terminal devices and telecom services more affordable and better quality to ensure widespread access

3.  Strengthen telecoms infrastructure by encouraging public-private partnerships

4.  Encourage campaigns for skills building

5.  Encourage multi-stakeholder governance

1. Facebook:

1.  Reduce the cost of internet access, such as supporting innovative business arrangements like free basics

2.  Promote free and open internet

a.  Do not permit fast lanes, blocking, throttling

b.  Do not introduce laws inhibiting innovation

c.  Innovative practices such as zero-rating can give more people access to content

3.  Expand connectivity infrastructure

a.  Streamline local licensing processes

b.  Reduce legal barriers to entry

c.  Promote sharing of passive infrastructure (dig once, build once)

d.  Tax incentives can accelerate development

1. Colombia IGF:

1. ICT appropriation linked to access is important to increase impact of government initiatives and reducing digital divide

2.  Promote production of software and local content with social focus

3.  Encourage public internet access strategies, and do not neglect them in favor of mobile access.  Public access links vulnerable communities.

4.  Expand community wireless networks and connection of schools and libraries to rural areas

5.  Reduce or eliminate taxes related to internet access and devices

6.  Reduce gender gap and ICTs

1. Broadband commission:

1.  Prioritize supply and demand-side policies to full range of broadband infrastructure, applications and services

2.  Initiate and prioritize broadband planning process

3.  Invest in ICTs and digital skills as engine of growth

4.  Review and update regulatory frameworks to take into account evolving models

1. Expand private and public sector engagement, augment stakeholder community, recruit leaders from various sectors (civil society)
2. More regional cooperation initiatives to address lack of domestic political will (IGF Niger)
3. Microsoft:

1.  Openness to dialogue across partners institutions and organizations

2.  Inclusiveness of local actors aware of local needs

3.  Enabling environment for joint planning and execution

4.  Identification of socio-economic development opportunities and priorities

5.  Application of successful models across disciplines

1. Promote public-private partnerships for connecting remote regions (Telefonica)

Address unsolicited e-mail