ARF

The ARF first formally recognised the importance of cyber confidence-building in 2012, when Ministers highlighted the need for measures to reduce the risks of misunderstanding, escalation, and conflict arising from the use of information and communication technologies (ICTs).

In 2015, the ARF adopted its first Work Plan on Security of and in the Use of ICTs. Unlike other organisations that have negotiated a defined set of cyber CBMs, the ARF chose a different approach. Rather than establishing a catalogue of individual measures, the Work Plan provides a framework for activities aimed at promoting transparency, cooperation, confidence-building, information-sharing, capacity-building, and responsible state behaviour in cyberspace.

Implementation within the ARF differs significantly from other cyber CBM frameworks. Activities are developed and sponsored by participating states, with implementation largely taking place through workshops, expert meetings, dialogue formats, and information-sharing initiatives.

As a result, workshops have become the principal mechanism through which cyber CBMs are implemented. Since the adoption of the Work Plan, participating states have organised regular activities on topics such as confidence-building measures, norms of responsible state behaviour, cyber incident response, critical infrastructure protection, and capacity-building.

One of the most significant institutional outcomes has been the establishment of the ARF Points of Contact (PoC) Directory, which remains the forum's most durable and operational cyber confidence-building mechanism.

The ARF's implementation model reflects a deliberate emphasis on dialogue and consensus-building. While this approach may produce fewer tangible outputs than some other regional organisations, it provides opportunities for sustained engagement and confidence-building among a highly diverse group of participants.

The ARF's broad membership is both one of its greatest strengths and one of its main challenges. The forum brings together countries with different political systems, strategic interests, levels of cyber maturity, and perspectives on cybersecurity. This diversity makes the ARF a valuable venue for dialogue but can also make consensus difficult to achieve.

As a result, implementation has often progressed slowly. Proposed activities require broad agreement, and geopolitical tensions have at times limited the forum's ability to move initiatives forward. External events, including the COVID-19 pandemic, have further affected implementation efforts.

Compared to other regional organisations, the ARF is also relatively lightly institutionalised. While the ASEAN Secretariat hosts an ARF Unit, implementation largely depends on the initiative and engagement of participating states rather than dedicated institutional support structures.

• The ARF pursues a distinctive cyber CBM model based on a Work Plan rather than a fixed catalogue of explicitly formulated CBMs.

• Workshops, dialogue, and information-sharing are the primary mechanisms for implementation.

• The ARF’s broad and diverse membership creates unique opportunities for confidence-building but can also slow decision-making and implementation.

• The Points of Contact Directory represents the forum’s most institutionalised cyber CBM.

• The ARF illustrates that dialogue and sustained engagement can themselves be important outcomes of cyber confidence-building.