Summary

  • ITU’s 6 October interim report asks PP-26 to consider extending the full four-country assessment to a Council session in 2027; a related Council paper asks the Council to leave that timing decision to the conference.
  • The report is a public-information desk review, not a completed investigation: it identifies events so far in Bahrain and the UAE and says primary-source work is needed before final conclusions.

The calendar is now part of the record. In Contribution 70, the ITU Secretary-General submitted an interim report on the impact of attacks affecting civilian telecommunications and ICT infrastructure in Bahrain, Kuwait, the United Arab Emirates and Jordan. Its requested action asks PP-26 to consider the report and agree to extend delivery of the full report to the Council in 2027. The document is listed for the conference meeting that begins on 9 November.

A second paper frames the hand-off. Contribution 140, posted for the 2026 Council session on 7 October, asks Council to note the interim report and defer the decision on a 2027 extension to PP-26. ITU’s own Council summary says the report is intended for the final Council meeting on 7 November, PP-26 and later meetings as appropriate. These are proposed steps. As of 10 October, the papers do not show that the conference has approved an extension.

Resolution 1436, adopted by the ITU Council in 2026, sets the reporting mandate. It directs the Directors of the three Bureaux to monitor attacks on civilian telecommunications and ICT infrastructure in the four named countries and provide regular reports, including on implications for regional and global connectivity. The October submissions therefore concern both the evidence being assembled and the route by which the timetable will be decided.

The interim report describes its findings as preliminary and based on a literature review and desk research using publicly available material. It says the available information reviewed so far allowed the authors to identify related events in Bahrain and the UAE. The report also says additional direct impacts across the four-country scope may emerge as more sources, particularly primary sources, are added. That is a limit on what the current record establishes, not a finding that Kuwait or Jordan experienced no impact.

Its summary highlights preliminary effects involving data centres in Bahrain and the UAE, alongside vulnerability risks for submarine cables and the Internet backbone. The report separately treats media accounts of attacks on telecom-provider offices as unvalidated: it says public details are insufficient to assess the events and damage, so further evidence collection is planned. Risk, a reported incident and an assessed impact remain different evidence states.

The stated next steps include interviews with relevant stakeholders in the four countries, qualitative and quantitative analysis, a possible Post-Disaster Needs Assessment approach, completion of the review of impacts on ITU programmes, and a full report to Council in 2027 if the relevant bodies consider that appropriate. The immediate decision is narrower: whether PP-26 accepts the proposed extension. It does not decide attribution or turn the interim assessment into a final damage account.

Sources