Summary

  • Resolution 1436 instructed ITU officials to monitor attacks and assess effects on infrastructure, services and ITU programmes, with reports for PP-26 and the Council’s final 2026 meeting.
  • The October interim paper is based on desk research and says interviews and primary-source work remain. A separate Secretary-General contribution asks PP-26 to move the full report to 2027; the request is still awaiting a decision.

The ITU’s first public accounting under Resolution 1436 leaves a clear question for its November conference: what will count as a completed assessment of attacks on communications infrastructure in Bahrain, Kuwait, the United Arab Emirates and Jordan?

The May resolution gave the organization a defined task. It told the directors of the three ITU Bureaux to monitor and report regularly on attacks against telecommunications and ICT infrastructure in the four states, assess effects on services and ITU programmes, and consider regional and global connectivity. It also instructed the Secretary-General to coordinate the work and provide a damage assessment for PP-26 and the Council’s final meeting on 7 November. The resolution calls for adequate financial and human resources to carry out the work. Resolution 1436 is therefore a reporting mandate with both a subject and a calendar.

The interim document, C26/140-E, is dated 5 October and appeared in the ITU’s public document system on 7 October. Its action paragraph asks the Council to note the report and defer to PP-26 a decision on extending the full report to the Council session in 2027. The paper says its results are preliminary and based on literature review and publicly available information. It says further data collection and analysis, including from primary sources, are needed. The interim report does not present an adopted extension.

A second document makes the decision point more explicit. In contribution S26-PP-C-0070, dated 6 October, the Secretary-General invites the Plenipotentiary Conference to agree to extend the full report’s submission to the Council session in 2027. PP-26 is the ITU’s highest policy-making body and is scheduled in Doha from 9 to 27 November; the final Council meeting of the 2026 session is set for 7 November. As of 12 October, the public record shows a request for a decision, not a decision already made. The contribution and the PP-26 schedule and mandate make that distinction visible.

The interim paper is also specific about how far its event record reaches. Based on the public information it reviewed, it identifies related events in Bahrain and the UAE. It says that as more data, particularly primary sources, are incorporated, further direct effects in the four countries may emerge. That wording does not establish that no incidents occurred in Kuwait or Jordan. It describes what the desk review could identify at that point.

Some examples show why an event list and an impact account are different products. The report describes service disruption at AWS regions in Bahrain and the UAE. Abu Dhabi Commercial Bank’s own 4 March notice says its retail mobile application and customer contact centre were disrupted for about 48 hours, while branches, ATMs, card services, web banking and business platforms stayed operational. The bank’s notice is evidence about its own services; it does not provide a region-wide count of affected customers or total losses. ADCB’s restoration notice and the ITU report support different parts of that account.

Other entries remain less settled. The report says media accounts described attacks on telecom service-provider premises, including facilities associated with Thuraya and du, but publicly available detail was insufficient to validate the events and the damage. It also cites a submission by Bahrain, Kuwait, the UAE and Jordan that reported strikes on a UAE submarine-cable landing station on 31 March and 6 April. The interim report says the effect of those strikes will be assessed in later work. A reported event, a verified asset impact and a measured service consequence are separate steps in the evidence chain.

Resolution 1436 also covers the ITU’s own programmes. The interim paper records the cancellation of the Global CyberDrill that had been planned for Dubai in May and postponements to 2027 for the Regional Development Forum for Arab States and the Arab Regional Policy and Regulatory Dialogue. ITU’s CyberDrill notice confirms the cancellation, and its Arab States events page lists the two postponements. These are tangible programme effects. They should be counted separately from physical damage to a telecom asset or loss of a customer service.

The report’s proposed next phase is practical: gather data from primary sources, including interviews with relevant stakeholders in all four countries; analyze it qualitatively and quantitatively; complete the assessment of ITU programme effects; and submit a full report to the Council in 2027 if the extension is agreed. The team says it may apply a Post-Disaster Needs Assessment framework. That remains a possible method, not a completed or adopted assessment. The UN Development Programme describes the PDNA approach as a coordinated, government-led way to assess damage, losses and recovery needs across sectors. Its PDNA guide gives a reference point for the method the ITU says it may use.

A useful final report would keep the evidence layers visible. For each event, it could identify the source and its status, the affected asset, the service observed, the time window, what was restored and what remains uncertain. Where organizations can provide it, the analysis could distinguish operational downtime from customer reach, migration cost and broader economic effects. That would let readers see which statements are confirmed by an operator or authority, which are based on open reporting, and which are still estimates.

There is a resource question as well. Resolution 1436 instructs the ITU to mobilize adequate financial and human resources. The interim paper’s action form says there are no additional financial implications for the Council action. That line does not show whether resources are already assigned to interviews and quantitative analysis; the public document does not spell out a work plan or staffing allocation. The gap is a question to answer, not proof that the assessment is unfunded.

The interim paper should be read for what it is: a status report that identifies early findings and names work still to do. Its candour helps. The next step is to make the proposed extension and the evidence plan equally legible. If PP-26 approves more time, the public record should say when primary interviews will occur, how the four-country scope will be covered, which indicators will be reported and when readers can expect updates.