on RCEP Security (& Cybersecurity) Exceptions: 1. RCEP basically reproduces GATT/GATS language, referring RCEP panels to interpretations developed in adopted WTO reports (RCEP 19.4.2); 2. Only two real additions: "national emergency" and "critical public infrastructure". 1/

3. The "critical public infrastructure" language incorporates a concern that many felt was missing without giving unconstrained leeway for governments to call all infrastructure "security-related": "critical" is likely to play a similar role to "essential" in preventing abuse.2/

4. The expression "national emergency" also sets a high bar, &presumably does not allow setting aside the agreement in case of any unrest or domestic challenge. (See "emergency" in Russia - Traffic in Transit, meaning "danger or conflict...pressing need...danger or disaster"). 3/

Conclusion: for trade, RCEP does not buy into the frenzy of securitized relations, where agreements would be nullified every time someone shouted "security". Exceptions are there, but (i) remain constrained scope-wise (i.e. no cybersecurity, food security, climate security...)4/

(2) retain a high bar for successful invocation; and (3) endorse the Russia - TiT competent addressing of the "which it considers" taboo, requiring an objective assessment of the connection between security interests, the conditions that threaten them, and the measures adopted.5/

Cybersecurity is more interesting. RCEP has two very different provisions on cyber security in its Electronic Commerce Chapter. One is a very bland provision encouraging the parties to cooperate. 6/

The other is, it seems, very close to an actual self-judging exception that does not allow "dispute" by other parties of security-driven server localization requirements. It is very constrained scope-wise, though, since the only obligation "in this Article" is paragraph 2. 7/

In sum: RCEP adopts a two-tier approach to security exceptions. For trade (in goods & services), the general WTO approach is maintained and the panel-shaped limitations are implicitly endorsed. For server localization, a self-judging, non-disputable security exception applies.