On June 11, 2026, the UN Institute for Training and Research (UNITAR) opened its first dedicated cybersecurity office in Riyadh — its third worldwide after Hiroshima and Bonn — in partnership with Saudi Arabia's National Cybersecurity Authority (NCA). UNITAR Executive Director Michelle Gyles-McDonnough and NCA Governor Majed Al-Mazyed launched the office with a mandate spanning training, research, policy development, and global knowledge exchange (Arab News). It is a meaningful institutional endorsement, and it deserves to be read on its merits before it is read for its risks.
The case for Riyadh, made fairly
The strongest argument for placing a UN cyber-capacity hub in Saudi Arabia is that the Kingdom has actually built the thing UNITAR exists to teach. This is not a vanity posting. Saudi Arabia placed first in the cybersecurity indicator of the IMD World Competitiveness Yearbook 2025, and was rated a Tier 1, "role-modelling" nation in the most recent UN International Telecommunication Union (ITU) Global Cybersecurity Index (Arab News). The ITU index assesses states across five pillars — legal, technical, organisational, capacity-development, and cooperative measures (ITU). Saudi Arabia scores well precisely because, since the NCA's creation in 2017, it has done the unglamorous institutional work: a single national reference authority, binding controls for critical sectors, and sustained budget.
The economic record reinforces the point. The NCA's Key Economic Indicators report put the domestic cybersecurity market at about $4.05 billion in 2024, up 14% year-on-year, contributing roughly SR18.5 billion to GDP. The specialist workforce passed 21,000 — a 9% annual rise — and women now make up 32% of it, above the 24% global average (Zawya). Independent forecasters expect the market to reach $7.81 billion by 2031 at a 9.4% compound growth rate (MarketsandMarkets). For a region long dependent on imported security expertise, a sovereign talent base — and one that out-performs the global benchmark on gender — is exactly the kind of capability the developing world needs more of, not less.
From a pro-innovation standpoint, much of the Saudi model is genuinely worth exporting. Concentrating cybersecurity authority in one competent regulator reduces the compliance maze that fragments policy in larger federal systems. Tying capacity-building to a fast-growing private market, rather than to permanent state spending, is the right structural choice. And the South-South knowledge transfer UNITAR envisions — training officials from countries that cannot fund their own programmes — is a public good that neither markets nor lone governments reliably supply.
Where the model strains
The difficulty is that "cybersecurity" in a state with weak speech protections is an elastic concept, and the same institutional muscle that hardens critical infrastructure can be turned on lawful expression. The evidence is contemporaneous, not hypothetical. In a coalition statement on May 20, 2026, ALQST, Democratic Diwan, Access Now and others reported that Meta had geo-blocked the Facebook and Instagram accounts of independent NGOs, researchers and human-rights defenders from audiences inside Saudi Arabia and the UAE — more than 100 pages and accounts restricted since March 2026, several explicitly at the Saudi government's request (ALQST / Access Now). The Kingdom has separately asked X to geo-block prominent activists.
This is the unresolved tension a UN imprimatur cannot wish away. Cybersecurity capacity-building is legitimate and badly needed; using platform leverage to silence diaspora critics is censorship by another name. When the two flow from the same national authority, the institutional prestige earned by the first risks laundering the second. UNITAR's mandate covers "policy development" — and policy is exactly where the line between protecting networks and controlling information gets drawn.
The proportionate path
The right response is neither to deny that Saudi Arabia has built real expertise nor to pretend a UN office sterilises the politics around it. It is to insist that capacity-building and content control be kept analytically and operationally separate. The internationally accepted frame already exists: under the International Covenant on Civil and Political Rights (Article 19), restrictions on expression must be legal, necessary and proportionate. A genuinely "role-modelling" cyber power would meet that standard, not just the ITU's technical pillars.
Concretely, that means UNITAR should publish the curriculum and governance terms of the Riyadh office so the world can see whether it teaches network defence or narrative management; it means the NCA's undisputed achievements in workforce and infrastructure should be the export, not its takedown requests; and it means platforms like Meta should disclose every geo-blocking order and resist those that target protected speech rather than genuine security threats.
The Riyadh office can be a net good for the open internet — spreading the defensive skills that keep hospitals and grids online across under-resourced states. But its legitimacy will be measured less by where it sits than by whether the model it teaches protects users from attackers without also protecting governments from criticism.