Sovereignty in Cyberspace A study on Customary International Law on the Principle of Sovereignty

Abstract: The global expansion of the internet has enabled the emergence of a relatively new theatre of inter-state conflicts; the domain of cyberspace. The emergence of cyberspace poses great challenges to the territorial understanding of the world order and raises important questions about fundamental concepts of international law. Unlike operations in the more traditional domains, i.e. land, sea, and air, cyber operations are characterised by their ability to transcend and defy international borders with ease. Consequently, the emerging conduct within cyberspace is challenging the traditional understanding of the notion of territorial sovereignty. On the one hand, it is undisputed that the prohibition on the use of force and the principle of non-intervention apply to conduct in cyberspace. If the hacking into and manipulation of an air traffic tower’s control system results in a collision between two aircrafts and ensuing loss of life, the fact that the operation is carried out by cyber means – instead of a bombardment of the air traffic tower – does not prevent it from being categorised as an unlawful use of force. On the other hand, when it comes to cyber operations that fall foul of the use of force and non-intervention thresholds – so-called low-intensity cyber operations – there is disagreement as to whether these are prohibited as a matter of law. Against this backdrop, this thesis analyses the existence of a primary rule in customary international law that prohibits certain low-intensity cyber operations as violations of sovereignty. In doing so, the thesis investigates whether the principle of sovereignty in itself functions as a prohibitive primary rule of customary international law or whether it simply functions as an underlying principle from which other binding norms derive. The thesis concludes that there currently exists a primary rule in customary international law that prohibits certain low-intensity cyber operations as violations of sovereignty. It also identifies and analyses the practical benefits and risks of having this rule.