International Law in Cyberspace: the UK’s position

An insight into International Cyberspace Law by Georgia M. Griesbaum

In the Spring of 2020, Austria and the Czech Republic publicly upheld the idea that sovereignty is a fundamental international legal rule which naturally extends to cyberspace, further contrasting growing international consensus with the controversial position taken by the UK on this topic.

In May 2018, Jeremy Wright made a speech at Chatham House concerning the UK’s view on the applicability of international law in cyberspace. He stated that contrary to the sentiments of the international community, the principle of sovereignty cannot be extrapolated to include a specific rule or prohibition against “cyber activity”.

Importantly, his statement suggests that cyber operations falling below the threshold of prohibited intervention (i.e. are not coercive or do not infringe on the domainé reservé of a state) do not violate international law per se, given that sovereignty, in the UK’s view, is a principle rather than a rule.

Several ICJ (International Court of justice) judgments, as well as widespread opinio juris and state practice (elements which create customary international law), support the opposite position, namely that sovereignty exists as a primary rule of international law applicable to cyberspace. This position is further reflected in the Tallinn Manual 2.0, an expert study and a definitive guide to the legal aspects of cyber operations.

The UK’s unique position and its potential advantages and disadvantages, therefore, warrant discussion. Ultimately, the UK must have seen a significant advantage in a position that allows it to conduct a broad range of cyber operations into other states without the need for that state’s consent, and further giving itself a basis on which to argue that international law remained unviolated. The utility of this is magnified by the high threshold of acknowledged prohibited cyber intervention (e.g. coercive intervention).

Adopting this position, however, obliges the UK to forfeit the legal use of countermeasures, i.e. the ability to respond in either cyber or non-cyber ways, to cyber operations violating UK territory, in a legally acceptable way. Equally, diplomatic and political ramifications must not be overlooked.

The UK may face a potential loss of credibility from its allies and the international community when the UK condemns (as it frequently does) other states for conducting cyber operations which fall below the threshold of prohibited intervention. The UK’s controversial position will undoubtedly encourage debate in the following years and incentivize other states to state their own views on this evolving area of law.