Abstracts Law

The principle of sovereignty and state cyber operations

by Jack Kenny

Cyber operations possess unique attributes that pose significant challenges for the application of international law. While there is widespread agreement among states that, in principle, international law applies to state cyber operations, considerable uncertainty remains over how international law applies to cyber operations that fall below the threshold of a use of force, effectively resulting in so-called “grey zones” where the application of rules is unsettled. Principally, this leads to the question of how the principle of sovereignty, as well as its derivative rules and related obligations of conduct, specifically the principle of non-intervention and due diligence obligations, may govern state cyber operations. This thesis argues that it is not possible to extrapolate a customary international law “rule of sovereignty” with a cyber-specific application from the principle of sovereignty under existing international law. Proposals for the formation of a cyber-specific customary international law “rule of sovereignty” featuring precise content tailored to the technical attributes of cyberspace to delineate criteria to determine its violation therefore constitute the further development of norms, requiring both state practice and opinio juris to crystallise. There currently exists a significant body of contrary state practice and insufficient opinio juris to support the development of such a rule. The thesis argues that the principle of non-intervention is capable of a broad application where coercion requires a degree of pressure to deprive the target state of control of its state functions, challenging the understanding that mere influence alone is not capable of being coercive and therefore may not qualify as a prohibited intervention. Finally, the thesis demonstrates that due diligence obligations are anchored in primary rules that are developed by states to apply in certain areas of activity, and that the current position of states is clear in determining that they are under no binding obligations in relation to cyber operations.