Compare
Compare
Thanks to its regulatory powers, robust digital economy, and active foreign and security policy, the European Union is one of the key players in cyberspace. The EU strongly promotes the position that international law, and in particular the United Nations (UN) Charter, applies in cyberspace. As a complement to binding international law, the EU endorses the voluntary non-binding norms, rules and principles of responsible State behaviour that have been articulated by the UN Group of Governmental Experts. It also encourages the development and implementation of regional confidence building measures, both in the Organisation for Security and Co-operation in Europe and other regions. On a bilateral level, the EU has established cyber dialogues with strategic partners to reinforce the exchange of good practices, lessons learnt and further the idea of responsible state behaviour in cyberspace.
Japan is a trusted partner and shares the same basic values of human rights, rule of law, and democratic governance. This common set of values also applies to cyberspace as both the EU and Japan have publicly expressed strong support for an open, free and secure internet and the application of international norms to state activities in cyberspace. Japan is also an important trading partner of the EU. The recently adopted Economic Partnership Agreement also reinforces the need for a closer integration of the digital economies. Alignment in broader international economic and political issues is also evident in the field of cyber diplomacy and thus constitutes a strong foundation for close cooperation and partnership.
The United Kingdom ranks 10th in the 2021 Network Readiness Index (NRI), 9th in the 2021 Digital Skills Gap Index and 14th in the 2021 IMD World Digital Competitiveness Ranking. The British digital sector contributes roughly £149 billion each year to the economy and employs more than 1.5 million people [x]. The country also remains Europe’s unofficial ‘start-up capital’, with British tech startups attracting more than $15 billion in venture capital investment in the midst of a global pandemic. Nevertheless, new and emerging challenges to peace and security in cyberspace represent pressing concerns for the UK [x]. Over the course of 2021, the UK’s National Cyber Security Centre dealt with 777 significant incidents, with around 20% of supported organisations being linked to the health sector and Covid vaccines [x]. In the face of ever-increasing cyber vulnerabilities, the UK government has recently adopted a strategy of ‘levelling up’ protection for British cyberspace. This has brought international collaboration on cyber issues to the forefront of Britain’s diplomatic agenda. British diplomacy has traditionally championed the rules-based international system both online and offline, placing great emphasis on human rights, democratic values and free trade.
Under the auspices of the UN, the EU and its Member States have consistently reaffirmed that a universal cyber security framework can only be grounded in existing international law, including the Charter of the United Nations in its entirety, international humanitarian law, and international human rights law.
Addressing issues as to how existing international law and international humanitarian law, including the principles of humanity, necessity, proportionality and distinction, apply to the use ICTs by States is necessary to increase accountability and transparency. International humanitarian law is fully applicable in cyberspace and this should not be misunderstood as legitimising the use of force between states in the cyber domain. The EU has typically opposed calls for the need to adapt existing international law as a means to develop a new legal instrument for cyber issues. Japan has highlighted the importance of promoting the rule of law in cyberspace, noting that cyberspace “should not be a lawless zone”. It further endorses the applicability of international law, in particular the UN Charter, in the cyber domain. In relation to the use of countermeasures, it has stated that it is not necessary for countermeasures to be limited to the same means as internationally wrongful acts.
Japan has cautioned against the launch of “premature” discussions on developing a legally binding new instrument, arguing that the adoption of such an instrument might “roll back” the achievement of past multilateral efforts in confirming the applicability of existing international law in cyberspace. Instead, Japan believes that it is necessary to consolidate, elaborate, and clarify the interpretation of existing treaties and content of customary international law.
During the drafting phase of the 2021 Open-Ended Working Group (OEWG) Report, Japan had proposed to include language explicitly affirming the applicability of State responsibility for internationally wrongful acts, the inherent right of self-defence recognized under the UN Charter, and International Humanitarian Law. The UK views international law as “a critical tool for ensuring stability and security in cyberspace”. In accordance with the 2013, 2015 and 2021 UNGGE reports as well the 2021 OEWG report, the UK has affirmed that international law, including the UN Charter in its entirety, applies in cyberspace; a position paper notably states that “we do not consider it is for States to pick and choose which international law instruments are applicable”. This includes the prohibition of the use of force (Article 2(4)), the peaceful settlement of disputes (Article 33) and the inherent right of states to act in self-defence in response to an armed attack (Article 51). The law of state responsibility applies to cyber operations in peacetime, including the doctrine of countermeasures in response to internationally wrongful acts. Meanwhile, the country has professed a strong commitment to the respect of human rights law in cyberspace, co-sponsoring the 2012, 2014, 2016, 2018 and 2021 UN Human Rights Council resolutions on the protection, promotion and enjoyment of human rights on the Internet. Likewise, the UK believes in the application of international humanitarian law (IHL) to cyber operations in armed conflict. In response to concerns expressed by other states that this might lead to an undue ‘militarisation’ of cyberspace, the UK has responded that the application of IHL does not encourage armed conflict but only serves to limit humanitarian consequences in the event of such conflict. In addition, the country has stated and that there are ways for cyber capabilities to be developed in a manner “consistent with international law” and called on states to be transparent about the existence of their own capabilities. Those statements do not entirely dismiss the idea of cyberspace as a new military domain, with the British position at the OEWG being that “the use of ICTs in military contexts may be preferable to use of kinetic weapons and can be de-escalatory”. The UK is against the establishment of new, binding international instruments to regulate state behaviour in cyberspace, arguing that “pursuing […] the development of new treaties is only likely to entrench existing divides in this area and will progress us no further on the question of how International Law applies”.
Addressing issues as to how existing international law and international humanitarian law, including the principles of humanity, necessity, proportionality and distinction, apply to the use ICTs by States is necessary to increase accountability and transparency. International humanitarian law is fully applicable in cyberspace and this should not be misunderstood as legitimising the use of force between states in the cyber domain. The EU has typically opposed calls for the need to adapt existing international law as a means to develop a new legal instrument for cyber issues. Japan has highlighted the importance of promoting the rule of law in cyberspace, noting that cyberspace “should not be a lawless zone”. It further endorses the applicability of international law, in particular the UN Charter, in the cyber domain. In relation to the use of countermeasures, it has stated that it is not necessary for countermeasures to be limited to the same means as internationally wrongful acts.
Japan has cautioned against the launch of “premature” discussions on developing a legally binding new instrument, arguing that the adoption of such an instrument might “roll back” the achievement of past multilateral efforts in confirming the applicability of existing international law in cyberspace. Instead, Japan believes that it is necessary to consolidate, elaborate, and clarify the interpretation of existing treaties and content of customary international law.
During the drafting phase of the 2021 Open-Ended Working Group (OEWG) Report, Japan had proposed to include language explicitly affirming the applicability of State responsibility for internationally wrongful acts, the inherent right of self-defence recognized under the UN Charter, and International Humanitarian Law. The UK views international law as “a critical tool for ensuring stability and security in cyberspace”. In accordance with the 2013, 2015 and 2021 UNGGE reports as well the 2021 OEWG report, the UK has affirmed that international law, including the UN Charter in its entirety, applies in cyberspace; a position paper notably states that “we do not consider it is for States to pick and choose which international law instruments are applicable”. This includes the prohibition of the use of force (Article 2(4)), the peaceful settlement of disputes (Article 33) and the inherent right of states to act in self-defence in response to an armed attack (Article 51). The law of state responsibility applies to cyber operations in peacetime, including the doctrine of countermeasures in response to internationally wrongful acts. Meanwhile, the country has professed a strong commitment to the respect of human rights law in cyberspace, co-sponsoring the 2012, 2014, 2016, 2018 and 2021 UN Human Rights Council resolutions on the protection, promotion and enjoyment of human rights on the Internet. Likewise, the UK believes in the application of international humanitarian law (IHL) to cyber operations in armed conflict. In response to concerns expressed by other states that this might lead to an undue ‘militarisation’ of cyberspace, the UK has responded that the application of IHL does not encourage armed conflict but only serves to limit humanitarian consequences in the event of such conflict. In addition, the country has stated and that there are ways for cyber capabilities to be developed in a manner “consistent with international law” and called on states to be transparent about the existence of their own capabilities. Those statements do not entirely dismiss the idea of cyberspace as a new military domain, with the British position at the OEWG being that “the use of ICTs in military contexts may be preferable to use of kinetic weapons and can be de-escalatory”. The UK is against the establishment of new, binding international instruments to regulate state behaviour in cyberspace, arguing that “pursuing […] the development of new treaties is only likely to entrench existing divides in this area and will progress us no further on the question of how International Law applies”.
Since 2014, the EU’s ambition has been to act as an ‘honest broker’ on multilateral discussions surrounding issues of cyber governance and norms of responsible state behaviour, aiming to ensure the support and partnership of proactive players in the context of the global debate. The EU has long promoted the need for voluntary, non-binding norms. It believes that norms crystallised under the UN GGE process should generally not be revisited and that progress should be made on matters relating to their implementation.
Within the OEWG, the EU advanced a suggestion to develop a global repository of existing practice within the United Nations, which would enable UN member states to showcase how they are implementing the voluntary norms of responsible state behaviour, confidence building and other measures. In multilateral fora, Japan has frequently emphasised the need to implement voluntary and non-binding norms of responsible state behaviour in cyberspace. The country believes that any discussion on norm-building should exclusively occur on the basis of the 11 norms affirmed within the 2015 UNGGE Report; possible new norms should be “carefully scrutinised” so as to avoid any change to these 11 norms or duplication with them.
Japan also strongly opposes the adoption of additional legally binding obligations, maintaining that such an endeavour would take a very long time whereas the evolution of technology is extremely fast-paced. Instead, countries should work on parallel mechanisms for capacity-building, raising awareness, and promoting a common understanding of norms. The UK regards voluntary, non-binding norms of responsible state behaviour as one of the three key pillars upon which the framework for international stability in cyberspace is currently built, the other two being international law and confidence-building measures (CBMs). The British have argued that “stronger awareness and understanding by all countries of the framework in general” is necessary and stated that they “remain concerned that the elaboration of new norms could undermine the existing norms by weakening the overarching protection they provide, or their technology neutral and ‘future-proofed’ nature”. The focus should instead be on the universalisation, operationalisation and implementation of existing norms, with regional organisations and capacity-building efforts playing a central role in this endeavour.
Within the OEWG, the EU advanced a suggestion to develop a global repository of existing practice within the United Nations, which would enable UN member states to showcase how they are implementing the voluntary norms of responsible state behaviour, confidence building and other measures. In multilateral fora, Japan has frequently emphasised the need to implement voluntary and non-binding norms of responsible state behaviour in cyberspace. The country believes that any discussion on norm-building should exclusively occur on the basis of the 11 norms affirmed within the 2015 UNGGE Report; possible new norms should be “carefully scrutinised” so as to avoid any change to these 11 norms or duplication with them.
Japan also strongly opposes the adoption of additional legally binding obligations, maintaining that such an endeavour would take a very long time whereas the evolution of technology is extremely fast-paced. Instead, countries should work on parallel mechanisms for capacity-building, raising awareness, and promoting a common understanding of norms. The UK regards voluntary, non-binding norms of responsible state behaviour as one of the three key pillars upon which the framework for international stability in cyberspace is currently built, the other two being international law and confidence-building measures (CBMs). The British have argued that “stronger awareness and understanding by all countries of the framework in general” is necessary and stated that they “remain concerned that the elaboration of new norms could undermine the existing norms by weakening the overarching protection they provide, or their technology neutral and ‘future-proofed’ nature”. The focus should instead be on the universalisation, operationalisation and implementation of existing norms, with regional organisations and capacity-building efforts playing a central role in this endeavour.
The EU places great importance on cyber resilience and capacity building. Internally, the Union has built a robust legal acquis in relation to the resilience of critical infrastructures, the cornerstone of which rests upon the 2016 Network and Information Security (NIS) Directive and the 2013 and 2019 Cybersecurity Acts. This legal meshwork seeks to integrate cybersecurity into all elements of the supply chain and introduce soft law mechanisms like the EU cybersecurity certification scheme. In doing so, it harmonises national cybersecurity capabilities, cross-border collaboration and the supervision of critical sectors across the EU.
In the coming months, the Commission intends to add upon the existing cyber-acquis by introducing an array of new initiatives, such as the updated NIS Directive (the so-called NIS2), a proposal on a Critical Entities Resilience (CER) Directive, and a plan to launch a network of Security Operations Centres across the Union. The aim is to create a Union-wide ‘cybersecurity shield’ that will facilitate the detection of cyberattacks and provide an impetus for proactive action.
This internal buildup of capabilities is supplemented by the development of a specialised ‘cyber diplomacy toolbox’ that allows the Union and its Member States to address cyber incidents through various joint policies, from cooperation and stabilisation measures to restrictive measures and attribution. Resilience constitutes one of the central objectives of Japan’s 2018 Cybersecurity Strategy, whose core components include international cooperation in sharing expertise and coordination of policies, incidence response, and cyber capacity-building (CCB). Japan has traditionally argued that global initiatives are required to reduce cybersecurity vulnerabilities and has advocated for a tailor-made approach that takes into account the national situation of recipient countries and the importance of national ownership.
Japan recognises the ‘trickle-up’ effect of national initiatives, stating that CCB “not only improves the capabilities of the recipient country, but also directly leads to enhanced security and stability in cyberspace as a whole”; in that sense, it disfavours the understanding of CCB as a “common but differentiated responsibility”, believing that such a view “does not fit the context” of international cyber cooperation. As a result, the country has assumed a balanced approach to CCB. On the one hand, it has successfully utilised multilateral fora such as the G7 and G20 summits to promote its own normative standards.
At the G7 Ise-Shina Summit in May 2016, for instance, Japan introduced the Ise-Shima Principles, which included the enhancement of cooperation on CCB. On the other hand, Japan considers its own security and that of its nationals as intrinsically tied to the cyber capabilities of developing countries, since attacks on the IT infrastructure of regional partners can adversely affect Japanese trade. Japan has thus acted primarily through ASEAN to promote regional capacity-building efforts. The July 2021 policy paper on Global Britain in a Competitive Age makes extensive reference to resilience in the post-Covid ICT environment, pledging that the UK will “strengthen global resilience” and “ensur[e] that more resilient countries worldwide can come together through stronger international institutions to act on the most pressing shared challenges”. In the cyber domain, this pledge has been further operationalised by the 2022 National Cyber Strategy, which frames cyber resilience in terms of risk awareness, system security and preparedness. The Strategy prioritises capacity building, adopting a whole-of-government approach and focusing on three elements: protecting critical international supply chains and infrastructure, advancing the secure use of digital technologies and working with industry partners and academia. Since 2016, the UK has worked through the National Cyber Security Centre (NCSC) to adopt an integrated approach to cyber incident management, streamlining across the public and private sectors. Meanwhile, Britain has championed
capacity-building assistance efforts abroad by providing advice, training and exercises and enabling the creation and maintenance of national Computer Security Incident Response Teams (CSIRTs). It has also provided funding to international capacity-building platforms, such as the Forum of Incident Response & Security Teams (FIRST) and the Americas CSIRT network. The UK has been working with partners within the OSCE to encourage the implementation of confidence-building measures (CBMs).
In the coming months, the Commission intends to add upon the existing cyber-acquis by introducing an array of new initiatives, such as the updated NIS Directive (the so-called NIS2), a proposal on a Critical Entities Resilience (CER) Directive, and a plan to launch a network of Security Operations Centres across the Union. The aim is to create a Union-wide ‘cybersecurity shield’ that will facilitate the detection of cyberattacks and provide an impetus for proactive action.
This internal buildup of capabilities is supplemented by the development of a specialised ‘cyber diplomacy toolbox’ that allows the Union and its Member States to address cyber incidents through various joint policies, from cooperation and stabilisation measures to restrictive measures and attribution. Resilience constitutes one of the central objectives of Japan’s 2018 Cybersecurity Strategy, whose core components include international cooperation in sharing expertise and coordination of policies, incidence response, and cyber capacity-building (CCB). Japan has traditionally argued that global initiatives are required to reduce cybersecurity vulnerabilities and has advocated for a tailor-made approach that takes into account the national situation of recipient countries and the importance of national ownership.
Japan recognises the ‘trickle-up’ effect of national initiatives, stating that CCB “not only improves the capabilities of the recipient country, but also directly leads to enhanced security and stability in cyberspace as a whole”; in that sense, it disfavours the understanding of CCB as a “common but differentiated responsibility”, believing that such a view “does not fit the context” of international cyber cooperation. As a result, the country has assumed a balanced approach to CCB. On the one hand, it has successfully utilised multilateral fora such as the G7 and G20 summits to promote its own normative standards.
At the G7 Ise-Shina Summit in May 2016, for instance, Japan introduced the Ise-Shima Principles, which included the enhancement of cooperation on CCB. On the other hand, Japan considers its own security and that of its nationals as intrinsically tied to the cyber capabilities of developing countries, since attacks on the IT infrastructure of regional partners can adversely affect Japanese trade. Japan has thus acted primarily through ASEAN to promote regional capacity-building efforts. The July 2021 policy paper on Global Britain in a Competitive Age makes extensive reference to resilience in the post-Covid ICT environment, pledging that the UK will “strengthen global resilience” and “ensur[e] that more resilient countries worldwide can come together through stronger international institutions to act on the most pressing shared challenges”. In the cyber domain, this pledge has been further operationalised by the 2022 National Cyber Strategy, which frames cyber resilience in terms of risk awareness, system security and preparedness. The Strategy prioritises capacity building, adopting a whole-of-government approach and focusing on three elements: protecting critical international supply chains and infrastructure, advancing the secure use of digital technologies and working with industry partners and academia. Since 2016, the UK has worked through the National Cyber Security Centre (NCSC) to adopt an integrated approach to cyber incident management, streamlining across the public and private sectors. Meanwhile, Britain has championed
capacity-building assistance efforts abroad by providing advice, training and exercises and enabling the creation and maintenance of national Computer Security Incident Response Teams (CSIRTs). It has also provided funding to international capacity-building platforms, such as the Forum of Incident Response & Security Teams (FIRST) and the Americas CSIRT network. The UK has been working with partners within the OSCE to encourage the implementation of confidence-building measures (CBMs).
The EU has been an early champion of the Budapest Convention signed under the auspices of the Council of Europe, given the overlapping membership of the two organisations. Much of the EU’s cyber diplomatic efforts have focused on promoting the Convention as the main instrument of choice for fighting cybercrime on a global level. EU member states have consistently opposed Russian bids for replacing this regime with another legal framework.
The Union is represented in the recently constituted Ad Hoc Committee established by UNGA resolution 74/247 by its Member States and is currently focused on ensuring that the process is inclusive, transparent, consistent with the progress of the UNGGE and OEWG processes, and committed to legal consistency. According to Japan’s 2018 Cybersecurity Strategy, the country is committed to “further [promoting] international partnership through international investigative cooperation and information sharing with international organisations, law enforcement agencies and security information agencies in foreign countries.”
Japan is a party to the Budapest Convention on Cybercrime and mutual assistance treaties (MLAT), voting against the Russian-sponsored UNGA resolution calling for a new binding cybercrime treaty. Japan has pursued dialogues related to cybercrime cooperation in the context of ASEAN, as well as on a bilateral basis with countries like the UK, USA, and Australia. According to the 2022 National Cyber Strategy, the UK is committed to promoting the Council of Europe’s Budapest Convention on cybercrime as the primary international instrument for inter-state cooperation, while simultaneously engaging constructively with the UN process to develop a new international cybercrime treaty that will sit comfortably alongside the Budapest regime. In terms of law enforcement, the UK has developed well established mechanisms through the National Cyber Crime Unit (NCCU), operating under the umbrella of the National Crime Agency (NCA). The NCCU is tasked with leading the operational response, coordinating activity across different stakeholders and providing specialist cyber support across the law enforcement domain. The NCA has also developed a network of international liaison officers, which regularly cooperate with Interpol and Europol. Bilateral cooperation with international partners occurs on the basis of the Budapest Convention and associated Mutual Legal Assistance Treaties (MLATs), which facilitate information sharing amongst signatory states. The UK has been an active participant – and has provided voluntary contributions – in the context of discussions for developing a Second Additional Protocol to the Convention to enhance the speed and efficiency of international evidence sharing; the Protocol will be opened for signature in May 2022. The UK has also provided capacity-building assistance to over 100 partner countries, especially in Eastern Europe, Southeast Asia and Africa.
The Union is represented in the recently constituted Ad Hoc Committee established by UNGA resolution 74/247 by its Member States and is currently focused on ensuring that the process is inclusive, transparent, consistent with the progress of the UNGGE and OEWG processes, and committed to legal consistency. According to Japan’s 2018 Cybersecurity Strategy, the country is committed to “further [promoting] international partnership through international investigative cooperation and information sharing with international organisations, law enforcement agencies and security information agencies in foreign countries.”
Japan is a party to the Budapest Convention on Cybercrime and mutual assistance treaties (MLAT), voting against the Russian-sponsored UNGA resolution calling for a new binding cybercrime treaty. Japan has pursued dialogues related to cybercrime cooperation in the context of ASEAN, as well as on a bilateral basis with countries like the UK, USA, and Australia. According to the 2022 National Cyber Strategy, the UK is committed to promoting the Council of Europe’s Budapest Convention on cybercrime as the primary international instrument for inter-state cooperation, while simultaneously engaging constructively with the UN process to develop a new international cybercrime treaty that will sit comfortably alongside the Budapest regime. In terms of law enforcement, the UK has developed well established mechanisms through the National Cyber Crime Unit (NCCU), operating under the umbrella of the National Crime Agency (NCA). The NCCU is tasked with leading the operational response, coordinating activity across different stakeholders and providing specialist cyber support across the law enforcement domain. The NCA has also developed a network of international liaison officers, which regularly cooperate with Interpol and Europol. Bilateral cooperation with international partners occurs on the basis of the Budapest Convention and associated Mutual Legal Assistance Treaties (MLATs), which facilitate information sharing amongst signatory states. The UK has been an active participant – and has provided voluntary contributions – in the context of discussions for developing a Second Additional Protocol to the Convention to enhance the speed and efficiency of international evidence sharing; the Protocol will be opened for signature in May 2022. The UK has also provided capacity-building assistance to over 100 partner countries, especially in Eastern Europe, Southeast Asia and Africa.
