This study examines the positions of European Union Member States (as of April 2024) on how international law applies in cyberspace. Of the 27 Member States, 13 have issued official national positions on the matter. The study is designed to identify commonalities and divergencies among them.
The authors have identified 13 international law topics that feature prominently in the national positions of EU Member States: sovereignty, due diligence, non-intervention, prohibition of the use of force, attribution, self-defence, countermeasures, plea of necessity, retorsion, human rights, international humanitarian law, peaceful settlement of disputes, and jurisdiction. They are grouped into four broad categories.
- Part I deals with the key international law obligations that regulate inter-State cyber operations in peacetime. Because a violation of these and other “primary rules” requires that the conduct be attributed to a State.
- Part II, the study addresses legal attribution based upon the so-called “secondary rules” of international law.
- Part III examines how States may lawfully respond to malicious cyber activity under international law.
- Finally, Member States have discussed certain specialised regimes of international law, such as international human rights law and international humanitarian law, in their national positions.
They have also touched on other matters of practical relevance, particularly the jurisdictional prerogatives of States in regulating cyber activities. Accordingly, an examination of these topics in Part IV concludes the study.
Ultimately, the study is designed to inform the feasibility of developing a common European Union position on how key international law rules regulate States’ cyberspace activities. It will help identify issues concerning which consensus among EU Member States can be easily achieved and those in which either differences of legal opinion or silence thereon may challenge progress in this regard.
