Sovereignty

Definition

Sovereignty

OPTION A Sovereignty is a core principle of international law. According to a widely accepted definition in the Island of Palmas arbitral award of 1928, [s]overeignty in the relations between States signifies independence. Independence in regard to a portion of the globe is the right to exercise therein, to the exclusion of any other State, the functions of a State. According to multiple declarations by the UN, NATO, OSCE, the European Union, and individual States, international law applies in cyberspace, and hence also the principle of sovereignty applies in cyberspace. It is the subject of some debate, however, to what extent this principle operates as a standalone rule of international law, the breach of which gives rise to state responsibility. For the proponents of this view, the prohibition on violating the sovereignty of other States is a substantive primary rule of international law. This view is at the basis of the analysis in the Tallinn Manual 2.0 and it has reportedly not been challenged by any of the over fifty States that participated in the process of consultations of the Manual in 2017. By contrast, the opposing view, originally formulated by the General Counsel of the US Department of Defense, considers that sovereignty is not "a binding legal norm, proscribing cyber actions by one State that result in effects occurring on the infrastructure located in another State, or that are manifest in another State". Rather, as further explained by two high-level US government legal advisors writing in their private capacity, it is "a principle of international law that guides state interactions". This view has since been endorsed by the UK attorney general. The remainder of this section proceeds on the basis of the former "sovereignty-as-rule" approach. Those espousing the latter "sovereignty-as-principle" approach should refer to the prohibition of intervention. It is understood that sovereignty has both an internal and an external component. In the cyber context, the "internal" facet of sovereignty entails that "[a] State enjoys sovereign authority with regard to the cyber infrastructure, persons, and cyber activities located within its territory, subject to its international legal obligations." As a general rule, each State must respect the sovereignty of other States. It is clear that a cyber operation with severe destructive effects, comparable to a "non-cyber" armed attack or a use of force against a State, constitutes a violation of its sovereignty; however, with more subtle cyber operations, the question is far from settled. The following modalities, highlighted in the Tallinn Manual 2.0, represent different ways of determining what a “sovereignty violation” might mean in the context of cyber operations: A State organ conducting cyber operations against a target State or entities or persons located there while physically present in the target State's territory violates the target State's sovereignty.  This was agreed by all Experts drafting the Manual; however, “a few” of the Experts thought that the extensive State practice carved out an exception for espionage operations. Causation of physical damage or injury by remote means; again, “a few” Experts took the position that this is a relevant but not a determinative factor by itself. Causation of a loss of functionality of cyber infrastructure: no consensus could be achieved as to the precise threshold (the necessity of reinstallation of operating system or other software was proposed but not universally accepted); Below this threshold, there was no agreement among the Experts whether operations that do not cause physical consequences or a loss of functionality qualify as a violation of sovereignty. Interference with data or services that are necessary for the exercise of "inherently governmental functions"; although the Experts could not conclusively define the term "inherently governmental functions", they agreed that, for example, the conduct of elections would so qualify. Usurpation of "inherently governmental functions", such as exercise of law enforcement functions in another State’s territory without justification. Attributing the relevant cyber operation to a State different from the target State is a necessary prerequisite for qualifying the cyber operation as a violation of the target State's sovereignty. OPTION B Sovereignty is a multifaceted concept and, as the International Court of Justice recognized recently, there are “many rules of international law which protect sovereignty in general”. In the territorial context, according to a widely accepted definition in the Island of Palmas arbitral award of 1928, [s]overeignty in the relations between States signifies independence. Independence in regard to a portion of the globe is the right to exercise therein, to the exclusion of any other State, the functions of a State.[26] Thus, “the first and foremost restriction imposed by international law upon a State is that – failing the existence of a permissive rule to the contrary – it may not exercise its power in any form in the territory of another State”. This may be termed as an obligation to respect another state’s territorial sovereignty or territorial integrity. It should be noted that an opposing view considers that sovereignty is "a principle of international law that guides state interactions, but is not itself a binding rule",[32] and in this regard does not consider that an obligation exists to respect territorial integrity, beyond the prohibitions of the use of force and intervention. It was originally formulated by two high-level US government legal advisors writing in their private capacity[33] and it has since been endorsed at least by the UK attorney general.[34] The remainder of this section proceeds on the basis of the former approach that there exists an independent obligation under international law to respect a state’s territorial integrity. Those espousing the latter "sovereignty-as-principle" approach should refer to the prohibition of intervention. Pursuant to the position that there exists an obligation under international to respect a state’s territorial integrity, there is likely to be little disagreement that this encompasses "the cyber infrastructure, persons, and cyber activities located within its territory, subject to its international legal obligations." [35]  Accordingly, it is clear that a cyber operation with severe destructive effects, comparable to a "non-cyber" armed attack or a use of force against a State, constitutes a violation of its territorial sovereignty. Additionally, a State organ conducting cyber operations against State A or entities or persons located there while physically present in State A’s territory violates the State’s territorial sovereignty.[37] Similarly, it would seem that causation of physical consequences by remote means would amount to a violation of sovereignty, though dissenting positions have been voiced. Whether espionage, involving physical presence of a person, constitutes a violation of sovereignty – and if so, under which circumstances – is a subject of ongoing scholarly disagreement.[38] As regards intangible, or virtual, layers of cyberspace, the question whether they are subject to a State’s territorial integrity is a subject of debate. This, of course, has implications for the question whether cyber operations involving intangible consequences can amount to violations of territorial integrity, and whether cyber activities involving virtual presence on cyber infrastructure in other States amounts to a violation of territorial integrity. Similarly, this has consequences for instances in which one may consider loss of functionality of cyber infrastructure as not involving physical consequences. On the one hand, the argument has been raised that, because ‘cyber infrastructure is property located on State territory’, it therefore follows that ‘cyber operations that interfere with a sovereign’s independent and exclusive control of territorial cyber infrastructure are prohibited’. Conversely, the territorial sovereignty of States over intangible layers of cyberspace has been rejected by others, for reasons such as: the difficulty for States to exercise effective control – effectivités – over such layers; the virtual nature of cyberspace which creates conceptual difficulties for placing such virtual layers under a legal framework which governs what may (not) be done vis-à-vis territory; and numerous media reports which – if true – would put much State practice at odds with an such an obligation. Finally, it should be noted that the Tallinn Manual 2.0 considered interference with data or services that are necessary for the exercise of "inherently governmental functions", as well as usurpation of "inherently governmental functions",  as violations of ‘sovereignty’[43] (although the Experts could not definitively define the term "inherently governmental functions").[44] Others have noted the paucity in State practice supporting this test, though all would agree it is necessary to see have State practice develops in this field.    Whether non-State actors can violate territorial sovereignty on their own is a matter of disagreement.