Report Summary: Low-Intensity Cyber Operations and State Sovereignty in Cyberspace

Low-Intensity Cyber Operations and State Sovereignty in Cyberspace
By Kevin Jon Heller

Despite the final report of the United Nations Open-Ended Working Group on Security of and in the Us eof Information and Communication Technologies (OEWG) affirming that international law applies to cyberspace, there remains great difference of opinion among states on how exactly international law applies to cyberspace and what operations international law prohibits. Much of the difference centers around the legality of ‘low-intensity’ cyber operations, the most common form of cyber operatives. Such operations involve the penetration of a computer system located on the territory of another state without the use of force or prohibited intervention. Because of their low costs and high utility, low-intensity cyber operations, including counterterrorism efforts and espionage, are increasingly common.

This report analyzes three competing positions on low-intensity cyber attacks, contrasting the varying degrees to which they consider low-intensity attacks as violations of the sovereignty of the territorial state:

1. Sovereignty as a Principle: According to this position, low-intensity cyber operations are never wrongful because sovereignty is a principle of international law rather than a rule that can be violated. This position is held solely by the UK.
2. Pure Sovereignty: This position says that low-intensity operations are always wrongful because sovereignty is a primary rule of international law. Any non-consensual penetration of a computer system located on the territory of another state is an unlawful violation of this rule. This position is strongly supported by France.
3. Relative Sovereignty: Although sovereignty is a primary rule of international law, only low-
   intensity cyber operations that cause physical damage or harm the cyberinfrastructure of a
   territory are wrongful. This position is supported by states such as the Netherlands, the Czech Republic, and since 2021, somewhat by the United States.

The report provides a comprehensive analysis of these three positions and the states that support them. It is largely dismissive of the ‘sovereignty as a principle’ position while providing a legal comparison of the two positions that consider sovereignty a rule. It concludes that ‘pure sovereignty’ has a much stronger legal foundation in general international law. It considers which position Denmark should take, considering that it is a small, technologically advanced country which would favor the ‘pure sovereignty’ position. The report concludes by providing considerations for Danish policymakers, recommending that Denmark issue a public statement concerning whatever position it adopts, in the interest of helping to shape international law.

Read more here.