A/76/136
UN. These obligations – and the UN Charter in its entirety – apply in cyberspace as
they do in the physical realm.
The obligation to seek peaceful settlement of disputes does not impinge upon a
State’s inherent right to act in individual or collective self-defence in response to an
armed attack. This right applies equally in the cyber domain as it does in the physical
realm.
The UN Charter (Article 33) applies to international disputes involving cyber
activities, the continuance of which are likely to endanger the maintenance of
international peace and security. States are required to seek the settlement of such
disputes by peaceful means such as negotiation, enquiry, mediation, conciliation,
arbitration, judicial settlement, and resort to regional agencies or arrangements, or
other peaceful means of their own choice.
Resolution of a cyber dispute consistent with Chapter VI of the UN Charter
(Pacific Settlement of Disputes) could include the parties referring the matter to the
International Court of Justice. This would require that the necessary preconditions be
met, including that the matter is admissible and that the Court has jurisdiction to hear
it.
The UN Security Council may exercise its powers and responsibilities under
Chapter VI and Chapter VII (Action with Respect to Threats to the Peace, Breaches
of the Peace, and Acts of Aggression) of the UN Charter with respect to cyber
activities endangering international peace and security.
In determining whether a cyber activity constitutes a use of force, States should
consider whether the activity’s scale and effects are comparable to traditional kinetic
operations that rise to the level of use of force under international law. This involves
a consideration of the intended or reasonably expected direct and indirect
consequences of the cyber activity, including for example whether the activity could
reasonably be expected to cause serious or extensive (‘scale’) damage or destruction
(‘effects’) in the form of injury or death to persons, or damage or destruction
(including to their functioning) to objects or critical infrastructure.
Harmful conduct in cyberspace that does not constitute a use of force may
constitute a breach of the duty not to intervene in the internal or external affairs of
another State. This obligation is encapsulated in Article 2(7) of the Charter and in
customary international law.
A prohibited intervention is one that interferes by coercive means, either directly
or indirectly, in matters that a State is permitted by the principle of State sovereignty
to decide freely. Such matters include a State’s economic, political, social and cultural
systems and foreign policy. Coercive means are those that effectively deprive or are
intended to deprive the State of the ability to control, decide upon or govern matters
of an inherently sovereign nature.
The use by a State of cyber activities to prevent another State from holding an
election, or manipulate the electoral system to alter the results of an election in
another State, intervene in the fundamental operation of Parliament, or significantly
disrupt the functioning of a States’ financial systems would constitute a violation of
the principle of non-intervention.
A use of force will be lawful when the territorial State consents, when it is
authorised by the Security Council under Chapter VII of the UN Charter, or when it
is taken pursuant to a State’s inherent right of individual or collective self-defence in
response to an armed attack, as recognised in Article 51 of the Charter.
Australia considers that the thresholds and limitations governing the exercise of
self-defence under Article 51 apply in respect of cyber activities that constitute an
21-09670
5/142