The Application of International Law to
State Activity in Cyberspace
Introduction
1.
New Zealand supports an international rules-based system that promotes an open, secure, stable, accessible
and peaceful online environment and encourages responsible state behaviour in cyberspace.
2. Recent advances in cyber capability and a rise in malicious activity online raise novel questions about how
international law applies to state activity in cyberspace. These questions have been considered in a number of
contexts, including by states, by the United Nations Group of Governmental Experts on Advancing Responsible
State Behaviour in Cyberspace in the Context of International Security (and its precursors), by the United Nations
Open-Ended Working Group on Developments in the Field of Information and Telecommunications in the Context
of International Security, and by experts, including in the Tallinn Manual process and through a series of Oxford
Statements on International Law Protections. In order to facilitate broader and deeper consensus on these issues,
this statement sets out New Zealand’s position on how international law applies to state activity in cyberspace.
International law applies online as it does offline
3. International law applies online as it does offline. Applicable international law includes: the United Nations
Charter; the law of state responsibility; international humanitarian law; and international human rights law.
4. While there is consensus amongst states that international law applies to state activity in cyberspace, the
question of how it applies is nuanced. Activities in cyberspace involve, at least:
a.
A human component: the real people operating in the physical world, some of whom may be state agents
or acting on the instructions of, or under the direction or control of, a state, and who use and misuse
information and communications technology (ICT).
b.
A tangible, physical component: the cyber infrastructure and hardware physically located in the sovereign
territory of a state.
c.
An intangible, virtual component: the data, operating systems, software, information and content of
cyberspace. These elements can operate with a transboundary character, including through
cyber personas.
5. As international law has evolved primarily with a territorial, physical conception of the world, care is required
to apply the established rules and principles of international law appropriately to the multi-layered context of
cyberspace. Applied appropriately, existing international law – as part of the framework of responsible state
behaviour in cyberspace – provides an effective toolkit to regulate state behaviour online. This includes the
ability to identify breaches of international law in cyberspace, attribute state responsibility for those breaches,
and guide responses from victim states.
Use of Force
6. The United Nations Charter and customary international law rules concerning the use of force apply to state
activity in cyberspace. Relevant obligations include:
7.
a.
the requirement to settle disputes by peaceful means;
b.
the prohibition on the threat or use of force against the territorial integrity or political independence of any
state, or in any other manner inconsistent with the purposes of the United Nations ; and
c.
the right of self-defence against an imminent or ongoing armed attack.
State cyber activity can amount to a use of force for the purposes of international law. Whether it does in any
given context depends on an assessment of the scale and effects of the activity. State cyber activity will amount
to a use of force if it results in effects of a scale and nature equivalent to those caused by kinetic activity which