Appendix: International law in cyberspace
This is a translation of a document sent by the Government of the Kingdom of the Netherlands to
Parliament. No rights can be derived from this version, the original text is authoritative.
Introduction
In this appendix the government will discuss a number of significant obligations under international
law that apply to states in cyberspace. Any violation of these obligations that is attributable to a
state constitutes an internationally wrongful act, unless there is a ground for precluding the
wrongfulness of an act recognised in international law. 1
As the government has indicated on multiple occasions and consistently argues, international law is
applicable in cyberspace. This is also recognised internationally. 2 Nevertheless, there are still many
unanswered questions concerning the precise manner in which international law should be applied
in cyberspace. This is due to the unique characteristics of the digital world in comparison with the
physical world. Digital data generally moves rapidly and is therefore often difficult to localise. It can
be transferred to another country in a matter of seconds, and can be stored across a range of
different countries. What is more, undesirable activity in cyberspace does not necessarily always
have an immediate physical impact, even though its effects may nonetheless be serious. It is not
yet entirely clear how these and other unique characteristics should be dealt with in the application
of international law. The government is encouraging international debate on ways to clarify the
application of international law in cyberspace. Clarity and consensus on these points are essential to
the international legal order.
The formulation of responses to these questions is an ongoing process, in which the government
coordinates closely with like-minded partners and pursues initiatives aimed at furthering dialogue,
such as the international consultations on international law in cyberspace hosted by the Netherlands
in The Hague in late May 2019.
In this appendix the government will discuss a number of significant rules of international law that
apply to states in cyberspace. It also explains its interpretation of the application of those rules.
Where relevant, it indicates what issues are still the subject of international debate and need to be
elaborated further. The following topics will be considered in turn: the obligations of states in
cyberspace, the attribution of cyber operations, and options for responding to undesirable cyber
activity by another state. The government has taken the primary sources of international law defined
in article 38 of the Statute of the International Court of Justice as a starting point. This article refers,
inter alia, to international conventions, international custom and the general principles of law as
sources of international law.
Obligations of states
Respect for sovereignty
The principle of sovereignty, i.e. that states are equal and independent and hold the highest authority
within their own borders, is one of the fundamental principles of international law. 3 More specific
rules of international law, such as the prohibition of the use of force, the principle of non-intervention
and the right of self-defence stem from this principle. These rules will be discussed in more detail
below.
The responsibility of states and the grounds for precluding the wrongfulness of an act under international law
are laid down, inter alia, in the Articles on the Responsibility of States for Internationally Wrongful Acts
(ARSIWA), which is included in UN General Assembly resolution A/56/589. The commentary on the ARSIWA is
included in the Yearbook of the International Law Commission, 2001, vol. II, Part Two.
2
See, for example, the 2013 and 2015 reports of the Group of Governmental Experts on Developments in the
Field of Information and Telecommunications in the Context of International Security:
https://www.un.org/disarmament/ict-security/; EU Cybersecurity Strategy, 2017; NATO Summit Declarations
of 2014, 2016 and 2018.
3
Island of Palmas arbitral award of 1928: ‘Sovereignty in the relations between States signifies independence.
Independence in regard to a portion of the globe is the right to exercise therein, to the exclusion of any other
State, the functions of a State.’
1
1