50 Fifth Report Annex B Question 8 Is sovereignty a discrete rule of international law that prohibits States from engaging in specific cyber operations? If so, does that prohibition cover cyber operations that fall below the use of force threshold and which do not otherwise violate the duty of non- intervention? 39. Sovereignty is undoubtedly the core architectural feature of the current international legal order, providing States with both rights and responsibilities.97 Sovereignty serves as a foundational principle for some of the international legal rules already mentioned (e.g., the prohibition on the use of force, the right of self-defense, State responsibility). Moreover, in certain contexts, sovereignty exists not as just a background principle, but as an independent rule directly regulating State behavior (i.e., a foreign aircraft entering another State’s airspace without permission violates its sovereignty).98 It is not yet clear, however, whether sovereignty operates as a rule in cyberspace. Tallinn ManIsland of Palmas (Netherlands v. United States of America), 2 R.I.A.A. 829, 839 (1928) (“Sovereignty in the relations between States signifies independence. Independence in regard to the portion of the globe is the right to exercise therein, to the exclusion of any other State, the functions of a State. . . Territorial sovereignty, as has already been said, involves the exclusive right to display the activities of a State. This right has as corollary a duty: the obligation to protect within the territory the rights of other States, in particular their right to integrity and inviolability in peace and in war.”). 98 See, e.g., Michael N. Schmitt and Liis Vihul, Respect for Sovereignty in Cyberspace, 95 TEXAS L. REV. 1639, 1640 (2017). In addition to Article 2(4)’s prohibition on the use of force, there is widespread agreement on a duty of non-intervention in international law that is applicable to cyberspace. See, e.g., Case Concerning Armed Activities in the Territory of the Congo (Democratic Republic of the Congo v. Uganda) (Jurisdiction and Admissibility) [2006] ICJ Rep. 6, 4648; Nicaragua Case, supra note 23, at 205; Declaration on Principles of International Law concerning Friendly Relations & Co-operation among States, UNGA Res. 2625 (XXV), U.N. Doc. A/RES/25/2625 (Oct. 23, 1970). The 2015 UN GGE endorsed it among the applicable rules of international law in cyberspace. U.N. Secretary-General, Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, U.N. Doc. A/70/174 (July 22, 2015) 26, 28(b). And Rule 66 of Tallinn 2.0 posits that “A State may not intervene, including by cyber means, in the internal or external affairs of another State.” Tallinn 2.0, supra note 20, at 312. As with the use of force, however, questions remain about how this duty operates in cyberspace and what cyber operations it prohibits or otherwise regulates. 97 Inter-American Juridical Committee ual 2.0 indicated that it constitutes a rule that operates to constrain a State’s cyber operations that do not rise to the level of a use of force or constitute a prohibited intervention.99 In 2018, however, the U.K. Attorney General took the view that sovereignty was a principle that informed other rules not a rule of international law itself.100 Since then, the French Ministry of Defense and the Dutch government have both expressed support for sovereignty as a stand-alone rule.101 Tallinn 2.0, supra note 20, Rule 4 (“A State must not conduct cyber operations that violate the sovereignty of another State.”). 100 See, e.g., Jeremy Wright, QC, MP, Cyber and International Law in the 21st Century (May 23, 2018), at https://www.gov.uk/government/speeches/cyber-and-international-law-in-the-21st-century (“U.K. Views”) (“Some have sought to argue for the existence of a cyber-specific rule of a ‘violation of territorial sovereignty’ … Sovereignty is of course fundamental to the international rules-based system. But I am not persuaded that we can currently extrapolate from that general principle a specific rule or additional prohibition for cyber activity beyond that of a prohibited intervention. The UK Government’s position is therefore that there is no such rule as a matter of current international law.”). 101 See Ministère des Armées, Droit international appliqué aux operations dans le cyberspace (Sept. 9, 2019), at https://www.defense.gouv.fr/salle-de-presse/communiques/communiques-du-ministere-desarmees/communique_la-france-s-engage-a-promouvoir-uncyberespace-stable-fonde-sur-la-confiance-et-le- respect-du-droit-international (“French Ministry of Defense Views”) at 6 (“Any unauthorised penetration by a State of French systems or any production of effects on French territory via a digital vector may constitute, at the least, a breach of sovereignty” (English translation by Rapporteur)); Letter to the parliament on the international legal order in cyberspace, July 5, 2019, Appendix 1, at https:// www.government.nl/ministries/ministry-of-foreign- affairs/documents/parliamentary-documents/2019/09/26/letter-to-the-parliament-on-the-international-legal-order- in-cyberspace (“The Netherlands Views”) (“According to some countries and legal scholars, the sovereignty principle does not constitute an independently binding rule of international law that is separate from the other rules derived from it. The Netherlands does not share this view. It believes that respect for the sovereignty of other countries is an obligation in its own right, the violation of which may in turn constitute an internationally wrongful act.”). A recent scholarly treatment questions if France clearly falls in the sovereignty-as-rule camp. See Gary Corn, Punching on the Edges of the Gray Zone: Iranian Cyber Threats and State Cyber Responses, JUST SECURITY (Feb. 11, 2020) (“although the MdA does state that cyberattacks, as it defines that term, against French digital systems or any effects produced on French territory by digital means may constitute a breach of sovereignty in the general sense, at no point does it assert unequivocally that a violation of the principle of sovereignty constitutes a breach of an international obligation. To the contrary, obviously aware of the debate, the document is deliberately vague on this point and simply asserts France’s right to respond to cyberattacks with the full range of options available under international law...”). 99 International Law and State Cyber Operations 51