52 Fifth Report Annex B 40. The eighth question sought to solicit Member State views on the question of sovereignty- as-principle versus sovereignty-as-rule. It was focused on the constraining function of sovereignty, i.e., whether and how it limits a State’s ability to conduct cyber operations outside of its territory. Interestingly, many of the responding States took the question as an invitation to reaffirm sovereignty’s enabling function – i.e., according State’s authority to regulate ICTs within their own territorial jurisdiction. Bolivia and Guyana, for example, both cited sovereignty as authorizing States to exercise jurisdiction over cyber infrastructure or activities in their territory.102 Ecuador, in contrast, cast doubt on the ability of States to exercise their sovereignty in cyberspace given its “intangible” characteristics, while affirming States do have sovereignty over “Cyber infrastructure” and activity related to that infrastructure in their territory.103 Chile and the United States also echoed the power sovereignty accords States over ICTs in their territory, but noted that this power must operate within limits. Both cited the need for States to exercise their sovereignty consistent with international human rights law.104 This last point was echoed by Colombia in its comments to the OEWG.105 41. On the question of whether sovereignty operates as a stand-alone rule in cyberspace, three States—Bolivia, Guatemala, and Guyana—affirmed its status as such.106 Guyana, for example, indicated that sovereignty protections are “not limited to activities amounting to an unjustified use of force, to an armed attack, or to a prohibited intervention.”107 Thus, it took the view that a State “must not conduct cyber operations that violate the sovereignty of another State” with the existence of such violations depending on “the degree Bolivia Response, supra note 1, at 5-7; Guyana Response, supra note 1, at 5. Ecuador Response, supra note 1, at 2. 104 Chile Response, supra note 1, at 4-5 (recognizing sovereignty authorizes protection and defense of a State’s “critical information infrastructure” as long as those sovereignty-based measures “do not violate the rule of international law – for example, those contained in international human rights law or international humanitarian law.”); 2014 US GGE Submission, supra note 1, at 737-8 (noting that the exercise of jurisdiction of a territorial State “is not unlimited; it must be consistent with applicable international law, including international human rights obligations” and citing, in particular freedom of expression and freedom of opinion). 105 Colombia Comments, supra note 5. 106 Bolivia Response, supra note 1, at 5-7; Guatemala Response, supra note 1, at 3; Guyana Response, supra note 1, at 5. 107 Guyana Response, supra note 1, at 5. of infringement and whether there has been an interference with government functions.”108 Guatemala adopted a similar stance, indicating that “a State participating in a specific cyber operation violates a country’s sovereignty if, in the course of a cyber attack, it takes certain information from another State’s cyber realm, even when no harm that could affect equipment or the human rights of a person or persons is caused.”109 42. Other States’ responses where quite equivocal. Peru simply cited sovereignty as “one of the fundamental pillars of international society” without opining on its status as an independent rule.110 Ecuador suggested that the “rule” authorizing States to control their own cyber infrastructure “does not prevent a state from engaging in cyber operations” without offering an opinion on whether it might regulate how they do so vis-à-vis other sovereign States.111 43. Chile’s response described sovereignty as a “principle” that “States carrying out cyber operations must always take … into account.”112 Thus, “every time a state considers carrying out a cyber operation, it must consider ensuring it does not affect the sovereignty of another.”113 The use of “principle” may suggest something other than a concrete rule, although the use of “must” creates a more obligatory expectation. Moreover, Chile did suggest that: every state has an obligation to respect the territorial integrity and independence of other states and must faithfully discharge its international obligations, including as regards the principle of nonintervention. Cyber operations that hinder another state from exercising its sovereignty therefore constitute a violation of that sovereignty and are prohibited under international law.114 102 103 Inter-American Juridical Committee The last sentence suggests sovereignty might constitute a stand-alone rule unless one reads the reference to intervention with another State’s exercise 108 109 110 111 112 113 114 Id. Guatemala Response, supra note 1, at 3. Peru Response, supra note 1, at 6-7. Ecuador Response, supra note 1, at 2. Chile Response, supra note 1, at 5. Id. Id. International Law and State Cyber Operations 53