A/75/123 The principle of sovereignty applies to cyberspace. France therefore reaffirms that it exerts its sovereignty over information systems, individuals and cyberactivities in its territory or under its jurisdiction, in accordance with its obligations under international law. The unauthorized penetration of French systems and the resulting effects in French territory through the use of offensive electronic means by a State entity or by non-State actors acting on the instructions or under the control of a State may constitute a violation of sovereignty. The scope of the measures that States can take to respond to a possible cyberattack depends on the seriousness of the attack’s effects. A cyberoperation can therefore be understood as a use of force prohibited under paragraph 4 of Article 2 of the Charter of the United Nations. Whether that threshold has been crossed depends not on the electronic means used but rather on the effects of the cyberoperation. If the effects are similar to those of conventional arms, a cyberoperation can be understood as a use of force. In the view of France, if the scope or effects of a major cyberattack perpetrated by a State, or by non-State actors acting under the control or on the instructions of a State, reach a sufficient threshold (such as substantial loss of life, significant material damage, or deficiency of critical infrastructure with significant consequences), that attack could constitute “armed aggression” under Article 51 of the Charter and thus justify a claim of self-defence. The right of self-defence could be exercised by conventional or electronic means, in accordance with the principles of necessity and proportionality. The characterization of a cyberattack as “armed aggression” under Article 51 of the Charter is a political decision to be made on a case-by-case basis in the light of criteria established by international law. France also recognizes that international humanitarian law fully applies to cyberoperations conducted in the context of and in relation to armed conflicts. Offensive cyberoperations are currently carried out in combination with conventional military operations. Despite their non-material nature, such operations remain subject to the geographic scope of application of international humanitarian law; in other words, their effects are confined to the territories of the States parties to an international armed conflict or, in the context of a non-international armed conflict, to the territory where hostilities are taking place. Offensive cyberwarfare operations undertaken by the French armed forces must comply with the following principles of international humanitarian law: – The principle of distinction between civilian assets and military targets. Cyberattacks not directed at a specific military target or carried out by means of cyberweapons that cannot be directed at a specific military target are prohibited. Certain data, although intangible, may constitute civilian assets protected under international humanitarian law. In accordance with this principle, a distinction must be made between combatants, or members of organized armed groups, and civilians. The civilian population in general and individual civilians must not be targeted unless and for such time as they participate directly in hostilities. In an armed conflict, any cybercombatant who is a member of the armed forces of a party to the conflict, any member of an organized armed group engaged in cyberattacks against another party, and any civilian directly participatin g in hostilities through electronic means may be the target of a conventional attack or a cyberattack; – The principle of proportionality and the precautionary principle. Constant vigilance must be exercised in order to protect persons and civilian assets from the effects of hostilities during such operations. Collateral damage must be commensurate with the concrete and direct military advantage anticipated. The principle of proportionality in cyberspace requires that all foreseeable effects of 38/84 20-08285