Czech Republic Position paper on the application of international law in cyberspace Sovereignty 1. The principles of sovereignty and sovereign equality of States are fundamental concepts of international law, cornerstones of the UN Charter and apply in cyberspace, just as they do in other domains.2 2. The two facets of sovereignty are the internal facet, meaning that every State exercises its sovereignty over its territory, including the ICTs located therein, subject to its obligations under international law, including international human rights law, and the external facet, meaning that every State may freely and independently choose and develop its political, social, economic and cultural system and determine its foreign policy. 3. The sovereignty of every State must be respected. The principle of sovereignty forms a basis of various rules, such as the prohibition of intervention and the prohibition of the use of force. At the same time, sovereignty is a rule in its own right which is capable of being violated. Thus, cyber activities that do not amount to a prohibited intervention or a prohibited use of force may nevertheless amount to a violation of a State’s sovereignty under international law. In such case, violation of one State’s sovereignty by another State, including by a cyber means, would be considered an internationally wrongful act.3 4. On the other hand, the Czech Republic does not consider every cyber operation attributable to a State and having an effect in the territory or infrastructure of another State to be a violation of the latter’s sovereignty. Cyberspace is a global and open domain and States often exercise their jurisdiction in another State’s territory without legal repercussions. For instance, an organ of a State viewing a publicly available website hosted in another State for the purposes of obtaining information during a criminal investigation does not violate that State’s sovereignty, despite exercising jurisdiction in its territory without its consent.4 5. Therefore, it is necessary to set a threshold where cyber activities could constitute a violation of the rule of sovereignty. The Czech Republic is of the view that cyber activities that rise above the level of negligible or de minimis effects and cause significant harmful effects on the territory of another State without the consent of that State could amount to a violation of the rule of sovereignty in relation to the State concerned. While there is no universal consensus on the threshold, the Czech Republic is of the opinion that the analysis should take into account the degree of infringement upon the target State’s territorial integrity (i.e. the scope, scale, impact or severity of the effects of the operation and the causal link between the operation and its effects) 2 As the Island of Palmas (or Miangas) case (Neth. v. U.S.), 2 RIAA 829, ICGJ 392 (PCA 1928), 4th April 1928, Permanent Court of Arbitration [PCA] asserts: “[S]overeignty in the relations between States signifies independence. Independence in regard to a portion of the globe is the right to exercise therein, to the exclusion of any other State, the functions of a State.” 3 See Article 2, Draft Articles on Responsibility of States for Internationally Wrongful Acts, with commentaries (ARSIWA), Yearbook of the International Law Commission, 2001 vol. II, Part Two. 4 States party to the Convention on Cybercrime allow such operations in each other’s territory. See Article 32 letter a) of the Convention on Cybercrime of the Council of Europe, adopted 23 November 2001, entered into force 1 July 2004, ETS 185. 3