Czech Republic Position paper on the application of international law in cyberspace or whether the operation interfered with or usurped inherently governmental functions.5 In general, the impact or severity of cyber effects will be evaluated in the same manner and according to the same criteria as for physical activities. The Czech Republic will assess whether a violation of sovereignty has occurred on a case-by-case basis, since further State practice and opinio juris is needed to clarify the scope of customary law in this area over time. 6. The Czech Republic is of the opinion that the following cyber operations in one State’s territory constitute violations of sovereignty, if attributed to another State, inter alia: a) a cyber operation causing death or injury to persons or significant physical damage; b) a cyber operation causing damage to or disruption of cyber or other infrastructure with a significant impact on national security, economy, public health, public safety or environment;6 for instance, if such an operation causes a severe power outage affecting thousands of households; c) a cyber operation interfering with any data or services which are essential for the exercise of inherently governmental functions, and thereby significantly disrupting the exercise of those functions; for example, distributing ransomware which encrypts the computers used by a government and thus disables the payment of retirement pensions or other social benefits.7 Prohibition of Intervention 7. The obligation of non-intervention is a well-established customary rule of international law stemming from the principle of State sovereignty, which is also applicable to cyberspace. A definition of prohibited intervention was provided by the International Court of Justice in the 1986 Nicaragua v United States case: “A prohibited intervention must […] be one bearing on matters in which each State is permitted, by the principle of State sovereignty, to decide freely. One of these is the choice of a political, economic, social, and cultural system, and the formulation of foreign policy. Intervention is wrongful when it uses methods of coercion in regard to such choices, which must remain free ones.”8 5 See also Rule 4 para 15 of the Tallinn Manual 2.0 on the international law applicable to cyber operations, 2 nd edition, CUP, 2017. 6 Compare the UN GGE 2015 report, paragraph 13, letter f): “A State should not conduct or knowingly support ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public[.]” and UN GGE report 2021 para. 42 7 See also the The Oxford Statement on Ransomware Operations. Oxford Institute for Ethics, Law and Armed Conflict 8 See para. 205 of Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Merits, Judgment of 27 June 1986, ICJ Reports 1986 and UN General Assembly, Declaration on Principles of International Law concerning Friendly Relations and Cooperation among States in accordance with the Charter of the United Nations, 24 October 1970, A/RES/2625(XXV). 4