19. Importantly, some cyber activities, such as cyber espionage, do not amount to a
breach of territorial sovereignty, and hence to a violation of international law.Footnote
16
They may however be prohibited under the national laws of a State.Footnote 17
20. It is possible that a series of cyber activities could lead to significant harmful effects
that violate the rule of territorial sovereignty. This is the case even if the individual
cyber activity on its own would not reach this threshold.
21. Canada will assess whether a violation of territorial sovereignty has occurred on a
case-by-case basis. As noted below, Canada believes further State practice and
opinio juris will help clarify the scope of customary law in this area over time. In any
event, Canada considers that the existence of varied approaches to assessing the
legality of cyber activities should not prevent States from agreeing that particular
malicious cyber activities are internationally wrongful acts.
Non-Intervention
22. State cyber activities may breach the foundational international law prohibition of
intervention in the internal or external affairs of another State. This would be the
case where both of the following conditions are met:
the activities aim to interfere with the internal or external affairs of the affected
State involving its inherently sovereign functions, known as domaine
réservéFootnote 18; and
the activities would cause coercive effects that deprive, compel, or impose an
outcome on the affected State on matters in which it has free choice.Footnote 19
23. In its most serious form, coercion may arise through the threat or use of force but
could also arise where a cyber activity is designed to deprive the affected State of
its freedom of choice. Coercion must be distinguished from other conduct such as
public diplomacy, criticism, persuasion, and propaganda.
24. An example of a prohibited intervention would be a malicious cyber activity that
hacks and disables a State’s election commission days before an election,
preventing a significant number of citizens from voting, and ultimately influencing
the election outcome. Another example would be a malicious cyber activity that
disrupts the functioning of a major gas pipeline, compelling the affected State to
change its position in bilateral negotiations surrounding an international energy
accord.
25. Whether or not a cyber activity meets the threshold for a violation of the rule on
territorial sovereignty or rises to the level of a violation of the rule against
intervention will be determined on a case-by-case basis. As with the thresholds for
violations of territorial sovereignty, Canada believes that further State practice and
opinio juris will help clarify the thresholds for the rule of non-intervention, and the
scope of customary law in this area over time.
Due Diligence
4/14