A/76/136 For the purpose of this paper, ‘cyber processes’ are events and sequences of events of data creation, storage, processing, alteration or relocation through means of information technology. The term ‘cyber infrastructure’ refers to all types of hardware and software components, systems and networks which allow for the implementation of ‘cyber processes’. This includes ‘[t]he communications, storage, and computing devices upon which information systems are built and operate.’ 56 ‘Cyber activities’ are ‘cyber processes’ instigated by users of cyber infrastructure. The term ‘cyber operation’ more narrowly refers to the ‘employment of cyber capabilities to achieve objectives in or through cyberspace.’ 57 ‘Cyberspace’ itself is understood here as the conglomerate of (at least partly interconnected) ‘cyber infrastructures’ and ‘cyber processes’ in the above-mentioned sense. In this paper, the adjective ‘malicious’, when used to describe certain activities in cyberspace, is not purported to carry a technical legal meaning. II. Obligations of States derived from the United Nations Charter a) Sovereignty The legal principle of State sovereignty 58 applies to States’ activities with regard to cyberspace. 59 State sovereignty implies, inter alia, that a State retains a right of regulation, enforcement and adjudication (jurisdiction) with regard to both persons engaging in cyber activities and cyber infrastructure on its territory. 60 It is limited only by relevant rules of international law, including international humanitarian law and international human rights law. Germany recognizes that due to the high degree of cross-border interconnectedness of cyber infrastructures, a State’s exercise of its jurisdiction may have unavoidable and immediate repercussions for the cyber infrastructure of other States. 61 While this does not limit a State’s right to exercise its jurisdiction, due regard has to be given to potential adverse effects on third States. By virtue of sovereignty, a State’s political independence is protected and it retains the right to freely choose its political, social, economic and cultural system. Inter alia, a State may generally decide freely which role information and communication technologies should play in its governmental, administrative and adjudicative proceedings. Foreign interference in the conduct of elections of a State may under certain circumstances constitute a breach of sovereignty or, if pursued by means of coercion, of the prohibition of wrongful intervention. 62 Moreover, by virtue of its sovereignty, a State may decide freely over its foreign policy also in the field of information and communication technologies. 63 Furthermore, a State’s territorial sovereignty is protected. Due to the rootedness of all cyber activities in the actions of human beings using physical infrastructure, cyberspace is not a deterritorialized forum. 64 In this regard, Germany underlines that there are no independent ‘cyber borders’ incongruent with a State’s __________________ 56 57 58 59 60 61 62 63 64 32/142 Tallinn Manual 2.0 (note 55), Glossary (p. 564). Ibid. The legal principle of State sovereignty is enshrined – in conjunction with the notion of equality of States – in Art. 2 para. 1 of the UN Charter. See also UN Group of Governmental Experts, reports of 2013 and 2015 (note 52), paras. 20 and 27, 28 (b) respectively; Tallinn Manual 2.0 (note 55), rule 1. A State’s jurisdiction may under certain conditions apply to situations beyond its borders, i.e. according to the principles of active and of passive nationality as well as universality. For example, restrictive regulatory or enforcement activities regarding important internet nodes in the territory of one State may seriously impair the functioning of networks of other States. See below, at I.b). See Tallinn Manual 2.0 (note 55), rule 3 (‘external sovereignty’). Ibid., rule 1, commentary, para. 5. 21-09670