A/74/120 3. (a) Relevant international concepts aimed at strengthening global cybersecurity Concepts related to preservation of international peace and security In order to ensure an open, secure, stable, accessible and peaceful cyberspace, France reaffirms its commitment to the applicability of international law, including the Charter of the United Nations in its entirety, international humanitarian law and international human rights law, to the use of information and communication s technology by States. Public international law In its 2013 report, the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security set out the principles and rules of international law governing t he actions of States in cyberspace. Even given the specific characteristics of cyberspace, such as anonymity and the role of private actors, international law provides the means necessary to responsibly control the behaviour of States in that environment. Failure of attribution should therefore not pose an insurmountable obstacle to the implementation of existing international law. The principle of sovereignty applies to cyberspace. In this connection, France reaffirms its sovereignty over information sys tems, individuals and cyberspacerelated activities on its territory, in accordance with its obligations under international law. Unauthorized penetration of French systems or the generation of effects in French territory through the use of cyberspace by a State entity or by non-State actors acting under the direction or control of a State may constitute a violation of sovereignty. The scope of the measures that States can take to respond to a possible cyberattack is a function of the seriousness of the attack: the more serious the cyberattack, the wider the scope of the measures. A cyberoperation can be understood as a use of force prohibited under paragraph 4 of Article 2 of the Charter of the United Nations. Whether that threshold has been crossed is not a function of the means of the cyberattack, but rather its effects. If its effects are similar to those of conventional arms, a cyberoperation could constitute a use of force. In the view of France, if the scope or impact of a major cyberattack perpetrated by a State, or by non-State actors acting under the supervision or instruction of a State, reaches a sufficient threshold (such as substantial loss of life, significant material damage, insufficient critical infrastructure with significant consequences), and is attributable to a State, that could constitute “armed aggression” under article 51 of the Charter and thus justify a claim of self-defence. The right of self-defence could be exercised by conventional or electronic means, if necessary and proportionate. The characterization of a cyberattack as “armed aggression” under article 51 of the Charter is a political decision to be made on a case-by-case basis in the light of criteria established by international law. France does not believe that it is necessary at this stage to establish a new international legally binding instrument dedicated to the challenges of cybersecurity. Existing international law applies to cyberspace, as it does to other spheres, and must be respected. International humanitarian law France supports the application of international humanitarian law to cyberoperations conducted in the context of and in relation to armed conflicts. 22/39 19-10580