In the field of international law, state sovereignty is often understood as competence, immunity, or authority, with a particular emphasis on the ability to make independent choices, referred to as sovereign autonomy. International sovereignty signifies a legal framework or position that includes rights guaranteeing independent authority as well as corresponding obligations within a community of equal sovereigns where all rights are mutual.Footnote 1 Sovereignty has been defined by the Permanent Court of Arbitration in the case of The Island of Palmas as “the independence in the relations between States. Independence in regard to a portion of the globe is the right to exercise therein, to the exclusion of any other state, the functions of a State”.Footnote 2 The issues associated with the application of international law to cyberspace originate from the novelty of the concepts involved in this domain. For example, the absence of a clear and precise delineation of cyber activities has posed challenges in applying various aspects of international law to cyberspace, including the concept of sovereignty.
Cyberspace has three layers: the physical layer, which includes computers, interconnected circuits, wires, and communication infrastructure; the logical layer, which consists of software logic, data packets, and electronics; and the social layer, which is the human.Footnote 3 Cyberspace lacks physical boundaries, allowing data to flow seamlessly across traditional territorial borders. This borderless nature complicates the application of traditional notions of jurisdiction and sovereignty.Footnote 4 Cyberspace is accessible from virtually anywhere in the world, provided that there is internet connectivity. This widespread accessibility not only facilitates global communication and commerce but also poses challenges for regulating activities that span across multiple jurisdictions. Actions in cyberspace can have global repercussions: affecting individuals, organizations, and states worldwide.Footnote 5 The high level of interconnectivity in cyberspace, while beneficial for economic and social interactions, also increases the risk of cyber threats spreading quickly across borders.Footnote 6
Some scholars argue that cyberspace is a separate and global realm, comparable to land, sea, air, and space.Footnote 7 This viewpoint emphasizes the distinct characteristics of cyberspace, including its lack of borders, ability to enable virtual interactions, and the creation of digital communities and businesses. Furthermore, it highlights the importance of implementing international legislation and governance structures that are especially tailored to tackle issues such as cybercrime, digital privacy, and cyberwarfare, which transcend traditional national boundaries. Cyberspace can be understood as a worldwide domain within the information environment, characterized by the utilization of electronic systems and the electromagnetic spectrum. It encompasses the processes of generating, storing, modifying, disseminating, and exploiting information through interconnected networks that rely on information and communication technologies (ICTs).Footnote 8
Although not completely opposing each other’s views, certain other scholars view cyberspace as an expansion of current technology rather than a distinct realm.Footnote 9 They assert that the internet and related technologies are just instruments that enable the communication, trade, and sharing of information within defined domains. From this perspective, the challenges presented by cyberspace, such as cybersecurity and digital rights, may be effectively addressed by utilizing the current legal and regulatory frameworks that have been modified to suit the technological environment. This viewpoint prioritizes the preservation of existing systems and practices in the way society handles technological advancements, rather than focusing on radical changes or transformations.Footnote 10 Overall, all states have agreed that the principles of international law, including sovereignty, should be applied in cyberspace, notwithstanding the disagreements as to which approach to adopt.Footnote 11 The new United Nations (UN) cybercrime convention, which was adopted in December 2024, also addresses sovereignty and obligates states to comply with the principles of sovereign equality and territorial integrity of states.Footnote 12
States in the international arena can be classified into two main camps based on their position on sovereignty in cyberspace. The non-Western camp, consisting of states such as Russia, China, and Iran, promotes a vision of cyberspace that is under greater national control. Conversely, the Western camp advocates for an open and global cyberspace. The resolution of this issue is contingent upon the economic, legal, cultural, political, and social interests of states, as well as their perceptions of the nature and desired characteristics of cyberspace. Additionally, it is crucial to consider how the interests of states are advanced, facilitated, or constrained within this space.Footnote 13 The objective of this study is to thoroughly analyze the divergent views that these different camps have regarding the implementation of sovereignty in the realm of cyberspace. In this regard, it further explores the notion of territorial sovereignty and its application in cyberspace, together with its challenges. Finally, two potential solutions are examined in order to solve the challenge of territorial sovereignty in cyberspace.
I. Sovereignty in the digital age
Russia and China, along with Kazakhstan, Uzbekistan, Kyrgyzstan, and Tajikistan, submitted a proposal to the United Nations General Assembly (UNGA) in 2015 entitled “International Code of Conduct for Information Security”, which includes a commitment to respect the “sovereignty, territorial integrity, and political independence of all countries”.Footnote 14 Furthermore, in his 2015 speech at the Second World Internet Conference in Wuzhen, Chinese President Xi Jinping emphasized the importance of cyber sovereignty and declared that cyber sovereignty is essential for national sovereignty.Footnote 15 In 2016, the Ministry of Foreign Affairs and the Cyberspace Administration of China prepared a report titled “International Strategy for Cooperation in Cyberspace”, which emphasized the role of sovereignty as one of the four basic principles of international relations.Footnote 16 It is thus apparent that states like Iran, Russia, China, and other countries with similar interests have strongly advocated for a cyberspace governance framework known as cyber sovereignty. The 2016 Joint Statement between the Presidents of China and Russia on Cooperation in Information Space Development underscores that the parties will collectively promote respect for, and oppose violations of, each country’s sovereignty in the information space.Footnote 17 This perspective asserts that states have the jurisdiction to regulate and manage online activity inside their own territories, similar to their authority over physical land.Footnote 18 They claim that this degree of authority is essential for protecting national security, upholding cultural norms, and maintaining political stability. Supporters of cyber sovereignty argue that without such authority, states are vulnerable to external interference and cyber risks that might endanger their political stability and national security.Footnote 19 This viewpoint is frequently reinforced by these states by highlighting the imperative of safeguarding against cyber espionage, cyberattacks, and protecting the essential interests of state.
Cyber sovereignty is a notion that supports state control over digital information and infrastructure inside national borders, in contrast to the idea of a borderless and universal internet. This approach aims to enhance security and regulation, but it also raises significant human rights issues, notably with regards to freedom of expression, access to information, and privacy. The consequences can include widespread censorship, increased monitoring, etc. Through the establishment of separate national networks or the implementation of strong rules on internet access, these countries may gain the power to effectively limit the free flow of information if they so desire. These states will often cite national security as a primary justification for their cyber sovereignty policy. They aim to protect the state against foreign cyber activities, espionage, propaganda, attacks on the legitimacy of their governments, etc. by exercising control over the internet. These states frequently argue that such control is essential to safeguarding traditional values and customs against perceived Western influences and moral degradation.Footnote 20
Several instances of states’ policies that are in line with this approach may be identified. The Sovereign Internet Law of Russia, implemented in 2019, seeks to create a domestic internet infrastructure that can operate autonomously from the global internet in case of external dangers. The stated purpose of this act was to protect the state against foreign intervention and to strengthen national security.Footnote 21 In addition, Roskomnadzor, Russia’s federal executive agency, has the responsibility of monitoring, controlling, and restricting Russian media and internet activity.Footnote 22 The “Great Firewall” in China is also a combination of laws and technologies that control internet usage within the country.Footnote 23 Likewise, the Chinese Cybersecurity Law of 2017 enforces strict rules on data localization and gives the government extensive power to regulate and monitor online activities.Footnote 24 The aims of these policies are to govern and manage internet access and content in China, uphold social order, regulate the flow of information, and safeguard national sovereignty.
Creating national regions in cyberspace by separating national networks from the global web and developing a nationalized internet is a more complicated measure to prove sovereignty in cyberspace. For example, we can mention North Korea’s “Kwangmyong” Internet and Iran’s “Clean and Halal Internet” project which would contain only content allowed by their strict interpretation of the Islamic law.Footnote 25 According to reports, North Korea’s internet consists of a search engine, news, e-mail, and a browser, with only 28 websites.Footnote 26 Additionally, the Iranian government announced that the destructive use of ICTs is a serious and imminent threat to the country’s sovereignty and domestic affairs.Footnote 27 In line with this statement, the principle of sovereign equality of states is asserted in Article 1 of the Declaration of the Iranian General Staff of the Armed Forces on Cyber Threats, emphasizing its applicability to the utilization of cyberspace.Footnote 28 Meanwhile, there are states that have adopted extreme policies regarding controlling their cyberspace which arguably endanger human rights. The Syrian government, for example, has implemented a rigorous strategy of internet surveillance and control, monitoring and limiting online activity within the country to crush opposition and ensure political stability.Footnote 29 Similarly, the policy of Belarus is to exercise authority over Internet Service Providers (ISPs) and online material, as well as to regulate and monitor internet usage within the country. This policy was implemented to uphold governmental control and suppress political opposition.Footnote 30 In Turkmenistan, internet access is under the jurisdiction of the state, and the government restricts access to foreign websites and controls information flow so as to prevent foreign influence and retain a tight grip on governance.Footnote 31
There are doctrines and white papers that may more clearly demonstrate the cyber sovereignty approach. Russia’s 2016 Information Security Doctrine clarifies its cyber sovereignty approach, emphasizing state control over digital infrastructure and information spaces to safeguard national security and stability. The doctrine mandates monitoring and regulation of online content to prevent the spread of extremist, false, or destabilizing information, and supports governmental surveillance as a key measure against internal and external threats. It stresses the importance of preserving territorial sovereignty in cyberspace through local technology advancements, regulatory measures, and international cooperation, while countering external manipulation, cyber risks, and internal unrest. This strategy effectively underpins Russia’s robust effort to assert its autonomy in the cyber realm.Footnote 32 China’s 2010 White Paper on the Internet asserts that China’s online domain is governed by national laws, emphasizing strict state control over cyberspace. It argues that sovereign states must manage their digital environments to safeguard national interests and security. The document outlines various regulations China enforces to control internet usage within its borders, ensuring online activity aligns with national objectives. It stresses the importance of monitoring content to maintain social stability and order, including curbing harmful material. Furthermore, it advocates for a governance framework that allows states to regulate their internet independently while promoting international cooperation based on mutual respect.Footnote 33
Nevertheless, there are slight differences between countries like North Korea compared to Russia, China, and Iran. Iran’s network can operate autonomously, while North Korea’s Kwangmyong is entirely disconnected from the global web. North Korea focuses on developing independent national networks, prioritizing national security and protection from foreign influence through isolation and stringent control over information flow. In contrast, Russia, China, and Iran do not completely isolate themselves from the global internet. Instead, they utilize filtering and monitoring systems to control access and surveil content. They assign resources to sophisticated firewall and surveillance technologies that screen and monitor internet traffic inside a unified yet regulated global internet structure. Furthermore, they emphasize the significance of achieving a harmonious balance between preserving access to the worldwide internet for economic and strategic benefits while concurrently exercising authority to safeguard national security and political stability.
Contrary to the strategy of Russia, China, and likeminded states, several Western states support an open and global internet. This approach, seemingly, places a high value on protecting human rights, such as the rights to freedom of expression, privacy, and access to information. At the same time, it also recognizes and respects the values of national sovereignty.Footnote 34 States like the United States of America (USA), European Union (EU) member states, the United Kingdom (UK), Canada, Australia, and other countries endorse a globally linked and relatively unrestricted internet with a focus on international cooperation and the promotion of democratic principles. Proponents argue that an open and global cyberspace is crucial for cultivating democracy, promoting economic advancement, and protecting personal freedoms. They call for the creation of worldwide standards and regulations to protect the internet as a space in which universal human rights, specifically the freedom of speech and privacy, are preserved in tandem with national security interests.Footnote 35 This method often involves implementing a multistakeholder approach to governance, where governments, business sector entities, civil society, and international organizations work together to create comprehensive and inclusive cyber policies. Like-minded states seek to establish a cyberspace that promotes innovation, economic growth, and the free flow of ideas by balancing state sovereignty, international collaboration, and the preservation of individual freedoms.Footnote 36
The USA has stated that:
The implications of sovereignty for cyber activities are complex, but we can start by noting two important implications of sovereignty for ICT-related activities. First, we acknowledge the continuing relevance of territorial jurisdiction, even to cyber activities, and second, we acknowledge the exercise of jurisdiction by the territorial state is not unlimited; it must also be consistent with applicable international law, including international human rights obligations.Footnote 37
Alongside the USA, the UK believes that it is crucial for states to uphold their human rights responsibilities when it comes to their conduct in cyberspace. This is essential for creating an environment that is open, safe, stable, accessible, and peaceful. States’ engagements in cyberspace are bound by certain rights that are of great importance. These rights include the right to be protected from any arbitrary or unlawful interference with privacy, family, home, or correspondence, the right to freedom of thought, conscience, and religion, and the right to freedom of expression.Footnote 38 Germany holds the opinion that state sovereignty in cyberspace is subject to the constraints of international law, especially international human rights legislation.Footnote 39 The USA, along with over 70 international partners including the EU, UK, Israel, Australia, Japan, South Korea, Argentina, Colombia, Uruguay, and others, signed the Declaration on the Future of the Internet. This declaration advocates for a global, open, and secure internet that upholds freedom of expression and innovation. This initiative aims to safeguard democratic values and protect human rights online.Footnote 40
The concept of technological or digital sovereignty has lately arisen as a mechanism to advance European leadership and strategic autonomy in the digital domain. Significant apprehensions have emerged regarding the economic and social impact of non-EU technology firms, jeopardizing EU individuals’ control over their personal data and hindering the expansion of EU high-tech enterprises, as well as the capacity of national and EU regulators to implement their legislation. Digital sovereignty in this sense denotes Europe’s capacity to operate autonomously in the digital realm, encompassing both protective measures and proactive instruments to promote digital innovation, including collaboration with non-EU enterprises.Footnote 41 There have been requests to establish a European cloud and data infrastructure to enhance Europe’s data sovereignty and mitigate the current dominance of non-European providers in the cloud and data storage market, which may adversely affect security and the rights of EU citizens. The Gaia-X project, initiated collaboratively by Germany and France, aims to create a federated data infrastructure at the European level, and commenced in 2020.Footnote 42 However, after 5 years, this project has not been successful in reaching its goal to create a trusted cloud infrastructure across Europe to be able to compete in the market.Footnote 43
In addition, the EU implements the General Data Protection Regulation (GDPR) to safeguard individual privacy and data rights. This regulation also aims to promote a digital single market while ensuring a balance between national sovereignty and the preservation of basic rights and freedoms.Footnote 44 The National Cyber Security Strategy of the UK seeks to bolster national cybersecurity while maintaining democratic principles and human rights, with the goal of safeguarding national interests in the digital realm through global cooperation and respect for individual rights.Footnote 45 Canada ensures a digital environment that is free, transparent, and secure, prioritizing the protection of privacy and democratic principles. This is achieved through the implementation of the Digital Charter,Footnote 46 which also fosters confidence and security in the digital economy while respecting individual rights. The International Cyber Engagement Strategy in Australia also aims to provide an open, unrestricted, and protected digital environment by means of global collaboration. Furthermore, it upholds worldwide cyber rules and safeguards online human rights.Footnote 47 Moreover, Germany’s Digital Strategy 2025 was released with the aim of promoting digital innovation and cybersecurity, as well as safeguarding privacy and data protection. It also seeks to strike a balance between economic growth and the protection of individual rights and freedoms.Footnote 48 Lastly, the French government released the National Strategy for an Open and Secure Digital Space in order to provide a secure digital environment that upholds individual freedoms and human rights and to promote the growth of a strong digital economy while safeguarding civil liberties.Footnote 49 These states emphasize the attainment of a delicate balance between their own authority and the protection of human rights in the area of the internet. Their politics focus on promoting an online environment that combines openness and security, thus strengthening democratic values and enabling global collaboration. As an international organization, the Allied Joint Doctrine of the North Atlantic Treaty Organization (NATO) likewise acknowledges the principle of sovereignty in cyberspace.Footnote 50 Beyond this, however, NATO refrains from expressing any additional stance on the matter of sovereignty. However, as its member states consist of Western countries, it is clear that its approach to this matter is similar to that of the Western camp.
While these states are committed to promoting an open and linked internet, there are subtle differences in their perspectives due to national agendas and regulatory frameworks. The USA prioritizes the importance of unrestricted expression and limited oversight,Footnote 51 whereas the EU values the safeguarding of data and privacy.Footnote 52 The UK adopts a moderate stance between these two viewpoints.Footnote 53 Canada adopts a well-balanced strategy,Footnote 54 and Australia places a higher emphasis on security issues. France, on the other hand, supports significant government involvement in regulating cyberspace to protect national interests and maintain public order while still respecting democratic values.Footnote 55 These different methods highlight the various strategies used by the Western camp that support the global internet, with an emphasis on human rights in the digital realm. However, in practice, certain actions of these states do not reflect the purported respect for human rights, which will be elaborated upon shortly.
Overall, the conflict between these two camps is currently one of the most contentious issues with respect to the sovereignty in the realm of cyberspace. The non-Western camp exhibits a tendency to embrace a more cautious strategy when it comes to this novel domain and is unwilling to jeopardize its own interests.Footnote 56 Moreover, a primary concern of this camp is that embracing a global approach to cyberspace will result in the hegemony of states that possess greater technological capabilities in this field. Nevertheless, these states must not overlook the innovative and worldwide characteristics of the cyberspace. It is important to highlight that there are a few instances where the policies and regulations of the non-Western camp have addressed human rights in cyberspace activities. One such example is the enactment of the Personal Information Protection Law (PIPL) in China in 2021.Footnote 57 PIPL is China’s federal data privacy law that deals with companies, whether domestic or foreign, which handle the data of Chinese citizens. It establishes strong requirements for these companies, regarding the use of Chinese citizens’ personal information both at home and abroad.Footnote 58 Although this law provides for some human rights like privacy, non-discrimination, etc. for citizens, it only targets consumer–company relationships. Consequently, the control and surveillance of citizens by the state itself remain unregulated. Such instances of protection are rather rare, especially when compared to the constraints and prohibitions imposed on users’ online activities in these countries. As such, a far greater and more serious concern about the possible infringement of human rights that may arise from adopting this camp’s approach to cyberspace still remains.
In contrast, the Western camp adopts a more liberal approach and aims to establish an open and global internet. They prioritize human rights and argue that the non-Western camp’s stringent approach leads to the infringement of human rights values. The primary challenge faced by this camp, however, is the potential violation of sovereignty, which is not tolerated by many states. However, states in the Western camp are also not inclined to put their own interests at risk, just like the non-Western camp. Instances exist where Western states have prioritized their policies above all else, endangering human rights and risking their violation. In May 2024, TikTok, a popular social media platform, initiated a court dispute in the USA against the Biden administration, challenging the administration’s policy that would prohibit the application from being accessed in the USA until and unless it completely separated from its Chinese parent firm, ByteDance, within a year. The attack on TikTok has been defended by lawmakers and the White House on the grounds that the application’s connection to Beijing poses a significant national security risk. However, proponents of the ban have not shown any evidence of the Chinese government’s actual attempts to acquire data from the corporation, nor any substantiation that officials in China have ever exerted control over the material on the platform, which is utilized by 170 million Americans. According to the United States’ Constitution, the government is not allowed to restrict speech based on hypothetical or possible harm to national security.Footnote 59
Furthermore, the USA has implemented a prohibition on the sale and import of new communications devices from five Chinese firms, including Huawei. This restriction is specifically targeted at equipment used for 5G network infrastructure due to concerns regarding national security.Footnote 60 Another instance is the implementation of the Online News Act in Canada, which mandates that technology companies such as Google and Meta pay Canadian news outlets for their content. As a consequence, access to news on Facebook and Instagram is blocked for Canadians, thereby jeopardizing their right to access information.Footnote 61 The most recent example is the extensive censorship on the news of the ongoing war in Gaza. Human rights non-governmental organizations (NGOs) report minor advancements in halting the digital censorship of pro-Palestine voices on social media platforms, one year after the increased intensity of the Israel–Hamas war. Following the October 7th attack, the Palestinian Observatory of Digital Rights Violations has documented over 1350 cases of online censorship from key platforms via an open call on its website until the first of July 2024, predominantly concerning Meta, TikTok, X, and YouTube.Footnote 62
In conclusion, states may change the priority balance in favour of national security interests or distributive justice on different occasions, and that is a result of the competition between great powers. They might oversee human rights concerns to prevent their opponents from dominating the world of power. Nevertheless, it is important to recognize that such decisions are not always driven by cynical motives related to power dynamics. States may also support human rights online for principled reasons, such as promoting democratic values, fostering international cooperation, or responding to domestic advocacy. This multifaceted approach reflects the complexity of balancing power, justice, and human rights in the digital age. While both camps share concerns about national security, Western governments prioritize human rights more than states like Russia and China.
In addition to these two primary camps that are the dominant source of conflict within the global community, there are states such as India that do not align entirely or seamlessly with either of these camps; or Japan, which, while an Eastern state, more closely aligns with the position of Western countries. Japan’s involvement in the Quadrilateral Security Dialogue (“Quad”) alongside the USA, India, and Australia demonstrates its commitment to a cyberspace that is free, open, and safe.Footnote 63 This has also been confirmed in its Cybersecurity Strategy.Footnote 64 Additionally, India is also a participant in the Quad. However, it has implemented data localizations that restrict the transfer of data across borders, which contradicts the common objectives of the Quad.Footnote 65 However, to obtain an impartial and thorough understanding of this issue, it is necessary to collectively examine all actions and opinions of states.
II. Territorial sovereignty and its challenges in cyberspace
Territorial sovereignty is a fundamental principle of international law that establishes a state’s absolute authority and control over its own geographic area. It encompasses both the legal and practical abilities of a state to govern its territory and people without external intervention. This notion, based on the idea of state sovereignty, is essential in maintaining international order and stability. It indicates that a state possesses supreme power within its own borders, including the management of natural resources, the implementation of laws, and the regulation of activities.Footnote 66 In the case of Nicaragua v. United States, the International Court of Justice recognized the principle of sovereignty of the state and declared that it also applies to the internal waters and territorial sea of every country and to the airspace above its territory.Footnote 67 Territorial sovereignty articulates that a state exercises full, exclusive, and independent power over its territory, which is the vital basis of international relations.Footnote 68 Therefore, territory has been an important aspect of sovereignty in international law.Footnote 69 Similarly in cyberspace, states have sovereignty in their territories. However, due to the special characteristics of cyberspace, territorial sovereignty faces important challenges.
A. Current status of territorial sovereignty
1. Measures taken under UN channel
The UN has actively addressed cyberspace governance through expert groups and working mechanisms. In 2004, following a proposal by Russia, the UNGA established the first Group of Governmental Experts (GGE) on Developments in the Field of Information and Telecommunications in the Context of International Security, with representatives from 15 countries.Footnote 70 Subsequent reports from the third and fourth GGEs (in 2013 and 2015)Footnote 71 confirmed that the principles of state sovereignty and international norms, including those derived from humanitarian and human rights law, are applicable to ICT-related activities and infrastructure.Footnote 72 Building on this foundation, the sixth GGE was formed in 2018 under General Assembly Resolution 73/266, comprising 25 experts from 25 countries.Footnote 73 Working from 2019 to 2021 and consulting regional organizations such as the EU, AU, OAS, and ASEAN, its July 2021 report reaffirmed that state sovereignty extends to the conduct of ICT activities within national territory.Footnote 74 In parallel, the UN established an Open-Ended Working Group (OEWG) on 5 December 2018, open to all member states, to further develop rules, norms, and principles for responsible state behaviour in cyberspace.Footnote 75 The OEWG’s final report in 2021, ratified in March of the same year, emphasized adherence to international law and cautioned against actions that contravene it.Footnote 76 UNGA resolutions have adopted the reports of GGE 2015 and OEWG 2019–2021.Footnote 77 A new OEWG was then formed in December 2020 (under Resolution 75/240) to continue these efforts until 2025.Footnote 78 With permanent representation from the five UN Security Council members, these initiatives collectively demonstrate the UN’s evolving and comprehensive approach to applying international law in the cyber domain.
During the sessions, many states declared their position on the applicability of international law in cyberspace. It appears that certain states (Iran,Footnote 79 China,Footnote 80 Costa Rica,Footnote 81 Cuba,Footnote 82 Malaysia,Footnote 83 Pakistan,Footnote 84 Peru,Footnote 85 Russia,Footnote 86 Syrian Arab Republic,Footnote 87 and VenezuelaFootnote 88) wish to establish a legally binding instrument pertaining to the realm of cyberspace. On the other hand, a considerable number of states (Australia,Footnote 89 Austria,Footnote 90 Belgium,Footnote 91 Canada,Footnote 92 Chile,Footnote 93 Colombia,Footnote 94 Croatia,Footnote 95 the Czech Republic,Footnote 96 Egypt,Footnote 97 Estonia,Footnote 98 EU,Footnote 99 France,Footnote 100 Germany,Footnote 101 Ireland,Footnote 102 Israel,Footnote 103 Italy,Footnote 104 Japan,Footnote 105 the Netherlands,Footnote 106 New Zealand,Footnote 107 Nordic countries,Footnote 108 the Republic of Korea,Footnote 109 Switzerland,Footnote 110 UK,Footnote 111 Ukraine,Footnote 112 and the USAFootnote 113) hold opposing views on this matter. Countries adopting the latter position contend that existing customary international law already applies in cyberspace, so there is no legal vacuum to be filled. In addition, on the fifth meeting of the Fourth Substantive Session of OEWG on Information and Communication Technology, Vietnam stated that the OEWG can elucidate the implementation of international law rules in cyberspace through alternative means. These include requesting an advisory opinion from the International Court of Justice, conducting an examination by the United Nations International Law Commission, and submitting a review proposal to the Sixth Committee of the UN.Footnote 114
States advocating for a legally binding document have elaborated their positions on this matter. For instance, Venezuela asserts that international public law does not directly apply to cyberspaceFootnote 115 and Indonesia calls for contextual consideration.Footnote 116 Nicaragua claims that current international law inadequately addresses cyber issues.Footnote 117 China’s position that voluntary, non-binding norms are insufficientFootnote 118 is echoed by Russia,Footnote 119 Iran,Footnote 120 Pakistan,Footnote 121 and Zimbabwe,Footnote 122 which highlight a legal vacuum in regulating information and communication technologies. On 15 May 2023, Russia, in collaboration with Belarus, North Korea, Nicaragua, and Syria as co-sponsors, presented the Concept of the UN Convention on Ensuring International Information Security (IIS) as an official document for the 77th session of the UNGA.Footnote 123 The proposed convention’s concept is founded on the ideas of sovereign equality among states and non-interference in their domestic affairs.Footnote 124 Russia reiterated its demand for the conclusion of such a treaty in the compendium of statements regarding the third annual progress report in September 2024.Footnote 125
In contrast, the majority of other countries opposing the development of a new legally enforceable instrument assert that such a proposal would constitute a substantial setbackFootnote 126 in the progress of international peace and stability, resulting in confusion and misinterpretation. The USA deems the recommendations for the progressive development of international law in this domain as vague and unfeasible.Footnote 127 The EU and its member states observe that, currently, they do not perceive the need for the creation of a new international legal instrument concerning cyber issues. They share worries regarding the potential for engaging in a contentious and protracted process that may yield no meaningful or constructive outcomes, thereby jeopardizing current practical initiatives to address the significant and urgent issue of escalating cyber incidents, as well as adversely affecting efforts to prevent conflict and foster stability in cyberspace.Footnote 128
The OEWG’s efforts will continue until 2025, and it remains to be seen if states will achieve consensus on the specifics of implementing international law in cyberspace. Nonetheless, according to the desire of states, a new permanent mechanism might be launched. Therefore, a breakthrough in this field via OEWG is unlikely. More than 40 states submitted a proposal under the title of a Program of Action (PoA) to promote the responsible behaviour of states in cyberspace, the purpose of which is to end the “dual track discussions” of the GGE and the OEWG and to create a “permanent forum” in the UN to consider the utilization of ICTs by states within the framework of global security.Footnote 129 The First Committee of the UNGA welcomed the idea of establishing a PoA pertaining to cybersecurity in November 2022, obtaining an overall count of 156 affirmative votes.Footnote 130 It might serve as a permanent, comprehensive, and proactive mechanism subsequent to the conclusion of the 2021–2025 OEWG’s tasks. The primary objectives of this permanent forum revolve around four key areas. The PoA, if established, would address the issue of ICT security in the context of international security with the aim of promoting an open, secure, stable, accessible, peaceful, and interoperable ICT environmentFootnote 131; strengthen the ICT security capacity of all states, including to develop and implement the cumulative and evolving framework for responsible state behaviour in the use of ICTsFootnote 132; and promote engagement and cooperation with interested parties and stakeholders, including businesses, NGOs, and academia.Footnote 133 One of the functions of the PoA is to examine the application of international law to the use of ICTs, recognizing the potential for future development of additional binding obligations, if warranted, and to assess any deficiencies in the current application of international law regarding ICTs, while also contemplating the establishment of further legally binding obligations.Footnote 134 All in all, the PoA has yet to be established and will be subject to a vote in the upcoming OEWG sessions.
2. State practice
Until now, numerous states have declared their opinions on the application of territorial sovereignty in cyberspace. Similar to the issue of sovereignty itself, states are divided into two major sides on their views about territorial sovereignty in cyberspace, which will be discussed in this section. One side is of the opinion that not every application of sovereignty to another state’s territory in cyberspace would amount to the violation of its sovereignty. Cyberspace is a global and open domain, and states often exercise their jurisdiction in another state’s territory without legal repercussions.Footnote 135 Germany
… recognizes that due to the high degree of cross-border interconnectedness of cyber infrastructures, a state’s exercise of its jurisdiction may have unavoidable and immediate repercussions for the cyber infrastructure of other States. While this does not limit a state’s right to exercise its jurisdiction, due regard has to be given to potential adverse effects on third States.Footnote 136
New Zealand does not consider that territorial sovereignty prohibits every unauthorized intrusion into a foreign ICT system or prohibits all cyber activity which has effects on the territory of another state.Footnote 137 The EU asserts that “a violation of the obligation to respect sovereignty may occur when a cyber operation, attributable to a State, infringes upon another State’s territorial integrity or leads to interference with or usurpation of inherently governmental functions of another State”.Footnote 138 Austria,Footnote 139 Canada,Footnote 140 Costa Rica,Footnote 141 Denmark,Footnote 142 Ireland,Footnote 143 Israel,Footnote 144 Italy,Footnote 145 Japan,Footnote 146 Netherlands,Footnote 147 Norway,Footnote 148 Poland,Footnote 149 Sweden,Footnote 150 and the USAFootnote 151 share the same views.
On the other side, some states believe that any penetration of the cyberspace by one state will amount to a violation of sovereignty and as such, is prohibited under international law. China declares that “the acts [that amount to the violation of sovereignty] may include, among others, unauthorized penetration into the network systems in the territory or within the jurisdiction of another State”.Footnote 152 Likewise, Iran has stated that if and when there is any utilization of cyberspace that involves the unlawful intrusion of the (public or private) cyber structures which are under the control of another state, this may be considered a violation of the sovereignty of the targeted state.Footnote 153 The African Union,Footnote 154 Brazil,Footnote 155 and FranceFootnote 156 have adopted the same approach towards territorial sovereignty in cyberspace.
3. The Tallinn manuals
At the academic level, efforts have been made to clarify the issue of applying international law in cyberspace, the most famous of which are Tallinn Manuals 1 and 2. NATO, and specifically its Cooperative Cyber Defense Centre of Excellence (CCDCOE), brought together experts in Estonia, which resulted in the drafting of Tallinn Manual 1 on the International Law Applicable to Cyber Warfare in 2013. This manual included 95 rules.Footnote 157 Four years later, the Tallinn Manual 2 on international law applicable to cyber operations included most of the contents of Tallinn Manual 1 regarding the law of use of force and armed conflicts, and by completing issues such as sovereignty and jurisdiction, and adding issues like diplomatic and consular rights, due diligence, the law of the sea, human rights, peaceful settlement of disputes, etc., it was published, containing 154 rules.Footnote 158 Regarding the exercise of sovereignty in cyberspace, Tallinn Manual 2 declares:
States enjoy sovereignty over any cyber infrastructure located on their territory and activities associated with that cyber infrastructure. Although territoriality lies at the heart of the principle of sovereignty, in certain circumstances, states may also exercise sovereign prerogatives such as jurisdiction over cyber infrastructure and activities abroad, as well as over certain persons engaged in those activities.Footnote 159
It further affirmed that states may exercise their sovereign rights over items or entities that engage in cyber activities within their territory.Footnote 160 The Tallinn Manuals serve as a valuable point of reference for discussing these matters. However, it is necessary to acknowledge that these manuals do not comprehensively encompass all concerns, and even among specialists, there exist areas of disagreement.Footnote 161 Moreover, Tallinn Manuals 1 and 2 have faced international criticism. Four national military manuals on the law of armed conflict – those from Canada, Germany, the UK, and the USA – were explicitly referred to by the experts in Tallinn Manual 1.Footnote 162 Others may have been used indirectly, as the Tallinn Manual 1 extensively draws on the ICRC Study on Customary International Humanitarian Law, which has a long list of national manuals on the subject.Footnote 163 Furthermore, the composition of the participants in the drafting process of Tallinn Manual 1 primarily consisted of specialists in armed conflicts, with a predominantly Western orientation.Footnote 164 In the context of Tallinn Manual 2, an endeavour was undertaken to address this issue by extending invitations to experts hailing from China, Japan, Israel, and Thailand. However, it is worth noting that the majority of participants still originated from Western states.Footnote 165 Experts in the fields of human rights, international telecommunication law, etc. were also invited.Footnote 166 The International Committee of the Red Cross was also present as an observing member in both projects.Footnote 167 Michael Schmitt, the General Editor of Tallinn Manual 2 has stated:
…Tallinn 2.0 does not reflect the views of any State or group of States. … This is not to say that State views were not considered. On the contrary, the Dutch Ministry of Foreign Affairs sponsored “The Hague Process,” by which 50 countries (including all of the UN Security Council’s five permanent members) and international organizations convened in the Hague during three meetings to consider draft manual chapters, receive briefings from key members of the IGE, and offer verbal and written input to the team.Footnote 168
Although expert-driven,Footnote 169 the process of formulating Tallinn Manual 2 involved extensive consultations with states, providing them with the opportunity to have an active role in shaping the codification process of the law. A number of states involved in cyberoperations maintained, throughout The Hague Process and beyond, a policy of silence and ambiguity in relation to their legal positions on the regulation of cyberoperations, with a view to preserving high levels of operational flexibility by adopting a “wait and see” approach. The reluctance by some states to take a public position on the contents of the applicable law during the drafting of Tallinn Manual 2 may explain the controversy that unexpectedly broke out after the issuance of the Manual, which concerned the designation of the prohibition against infringement of sovereignty as a specific rule of international law.Footnote 170 As such, the Tallinn Manuals cannot easily be considered as a reflection of opinions of the international community. However, it is worth mentioning that many states cite Tallinn Manual 2 in their discussion of the application of international law to cyber operations – either explicitly or by utilizing similar language in their formulations – particularly on sovereignty. Another critique pertaining to these manuals is the process by which the experts were selected. The selection process of experts in Tallinn Manuals 1 and 2 is not clear, and to reject speculations about the experts’ lack of impartiality, it should be fully clarified.Footnote 171
In 2021, the CCDCOE has launched the Tallinn Manual 3.0 Project, a five-year venture that will involve the revision of existing chapters and the exploration of new topics that are of importance to states. In addition to state practice and states’ official statements on international law, the activities and statements of international fora, such as those at the UN and regional levels, academic scholarship, and multistakeholder initiatives involving governments, industry, and civil society, will be considered. An essential facet of the project is engagement with states,Footnote 172 which will be afforded the opportunity to offer national perspectives for consideration in the revision of the Manual. The nature of the Tallinn Manual will remain unchanged; it will continue to be a non-legally-binding scholarly work by distinguished international legal academics and practitioners, intended to provide an objective restatement of international law as applied in the cyber context. It is policy-neutral and politics-neutral and thus will not represent the legal position or doctrine of any state or international organization, including the CCDCOE.Footnote 173
4. Open-ended ad hoc intergovernmental committee of experts
The UN open-ended ad hoc intergovernmental committee of experts plays a pivotal role in shaping the discourse on how sovereignty applies in cyberspace. By addressing topics such as state jurisdiction, enforcement of international law, and territorial integrity in the digital domain, the committee’s work directly engages with the fundamental debate between the cyber sovereignty approach, championed by states like China and Russia, and the open and global internet favoured by Western nations. It provides a platform for states to articulate and negotiate their competing visions. These discussions underscore the tension between national control and global connectivity, offering insights into the practical implications of sovereignty in cyberspace and the evolving dynamics between the two dominant camps.
In 2019, Russia, with the support of China, Cambodia, Belarus, North Korea, Myanmar, Iran, Venezuela, and Nicaragua put forth a proposal in the UNGA for a convention to combat cybercrime. In December 2019, the UNGA adopted this resolution and formed the ad hoc intergovernmental committee to “Elaborate a Comprehensive International Convention on Countering the Use of Information and Communication Technologies for Criminal Purpose”.Footnote 174 Over the last 10 years, Russia has strongly promoted the establishment of a new global cybercrime treaty, notwithstanding the presence of the Budapest Convention on Cybercrime, an international treaty drafted by the Council of Europe in 2001. Since then, 66 states globally have ratified the Budapest Convention, with other countries currently in the process of ratification. Although it was a member of the Council of Europe then, Russia did not accede to the Budapest Convention, asserting that the convention infringes upon state sovereignty by permitting cross-border cybercrime activities.Footnote 175 This proposed treaty is a Russian initiative challenging the Council of Europe’s Budapest Convention, arguing that Article 32(b) explicitly allows states to breach the sovereignty of other states:
A Party may, without the authorisation of another Party:
b) access or receive, through a computer system in its territory, stored computer data located in another Party, if the Party obtains the lawful and voluntary consent of the person who has the lawful authority to disclose the data to the Party through that computer system.Footnote 176
The resolution provoked significant dissent from Europe, the USA, Western civil society, and certain human rights groups. These groups do not see reasons for negotiating a new treaty when an existing one is in place. Furthermore, allocating time and finite resources to writing a new treaty when those efforts could be more effectively devoted towards improving the existing Budapest Convention seems unreasonable. Numerous supplementary protocols have been incorporated. Furthermore, drafting a complete treaty appears to detract from the need to enhance state capabilities in identifying, punishing, and combatting cybercrime. Instead of improving and augmenting the Budapest Convention, Russia’s proposed treaty considerably broadens the concept of cybercrime, empowering states to classify nearly any online activity as a cybercrime. It encompasses intentionally ambiguous terminology and meanings, allowing broad interpretation and potential misuse in the future.Footnote 177 The convention raises three major concerns, namely, its broad scope, the absence of human rights protections, and the threats it poses to children’s rights.Footnote 178 Following General Assembly decision 78/549, the reconvened final session of the Committee took place in New York from 29 July to 9 August 2024. During this session, the Committee approved the draft resolution titled “Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes” for consideration by the UNGA, annexing the approved draft text of the new Cybercrime Convention for the General Assembly’s adoption. The session also reviewed interpretative notes on certain articles of the proposed Convention and resolved to include them as an annex in the session report.Footnote 179 The Convention was then adopted on 24 December 2024.Footnote 180
The Convention prohibits cross-border operations conducted by state computer networks without the authorization of their respective authorities. Russia refrained from joining the Budapest Convention primarily because of its provision for cross-border activities. Moscow contends that permitting outsiders to execute cross-border cyber activities may jeopardize its own security and sovereignty. Another significant shortcoming of the Budapest Convention is its criminalization of only nine categories of cyber offences, despite the fact that this number has risen over the past two decades.Footnote 181 The Convention, currently, delineates 11 distinct types of crimes. However, the UNGA has called on the ad hoc committee to continue its work to possibly negotiate a protocol for additional criminal offences.Footnote 182 The text of the Convention also emphasizes the critical matter of international collaboration and anticipates the establishment of several new entities and mechanisms.
The Convention provides for rather strict rules on sovereignty in cyberspace in situations where there seem to be a contradiction to a state’s domestic laws and interests. According to Article 5(2) of the Convention: “Nothing in this Convention shall entitle a State Party to undertake in the territory of another State the exercise of jurisdiction and performance of functions that are reserved exclusively for the authorities of that other State by its domestic law.”Footnote 183 Furthermore, Article 40(21) states: “Mutual legal assistance may be refused: … (b) If the requested State Party considers that execution of the request is likely to prejudice its sovereignty, security, ordre public or other essential interests.”Footnote 184 However, the Convention, at Article 22, has provided some bases for extraterritorial jurisdiction, namely, active and passive nationality principle.
B. Challenges and potential solutions
Approaches towards the concept of territory in cyberspace highlight different aspects of the complex relationship between cyberspace and territorial sovereignty. While international law can be applied to cyber activities, and states may exercise sovereignty over different layers of cyberspace within their jurisdiction, the unique nature of cyberspace complicates this application. The absence of clear physical demarcations in cyberspace means that jurisdictional claims based on traditional territoriality face significant legal and technical challenges. The following paragraphs will provide a detailed explanation of these challenges.
Some scholars are of the opinion that cyberspace needs a physical and tangible infrastructure to exist.Footnote 185 Humans have the capacity to shift specific activities and behaviours to the realm of cyberspace, engaging with or immersing themselves in it to a significant extent. However, it is important to note that they are unable to completely detach themselves from the physical world. Hence, it may be argued that cyberspace and its organization are inherently intertwined with the governance of states. It is not distinct from non-digital space. Transactions conducted in cyberspace entail the involvement of actual individuals residing within a specific jurisdiction who engage in commercial interactions with other individuals residing within the same or a different jurisdiction. Additionally, these transactions may encompass activities that have tangible effects within a particular jurisdiction.Footnote 186 Thus, a state may extend its sovereignty over the physical layer of cyberspace or infrastructure located within its borders. It can also exercise authority over the social layer, that is, its citizens. State sovereignty can also apply to the effects of cyber operations imposed on its territory, irrespective of their source. In addition, the state can exercise sovereignty over data that passes through its infrastructure or that originates or ends up in that territory.Footnote 187 Therefore, international legal standards with territorial limitations can also be extended to cyber activities.Footnote 188
At the same time, scholars have further noted that network boundaries do not directly correspond to geographic borders.Footnote 189 Cyberspace significantly weakens the connection between online events and physical locations. The advent of the World Wide Web has disrupted the connection between geographical location and various aspects related to online behaviour. These include the jurisdictional authority of local governments to regulate online conduct, the consequences of online behaviour on individuals or entities, the legitimacy of local governments’ endeavours to regulate global phenomena, and the ability to ascertain the physical location for determining the relevant set of regulations.Footnote 190 Moreover, companies such as Google perceive cyberspace as an open “storeroom” that is collectively owned, devoid of any restrictions.Footnote 191 Consequently, the internet dramatically eliminates the possibility of establishing laws based on physical borders, at least with regard to the fact that rule-making in cyberspace should be done within a specific territorial framework.Footnote 192 The absence of territorial boundaries in cyberspace can be attributed to the fact that internet transmissions occur without the presence of physical landmarks or barriers that would otherwise separate individuals and geographic locations. Users in virtual space cannot be aware of crossing physical boundaries like in the real world. For this reason, in this space, physical borders can no longer indicate entering the territory of another state.Footnote 193
Since no trace of a border can be discerned in cyberspace, a definite domain cannot be determined. Issues that depend on the current, fluid, and global character of cyberspace make it difficult for states to exercise full sovereignty in this area.Footnote 194 At the moment, although most states are silent about creating new borders and continue to adhere to the traditional geographic borders approach, certain states have made efforts to acknowledge the distinctive attributes of cyberspace in this regard. “In New Zealand’s view, the application of the rule of territorial sovereignty in cyberspace must take into account some critical features that distinguish cyberspace from the physical realm. In particular: … i) cyberspace contains a virtual element which has no clear territorial link….”Footnote 195
In addition, in Netherland’s view, in cyberspace, the concepts of territoriality and physical tangibility are often less clear.Footnote 196 Romania has stated:
At the same time, we acknowledge that the difficulty in relation to this principle lies in the absence in the cyberspace context of the territoriality and physical dimensions, which are the specific elements of the analysis when dealing with the sovereignty in the traditional sense.Footnote 197
Lastly, Switzerland is of the view that “owing to the special characteristics of cyberspace, which has no clear territorial boundaries, putting the principle of sovereignty into practice is a particular challenge.”Footnote 198
In the following paragraphs, we will examine two potential solutions to solve the challenge of territorial sovereignty in cyberspace; one of which is defining sovereignty by considering the state’s competence and function, independent of territorial considerations. Territory refers to the physical space where a state’s sovereignty is often manifested. The phrase sovereignty is frequently employed as a synonym for territorial sovereignty.Footnote 199 The significance of territory in international law arises from the incorporation of Roman legal principles into medieval feudal Europe, which fostered the notion that territory is possessed and exclusively controlled by the state.Footnote 200
In the meantime, an alternative hypothesis known as the competence theory has been put forth, presenting a contrasting viewpoint to the previous theories. According to this view, territory is not a possession under state ownership or as one of its constituent aspects. Instead, it is regarded as a geographical framework within which domestic law holds jurisdiction.Footnote 201 The idea of competence subsequently gave rise to a subtheory known as function theory.Footnote 202 As per this theoretical framework, the authority of a state is not derived from international law but rather from the inherent entitlement of the state to use its power within the boundaries acknowledged by the international law.Footnote 203 The delineation of territory is established through the state’s function, which takes place through the exertion of pertinent sovereign power.Footnote 204 This implies that the state has the ability and authority to exercise its sovereignty outside its geographical boundaries, based on its competence and function. In this instance, the identification of a state’s competence can be ascertained by considering specific legal and political criteria, subject to the consent of states.Footnote 205
Moreover, the utilization of function theory provides the potential for states to assume a controlling role in cyberspace based on their sovereign capabilities.Footnote 206 The function theory in cyberspace necessitates collaborative endeavours among states to identify the specific interests that need safeguarding through international law, as well as to establish the threshold at which the violation of those interests occurs.Footnote 207 Some scholars have concluded that a state’s cyber boundaries encompass every location in cyberspace where its interests are affected.Footnote 208 Competence theory and function theory shift the focus from geographical borders to the competencies and functions of the state. Under these particular theories, the concept of the exclusive sovereignty of a state will not be presumed with regards to specific actions and communications. Instead, there will be a recognition of both overlapping and coexisting states. In addition, this approach places significant emphasis on the rights of states within and beyond their borders, and it does not inherently require states to automatically uphold each other’s internal territorial sovereignty, unless that action is explicitly prohibited under international law, such as, for example, intervention in the domestic affairs of another state.Footnote 209
In general, extraterritorial jurisdiction empowers states to unilaterally regulate persons, conduct or property beyond their borders.Footnote 210 Since 1925, many governmental and private efforts have been made to codify the rules of international law governing extraterritorial jurisdiction.Footnote 211 This issue has faced obstacles both from political and legal perspectives since its inception. The Committee of Experts of the League of Nations declared that “international regulation of these questions by way of a general convention, although desirable, would encounter grave political and other obstacles”.Footnote 212 Similarly, after 18 years of work, the Institut de Droit International admitted that this topic has failed to yield a consensus in any forum in which it has been presented.Footnote 213 This finding remains relevant today, and it is likely the reason why the ILC has not included this issue on its current working agenda.Footnote 214 However, in spite of the controversy regarding the customary status of extraterritorial jurisdiction in international law, states have been engaged in these activities in different forms and on multiple bases.
The passive personality principle may be understood as referring to the jurisdiction that a state may exercise with respect to conduct abroad which injures one or more of its nationals.Footnote 215 According to Article 22(2) of the UN Cybercrime Convention: “… a State Party may also establish its jurisdiction over any such offence when: (a) The offence is committed against a national of that State Party”.Footnote 216 Recognition of passive personality jurisdiction by the Cybercrime Convention would represent a significant jurisdictional expansion. It would legitimize the use of passive personality jurisdiction in any context, and risk its acceptance becoming customary international law. Unlike previous uses of passive personality jurisdiction, its inclusion here would be freed from substantive limits (to terrorism or violence) and functional limits, as exist in the UN corruption and organized crime treaties.Footnote 217 Passive personality jurisdiction undermines the fundamental purpose of a treaty – unifying the cybercrime regime. Rather than encouraging cooperation on a shared core of cybercrimes, the treaty permits fragmented criminal enforcement that legitimizes states exercising jurisdiction over many cyber offences – defined as each state chooses – against any of their nationals.Footnote 218
The protective principle may be understood as referring to the jurisdiction that a state may exercise with respect to persons, property, or acts abroad which constitute a threat to the fundamental national interests of a state, such as a foreign threat to the national security of a state.Footnote 219 China adopts the protective principle in cybersecurity and data security laws. According to Article 75 of its Cybersecurity Law, any overseas institution, organization, or individual that attacks, intrudes into, disturbs, destroys, or otherwise damages the critical information infrastructure of China, causing any serious consequence, is subject to legal liability in accordance with the law.Footnote 220 The case of Tidal Music AS v The Public Prosecution Authority Footnote 221 before the Norwegian Supreme Court and the case regarding the LinkedIn Corporation decided by the Moscow City CourtFootnote 222 are significant case studies on this matter.
Germany asserts that a state’s jurisdiction may under certain conditions apply to situations beyond its borders, i.e. according to the principles of active and of passive nationality as well as universality.Footnote 223 France’s national cyber incident classification system is based on a technical and effects-based assessment of the cyber operation.Footnote 224 The idea of an effects-based approach in relation to state cyber activity from outside the territory that has harmful effects in another territory is also one that the EU has recently adopted in relation to its newly enacted cyber sanctions regime.Footnote 225 the Directive (EU) 2019/71321 imposes conditions before the Member States can practice extraterritorial passive personality jurisdiction in cyberspace.Footnote 226 Belgium,Footnote 227 Denmark,Footnote 228 Netherlands,Footnote 229 Sweden,Footnote 230 and the Republic of KoreaFootnote 231 permit extraterritorial jurisdiction in certain cases. The European Convention on Human Rights adopts a functional approach towards jurisdiction where, once a public–power relationship is established, human rights obligations apply both domestically and abroad.Footnote 232 Jurisdiction is defined by a state’s human rights functions, extending its authority beyond traditional territorial limits to any area where it effectively exercises public power.Footnote 233
The Microsoft Ireland centred on whether a US warrant could compel a US-based company to produce data stored abroad, raising concerns over the extraterritorial application of US law. Although the matter reached the Supreme Court, the implementation of the CLOUD Act in 2018 prevented a definitive ruling.Footnote 234 The CLOUD ActFootnote 235 clarifies that US law enforcement can access overseas data under specified circumstances and establishes frameworks for bilateral agreements. This case exemplifies the extraterritorial exercise of state functions in law enforcement. Under CLOUD Act agreements, orders can be directly served across borders, subject solely to the issuing state’s law.Footnote 236 Alongside the USA, the EU adopted the 2023 E-evidence Regulation to streamline cross-border data access among member states.Footnote 237 This legislation provides a faster alternative to traditional mutual legal assistance, addressing challenges posed by the unpredictability and loss-of-location of electronic evidence. It allows member state authorities to issue European production or preservation orders, compelling service providers within the Union to supply or safeguard evidence regardless of its location,Footnote 238 while decoupling enforcement jurisdiction from physical data storage.Footnote 239 However, these measures are not a perfect fitFootnote 240 and as they originate from a Western perspective, they are unlikely to be accepted by Russia, China, and similar states in the foreseeable future.
The utilization of competence/function approach is not recognized in the current international law. However, examples would be of great assistance in allowing us to better understand its probable application in the real world. Consider that Country A asserts regulatory control over a foreign data centre storing its citizens’ personal data, claiming competence due to the direct impact despite the centre being outside its borders. Similarly, if a cyber-attack from Country B disrupts Country A’s critical infrastructure, Country A may invoke function-based authority to respond extraterritorially. Moreover, states setting thresholds for securing online financial transactions in a borderless environment further exemplify competence and function theories, focusing overall on practical impacts rather than strict geographical limits. This balanced approach emphasizes safeguarding national interests over traditional territorial sovereignty, especially for actions with tangible national effects. The competence/function theory should not be confused with the effects doctrine. While the effects doctrine focuses on the impact of an external event on the state, competence and function theories emphasize a state’s intrinsic capacity and legal entitlement to act, even extraterritorially, based on its core functions and responsibilities.
The competence/function theory expands the understanding of jurisdiction by advocating for collaborative, competence-based frameworks suited for cyberspace’s dynamic, borderless environment. It does not discard existing legal models – such as the effects doctrine, universal jurisdiction, or passive personality – but rather builds on them to enhance states’ capacity to address cyber threats. It emphasizes cooperation and the recognition of functional duties over a wholesale shift to a new model. Instead, states should evolve existing practices by revising domestic laws and facilitating technology transfer to address imbalances.
Jurisdictional reasonablenessFootnote 241 could be a flexible framework that replaces rigid territorial boundaries with fluid criteria – such as effects, connections, and interests – to manage overlapping enforcement claims. It employs an interest-balancing test, weighing factors like the location of harm and the involved parties’ ties, ensuring that extraterritorial jurisdiction is exercised proportionately. This approach complements competence/function theory, which asserts that a state’s authority is rooted in its capacity to govern activities impacting its interests beyond fixed borders. Under a reasonableness-based interest-balancing test, a state’s claim to exercise extraterritorial jurisdiction is assessed by weighing factors like the location of the harm, the nationality of the involved parties, the extent of a state’s connection to the conduct, and the overall impact on its vital interests.Footnote 242 Together, these concepts provide practical criteria for determining when extraterritorial enforcement is justified, fostering cooperative regulation among states and mitigating conflicts in today’s interconnected global governance landscape.
Since it allows states to define their sovereignty based on their competence rather than solely physical infrastructure and authorizes a shared functional approach, it is better suited for addressing issues that require multilateral action, such as cybercrime, cyberterrorism, and global data flows. This approach is more likely to strike a balance between state sovereignty and maintaining the open, interconnected nature of the global internet. This practice will undoubtedly encounter opposition from the non-Western camp as it allows states to exercise sovereignty within one another’s territories. To effectively execute this method, however, the extent of the effect and the interests of states must be clearly defined. Ultimately, the resolution of the persistent issue of sovereignty in cyberspace necessitates the cooperation of the international community, especially the rival camps.
An additional suggestion that may be employed to address the issue of implementing sovereignty in the realm of cyberspace is the utilization of Functional Equivalent of the Border (FEB). In the realm of cyberspace, the existence of borders is recognized, but with a deliberate decision to not explicitly acknowledge them in the same manner as physical boundaries such as those found on land or at sea. The advent of technologies that impact conventional notions of boundaries is not a recent phenomenon. The advent of air transportation necessitated a paradigm shift in conventional border security perspectives. The concept of borders in cyberspace can be deemed to have some similarities with that of air transportation.Footnote 243 As is often understood, it is not reasonable to anticipate that an aircraft, while airborne and seeking entry into a certain jurisdiction, would undergo customs inspections and associated inspections inside the same airspace upon crossing the border. Due to this rationale, the first location of the aircraft’s landing is regarded as the border, identified as the FEB.Footnote 244 The FEB provides the very first possibility to effectively conduct border controls on that aircraft.Footnote 245 In order to utilize the FEB, it is imperative to take into account the following conditions: firstly, a reasonable certainty that the person or thing has crossed the border must exist. Secondly, it must be reasonably inferred that there have been no significant alterations since the first formation of the connection with the border. Lastly, the aircraft should undergo inspection promptly upon entering the border.Footnote 246 If one were to interpret the current territorial border as a cyber border, the point at which data transmission cables intersect the physical boundaries would serve as the demarcation line between two countries.
To adapt the FEB concept for the cyber realm, it is essential to recognize its inherent differences from the physical world. In a traditional context, the FEB relies on clear indicators such as the confirmed crossing of a border, the unaltered state of the connection post-entry, and the immediate inspection of an aircraft upon arrival. However, in cyberspace these criteria become more fluid and challenging to verify. This is due to the potential for data to traverse alternative pathways, such as via satellite transmissions, and so reach different jurisdictions, unlike a single aircraft landing on a territory. Furthermore, it is important to note that border controls and inspections cannot be conducted in a manner similar to those implemented on airplanes while in flight.Footnote 247 Cyber operations are often covert and can be deliberately masked, meaning there is rarely absolute certainty that a digital incursion has occurred within a state’s territory. Moreover, unlike a controlled airport border, cyber intrusions are not confined to government systems; they can target any digital infrastructure, including the personal or corporate networks of individuals, further complicating the notion of a definitive border. Additionally, while airlines are mandated to notify and undergo inspection when entering a territory, non-state actors in cyberspace face no such obligations, rendering traditional notification mechanisms inapplicable. Consequently, applying FEB in the cyber context requires a more flexible, interest-based framework – one that substitutes fixed territorial markers with dynamic criteria such as the nature of the digital connection, the actual or potential impact on state interests, and a balance of competing claims, thereby accommodating the unique, borderless, and covert characteristics of cyberspace.
The most accurate description of a cyber border is the FEB, which indicates the initial point of practical examination for data, including network routers, computer servers, personal computers, and other network devices.Footnote 248 One could consider the territory of cyberspace to be a collection of a state’s network device ports, directly linked to the network devices of other nations. We can delineate the state’s cyber area based on its national network of devices. As a result, the network map represents the state of cyberspace.Footnote 249 To be more precise, multiple techniques may be employed to implement FEB in the realm of cyberspace. Border routers function as the primary barrier at the locations where data enters or leaves a network.Footnote 250 For example, a company’s internet traffic passes via its border router, enabling the application of essential security measures. Firewalls are positioned at the network perimeter and analyze incoming and outgoing data based on predetermined security criteria.Footnote 251 This procedure resembles a digital traffic checkpoint similar to border control. ISPs may act as guardians for managing the flow of data into and out of the larger internet infrastructure.Footnote 252 They have the capacity to monitor and control the transfer of data, preventing harmful actions and filtering content, similar to the procedures used during physical border customs inspections. This does not imply that the service providers should be liable for malicious or non-reliable content. Instead, it signifies that they possess the capacity and control over the data and may cooperate with states to reach a suitable solution on this matter.
States can utilize a range of methods to enforce jurisdictional control while implementing the FEB. These tools include the deployment of intrusion detection systems and intrusion prevention systems placed at the periphery of the network. Their purpose is to monitor and analyze traffic patterns in order to detect possible threats.Footnote 253 In addition, governments have the option to use data loss prevention tactics at border devices to carefully examine incoming and outgoing traffic.Footnote 254 Lastly, routers and firewalls implement access control lists and security rules, which regulate network access and define the parameters of data exchange.Footnote 255
It is important to acknowledge that the FEB, by focusing on the entry and exit points of data (like routers and servers), oversimplifies the fluid nature of data flow, which can cross multiple jurisdictions in milliseconds. This can lead to overlapping claims of jurisdiction, risking legal uncertainty and the potential for conflict between states. Furthermore, by treating network routers and servers as points of control akin to physical borders, states may feel justified in imposing mass surveillance or screening measures on data entering or leaving their networks. This could potentially amount to challenges in the realm of international human rights law, particularly in relation to privacy rights. In practice, enhanced surveillance and monitoring at digital “borders” might lead to excessive data collection, infringing on privacy and the right to free expression. The opaque nature of cyber operations means that determining when and how a cyber operation has “crossed” a border could be manipulated to justify unwarranted intervention or censorship. This, in turn, might stifle dissent and limit access to information, as states could use FEB as a pretext to control or suppress online communications. Such measures risk causing widespread human rights harm by eroding fundamental freedoms and subjecting large numbers of people to indiscriminate monitoring and control.
Acceptance or rejection of the FEB concept in cyberspace will vary significantly among states. Some states – particularly those with a strong emphasis on national security – may welcome FEB as a tool to better delineate and control digital borders. For example, states with robust cyber defence strategies might view it as a necessary evolution of traditional border control to address covert cyber intrusions. In contrast, states that favour a more open, globalized internet – often aligned with liberal democratic values – could oppose rigid cyber border enforcement for fear that it may limit cross-border collaboration or be used to justify censorship. Moreover, developing countries might be cautious about adopting FEB if they see it as a mechanism that could reinforce existing imbalances in cyber power, thereby undermining their ability to negotiate on equal terms in international cyber governance.
As discussed above, we can conclude that the FEB is more aligned with the approach and interests of the non-Western camp. FEBs could contribute to the fragmentation of cyberspace into separate national segments by reinforcing national borders in this realm. It seems that the FEB approach would not solve the tensions between Western and non-Western approaches towards sovereignty in cyberspace. FEB works well for states that prioritize national control over their digital environments. It offers a clear framework for data sovereignty, allowing states to exert control over data as it crosses their networks. This control is especially important for states that have strict data localization laws or are concerned more about protecting their interests and national security than the free flow of information in the digital space.
III. Conclusion
The application of international law to cyberspace remains one of the most complex and contentious challenges of our time, largely due to the borderless nature of the digital realm and the divergent views on sovereignty. As this paper has demonstrated, states largely remain divided between the restrictive cyber sovereignty approach and the more liberal Western perspective. Amidst these competing paradigms, the competence/function theory emerges as a rather realistic and suitable approach for the future. This theory shifts the focus from rigid territorial definitions to an assessment of a state’s inherent capacity to govern activities that affect its interests, thereby offering a nuanced alternative that builds on, rather than replaces, traditional models such as the effects doctrine, universal jurisdiction, and passive personality. To move this promising approach from theory to practice, several concrete topics for future research should be pursued.
Firstly, empirical studies on case examples can offer valuable insights into how extraterritorial jurisdiction has been applied, identifying strengths and shortcomings in current legal instruments. Comparative research across different jurisdictions could also illuminate best practices for integrating competence/function theory with existing enforcement frameworks. Secondly, there is a need for normative research aimed at developing standardized criteria for a reasonableness-based interest-balancing test. Such research should focus on identifying the key factors – such as the location of harm, the nationality of involved parties, and the extent of a state’s functional ties to a cyber incident – that justify the exercise of extraterritorial jurisdiction. Developing these guidelines would help mitigate conflicting claims and promote a harmonized global cyber governance regime. Thirdly, future research must address the human rights implications inherent in extraterritorial cyber enforcement. Given the potential risks of mass surveillance and data overreach, studies should explore the development of robust safeguards and accountability mechanisms which ensure that state actions in cyberspace do not infringe on privacy, freedom of expression, and other fundamental rights. Such research could inform the drafting of legal instruments that balance state sovereignty with the protection of individual liberties.
Furthermore, exploring the establishment of a permanent international forum for cyber governance represents another promising avenue for future research. Building on the experiences of the UN OEWG and the proposed PoA, this forum could serve as a continuous platform for dialogue, capacity-building, and the development of multilateral legal instruments. It would facilitate cooperation between states with differing approaches – bridging the gap between Western and non-Western paradigms – and promote technology transfers and joint initiatives to enhance global cyber security.
In conclusion, while the debate over territorial sovereignty in cyberspace remains unresolved, the competence/function theory offers a viable, forward-looking pathway that reconciles traditional legal principles with the demands of a digital age. Its adoption will require extensive international collaboration, rigorous academic inquiry, and a willingness among states to evolve existing legal frameworks. Concrete future research on case studies, normative criteria, human rights safeguards, and multilateral legal mechanisms is essential for advancing this promising approach. Embracing a competence-based model could ultimately lead to a more nuanced, effective, and equitable system for governing cyberspace – one that balances state sovereignty with the imperatives of global connectivity and the protection of human rights.
Acknowledgements
The author would like to thank the reviewers for their comments.
Funding statement
None.
Competing interests
The author declares none.
Ashkan SHOKRI graduated with a degree in public international law (LLM) from Allameh Tabataba’i University, Tehran, Iran.
