Hostname: page-component-74656f9884-c52kr Total loading time: 0 Render date: 2026-11-07T07:52:12.932Z Has data issue: false hasContentIssue false
  • English
  • Français

THE DATA EMBASSY UNDER PUBLIC INTERNATIONAL LAW

Published online by Cambridge University Press:  28 January 2019

Bartłomiej Sierzputowski
Bartłomiej Sierzputowski*
Affiliation:
PhD student, Faculty of Law and Administration, bartlomiej3737@wp.pl.
Rights & Permissions [Opens in a new window]

Abstract

This article discusses the data embassy, a new international legal concept created in response to a pressing problem. In 2007, Estonia fell victim to ‘distributed denial-of-service attacks’ and consequently, made Estonia's entire public sector data communications network inoperable. Their response was to strengthen their protection against and penalization for cybercrime, and to develop the concept of a ‘data embassy’. On 20 June 2017 the Republic of Estonia and the Grand Duchy of Luxembourg signed an ‘Agreement on the hosting of data and information systems’, to host Estonian data in Luxembourg. Such data embassies perform a unique function and benefit from many privileges and immunities, but their legal status has been unclear. This article addresses the question concerning the legal status of the premises of the data embassy.

Keywords

consular premisescyber attackData EmbassyEstoniaGrand Duchy of Luxembourgpremisespremises of the missionpublic international law

Information

Type
Shorter Articles
Information
International & Comparative Law Quarterly , Volume 68 , Issue 1 , January 2019 , pp. 225 - 242
Copyright
Copyright © British Institute of International and Comparative Law 2019 

I. INTRODUCTION

Cyberterrorism presents a major threat to global security and information in the 21st century.Footnote 1 In 2007, Estonia was the main target of hackers who brought government services and the banking system to a halt.Footnote 2 The Estonian Cabinet was aware of the loss of national data. For instance: key web servers of banks, government agencies and the office of the president ‘succumbed to the attacks’.Footnote 3 It was threatened that private messages of members of Parliament, and details of private bank accounts would be made accessible to the public. As a consequence, banks in Estonia were almost shut down. As Nazario notes, it affected international banking, slowed down financial transactions and came at great monetary costs.Footnote 4 This was one of the biggest cyber attacks in history (the first distributed denial-of-service (DDoS) attack),Footnote 5 beginning on 27 April 2007 and ending on 18 May 2007.Footnote 6 Towards the end of the attack hackers attempted to ‘halt the functioning of the entire public sector data communications network’.Footnote 7 The Minister of Foreign Affairs of the Republic of Estonia described the attack as ‘virtual, psychological and real – all at the same time’.Footnote 8 The President of Estonia, Toomas Hendrik Ilves, said, ‘today we do not need missiles to destroy the infrastructure. Everyone can do this, but under certain condition – you must be on-line’.Footnote 9

In 2008 and 2009Footnote 10 more cyber attacks were conducted. Hackers attacked Radio Free Europe in Belarus, Lithuanian websites and the website of the Georgian President Mikhael Saakashvili.Footnote 11 These attacks were, however, less damaging than that targeted at Estonia in 2007. During the 62nd session of the United Nations General AssemblyFootnote 12 the President of Estonia stated that ‘in April and May of this year Estonia successfully coped with an extensive cyber attack, and we are prepared to share with other countries the know-how we have acquired’.Footnote 13 The President himself encouraged the international community ‘to cooperate in legal matters in questions concerning cyber security’, ‘to establish an appropriate legal space’ and ‘to accede to the Convention on Cybercrime of the Council of Europe’.Footnote 14 The international community recognized this voice as being of importance. It resulted in fundamental changes in relation to cybercrime: 36 countriesFootnote 15 ratified the Convention on Cybercrime,Footnote 16 and Estonia changed its national legislation and now penalizes cybercrime.Footnote 17

In May 2008, the Ministry of Defence in cooperation with the Estonian Ministry of Education and Research, the Ministry of Justice, the Ministry of Economic Affairs and Communications, the Ministry of Internal Affairs and the Ministry of Foreign Affairs submitted to the Estonian Government the document entitled ‘Cyber Security Strategy for 2008–2013’. This Strategy was aimed at ‘reducing the inherent vulnerabilities of cyberspace in the nation as a whole’.Footnote 18 Moreover, in 2013 the Estonian Government launched a project entitled ‘Data Embassy Initiative’—‘reflective of its innovative approach to e-government and of its need to ensure national digital continuity no matter what’.Footnote 19 These steps resulted in creating more powerful measures to prevent the problem of cybercrime in Estonia. One of the consequences of this strategy, was the definition of Estonia's critical infrastructure.Footnote 20

Four years later, on 20 June 2017 in Luxembourg, the Estonian Cabinet decided to sign an Agreement with the Grand Duchy of Luxembourg on the hosting of data and information systemsFootnote 21 (Agreement). This Agreement establishes the data centreFootnote 22 (the Data Embassy) where Estonian data will be hosted, that is: data and information systems, equipment and licences and associated components, such as telecommunications and storage systems.

Estonia is one of the most digitally advanced societies in the world.Footnote 23 Estonians can ‘perform nearly every public and private sector transaction in digital form’.Footnote 24 The institution of the Data Embassy seems to fit into this pattern of creating a modern and safe ‘e-government’ system.

It is worth noting that on 5 March 2018 in Luxembourg, the European Patent Organisation and the Grand Duchy of Luxembourg signed the Complementary Agreement concerning the inviolability of the archives of the European Patent Organisation.Footnote 25 The Complementary Agreement entered into force on 25 July 2018.Footnote 26 It is the second arrangement in the world which establishes a place where entire archives, correspondence, documents, manuscripts, photographs, films, recordings, computer and media data, data carriers and any other similar material belonging to or held by the European Patent Organisation will be hosted.Footnote 27

One of the purposes of this article is to answer the question whether the Data Embassy is a new institution under public international law. Furthermore, the question arises as to whether the Data Embassy has a significant impact on developing public international law in the respect of counteracting cybercrime. The article also tries to answer the question regarding the legal status of the premises of the Data Embassy when comparing it to diplomatic mission premises or consular premises. The article compares the provisions of the Agreement of 20 June 2017 having taken into consideration the provisions of the Vienna Conventions on Diplomatic and Consular Relations.

II. CYBER ATTACKS IN EUROPE IN THE 21st CENTURY: THE CASE OF ESTONIA

It has been suggested that the reason for the cyber attack was probably the decision to relocate the Soviet monument—the Bronze Soldier, which was erected in Tallinn in 1947 as a memorial to the victory of the Soviet Army over the Nazis.Footnote 28 The Russian Government objected to this decision.Footnote 29 Ethnic Russians organized riots against the Estonian authorities, but this was not the only consequence. In Moscow the national flag of Estonia was torn from the embassy building. ‘All this violates the Vienna Convention on Diplomatic Relations’Footnote 30—said the Minister of Foreign Affairs of the Republic of Estonia. Not only did demonstrators tear down the flag of Estonia from the Estonian embassy, but they also burned it in front of the building.Footnote 31 Moreover, they blocked the normal functioning of the Estonian embassy in Moscow and physically attacked several of its diplomats, including the head of the mission.Footnote 32 On 27 April 2007, Estonia's computing and network infrastructure were brought to a halt by massive amounts of data being pushed to their servers, effectively paralysing them, in what is known as a DDoS attack.Footnote 33

The Minister of Foreign Affairs of the Republic of Estonia accused the Russian Government of coordinating cybercrime activities against his country.Footnote 34 Russia denied any involvement in the attacks or that it had in any way conducted or cooperated with the attackers against the security and sovereignty of Estonia.Footnote 35 In the first few days of the cyber attacks local society was totally powerless. The main targets for cyber attack were: ‘servers of institutions that are responsible for the Estonian Internet infrastructure, governmental and political targets, services provided by the private sector, personal and random targets’.Footnote 36 What is more, public propaganda and dissemination of attack instructions were used to coordinate the attacks.Footnote 37 Observers emphasized that ‘Estonia was barged into the Stone Age by the cyber bomb’.Footnote 38

On 1 May 2007 the attacks increased and were ‘mainly targeted against the web and name servers of government entities’.Footnote 39 One week later on 9 May 2007, cyber attacks appeared ‘to be attempting a <<cyber blockade>> of Estonia’.Footnote 40 Estonia successfully fended off the attacks, made possible because Estonia used its server infrastructure hardening, which was a third phase of action following the cyber attacks.Footnote 41 Consequently, the attacks ended on 18 May 2007Footnote 42 but ‘banks continued to experience a diminished level of interruptions even after that date’.Footnote 43 On 10 May 2007, the European Parliament passed a resolution on the EU–Russia Summit to be held in Samara on 18 May 2007, calling upon ‘the European Union to demonstrate solidarity with Estonia and speak to Russia with one voice in the context of recent events in Tallinn’. Moreover, it called on ‘Russia to fully respect its obligations under the Vienna Convention on Diplomatic Relations by guaranteeing the protection of foreign diplomats and the normal functioning of foreign embassies’.Footnote 44

On 24 May 2007 the European Parliament passed another resolutionFootnote 45 which confirmed the fact that systematic cyber attacks had been organized, mostly from outside Estonia, in an attempt to block official communication lines and Estonian administration websites. Moreover, the fact that those attacks had come from Russian administration IP addresses was also reaffirmed. Furthermore, the attacks had had the nature of being intensive propaganda attacks and they had continued via the Internet and mobile telephone messages calling for armed resistance and further violence.

The European Parliament expressed ‘its support for, and solidarity with, the democratically elected Estonian Government in its efforts to ensure order, stability and the rule of law for all residents of Estonia’. Furthermore, it stated that ‘attacks targeting one of the smallest EU Member States’ were ‘a test case for the European Union's solidarity’. In addition to this, the European Parliament called on the Commission and all the Member States to assist in the analysis of the cyber attacks on Estonian websites. Moreover, it ordered a study to be conducted on how such attacks and threats might be addressed at EU level and called on Russia to assist in these investigations in full.Footnote 46

The consequences of the cyber attack made Estonians aware that special measures had to be taken in order to prevent attacks in the future, given their ‘direct economic and … wider societal effect’.Footnote 47 Estonia has changed its legal system by penalising cybercrimeFootnote 48 and passing the ‘Cyber Security Strategy for 2008–2013’. The signing of the Agreement between the Grand Duchy of Luxembourg and the Republic of Estonia was the culmination of this process of developing cyber security in Estonia.

III. THE DATA EMBASSY AND PUBLIC INTERNATIONAL LAW

The Data Embassy of the Republic of Estonia as well as the Data Embassy of the European Patent OrganisationFootnote 49 will be located in premises provided by the Grand Duchy of Luxembourg.Footnote 50 The premises should arguably benefit from special protection, because all Estonian and European Patent Organisation data will be hosted there. Therefore, the question arises as to the legal status of these premises – and also whether they should have the same level of international protection as that afforded to diplomatic mission premises or consular premises.

A. The Premises under the Vienna Conventions

1. Vienna Convention on Diplomatic Relations

The Preamble to the Vienna Convention on Diplomatic RelationsFootnote 51 (VCDR) provides that one of the purposes of the ‘privileges and immunities is not to benefit individuals but to ensure the efficient performance of the functions of diplomatic missions as representing States’. Article 1(i) of the VCDR defines the premises of a missionFootnote 52 as the buildings or parts of buildings and the land ancillary thereto, irrespective of ownership, used for the purposes of the mission, including the residence of the head of the mission. The decisive prerequisite is the use of the premises for the purposes of the mission. The process of classifying the premises is ‘the mere privilege of the sending State’.Footnote 53 In addition, the VCDR provides that the residence of the head of the mission is also classified as a premise of the mission.Footnote 54 This has important implications. Article 1(i) does not grade or point to the type of properties, which could be considered as the premises of the mission. The buildings or parts of buildings and the land ancillary thereto could be a detached house, a tenement house, gardens, etc.Footnote 55 With regard to customary international law, embassies are usually located in the capital city of a country. Some countries, such as the United Kingdom, have specific legislationFootnote 56 concerning the location of missions.Footnote 57

One of the most important provisions of the VCDR is Article 22, concerning the inviolability of the premises.Footnote 58 Article 22(1) of the VCDR provides that the premises of the mission shall be inviolable, as well as the archives and documents of the mission.Footnote 59 The private residence of a diplomatic agent should also be inviolable.Footnote 60 The receiving State does not have a right to enter into the premises of the mission without the consent of the head of the mission.Footnote 61 This was confirmed by the International Court of Justice in the United States of America v Iran, which states that ‘the principle of the inviolability of the persons of diplomatic agents and the premises of diplomatic missions is one of the very foundations of his long-established regime’.Footnote 62 As a consequence, the premises of the mission, their furnishings and other property thereon and means of transport belonging to the mission are immune from search, requisition, attachment or execution.Footnote 63 It also means that the premises of the mission are immune from expropriation.Footnote 64 Pursuant to Article 22(2) of the VCDR, the receiving State is obliged to take all appropriate steps to protect the premises of the mission against any intrusion or damage and to prevent any disturbance of the peace of the mission or impairment of its dignity.Footnote 65 This ‘special duty’ consists of for example ensuring 24-hour police or military guard if the mission is ‘particularly vulnerable’.Footnote 66 ‘The obligation to protect the inviolability of the premises, documents and archives is a strict one. The receiving State must make its bests efforts to provide this protection’.Footnote 67 Nonetheless, Denza points out that the duty under Article 22(2) of the VCDR ‘is not an absolute one, and what is appropriate depends on the degree of threat to a particular mission and on whether the receiving State has been made aware of any unusual threat’.Footnote 68 In turn, Chatterjee emphasises that

[e]ven after a mission has been occupied or seized, under customary international law a receiving State has an obligation to make its efforts to bring the flagrant infringements of the inviolability of the premises, archives and the diplomatic and consular staffs to a speedy end, restore the status quo and to offer reparation for the damage.Footnote 69

It is worth noting that the mission and its head have the right to use the flag and emblem of the sending State on the premises of the mission, including the residence of the head of the mission, and his means of transport.Footnote 70 This special right underlines the inviolability of the premises of the mission.Footnote 71

One of the primary duties of the receiving State is to facilitate the acquisition by the sending State of premises necessary for its mission or to assist the latter in obtaining accommodation.Footnote 72 Article 21(2) of the VCDR does not impose any duties on the receiving State. It is not an obligation, just the manifestation of help.Footnote 73 In turn, Article 25 of the VCDR provides that the receiving State shall accord full facilities for the performance of the functions of the mission. One of the examples of the mentioned facilities, is to offer ‘assistance in obtaining telephone lines, or permits for alterations or extensions to the premises’.Footnote 74

On the other hand, Article 41(3) of the VCDR provides that the premises of the mission must not be used in any manner that is incompatible with the functions of the mission as laid down in the VCDR or other rules of general international law.Footnote 75

It is, then, the usage of the mission which is crucial. As Aust states, ‘once the premises are ready to be occupied they probably then become premises of the mission and will continue’ to be ‘so even if … they have to be vacated for refurbishment’ at a later date. ‘They will cease to have their special status once they cease to be used for the purposes of the mission’.Footnote 76 However, since the receiving State does not have a right to enter the premises of the mission this can be difficult to determine.

2. Vienna Convention on Consular Relations

The Vienna Convention on Consular RelationsFootnote 77 (VCCR) defines ‘consular premises’ as ‘the buildings or parts of buildings and the land ancillary thereto, irrespective of ownership, used exclusively for the purposes of the consular post’. It should be noted that ‘[t]he protection provided by the VCCR is more limited’ than that given to diplomatic premisesFootnote 78 and ‘does not include a consular residence’.Footnote 79

When it comes to the protection of the consular premises, the provisions are also different from those in the VCDR. For example, consular premises are not immune from expropriation.Footnote 80 And whilst the authorities of the receiving State may not enter parts of consular premises used exclusively for the purpose of the work of the consular post, ‘the VCCR allows officials of the receiving state to enter consular premises without consent of the head of the post, if the officials secured consent of the designee of the head of the post or of the head of the diplomatic mission’.Footnote 81

Similar to the VCDR, the receiving State is under a special duty to take all appropriate steps to protect the consular premises against any intrusion or damage and to prevent any disturbance of the peace of the consular post or impairment of its dignity.Footnote 82

The VCCR, similarly to the VCDR, imposes a positive duty on the receiving State to accord full facilities for the performance of the functions of the consular post.Footnote 83 Furthermore, the VCCR imposes a duty to facilitate the acquisition on its territory, in accordance with its laws and regulations, by the sending State of premises necessary for its consular post or assist the latter in obtaining accommodation in some other way.Footnote 84 Where necessary, the receiving State shall also assist the consular post in obtaining suitable accommodation for its membersFootnote 85 (though this is not a duty). The consular premises, like the premises of the mission, shall not be used in any manner incompatible with the exercise of consular functions,Footnote 86 a point repeatedly made by the UN General Assembly.Footnote 87 As with diplomatic premises, usage is the key to its status, and the inviolability commences when consular premises are ready to be occupied and ends when the premises have to be vacated or when they have lost their special function.

3. The Agreement between the Grand Duchy of Luxembourg and the Republic of Estonia on the hosting of data and information systems signed in Luxembourg on 20 June 2017

The signing of the 2017 Agreement between the Grand Duchy of Luxembourg and the Republic of Estonia was the culmination of the work on enhancing cyber security in Estonia. The Preamble to this bilateral act provides that ‘this agreement is in the spirit of the Vienna Convention on Diplomatic Relations’, but notes that ‘the Vienna Convention on Diplomatic Relations is not sufficient to set a legal framework for the hosting of data and information systems’ because the VCDR does not include ‘provisions on the hosting of data’.

Article 1(b) of the Agreement defines the ‘premises’ as ‘a dedicated data centre space provided by the Grand Duchy of Luxembourg and meant for the purpose of hosting Estonian data and information systems and equipment’. This means that Luxembourg has a duty to make such premises available to Estonia, which is reflected in Article 2(2) of the Agreement.Footnote 88 This, is analogous to the duty imposed on receiving States by the VCDR, mentioned above.

The premises are to be provided in full working condition to host Estonian data and information systemsFootnote 89 and, again, reflecting the VCDR, must not be used in any manner incompatible with the purpose laid down in this Agreement or by other rules in international law.Footnote 90 Furthermore, Luxembourg is obliged to ensure that only the authorized representativeFootnote 91 of EstoniaFootnote 92 has access to the premises. And no-one else may do so without the prior approval of the Estonian representative.Footnote 93 Since the premises are to be inviolable, they are exempt from search, requisition, attachment or execution,Footnote 94 in a manner similar to diplomaticFootnote 95 or consular premises.Footnote 96 Consequently, and similarly to other mission premises, the premises of the Data Embassy should not be expropriated. All data and information systems stored form part of the archives of Estonia and, like the premises, are inviolable and thus exempt from search, requisition, attachment or execution,Footnote 97 similar to mission and consular archives.Footnote 98 Moreover, all the equipment and licencesFootnote 99 installed by Estonia in order to operate the data centre are to be regarded as assets of Estonia and enjoy immunity from all forms of legal process.Footnote 100

There are further analogies with diplomatic premises. For example, Article 6(3) of the Agreement provides that ‘[t]he Grand Duchy of Luxembourg shall grant the premises the same treatment as granted to diplomatic missions in respect of its official communications and the transmission of all its documents’.Footnote 101 Luxembourg also has a duty to take all appropriate measures to protect the premises against any intrusion or damage within its territory of Luxembourg. Such measures are to be considered appropriate if they offer the same level of protection as that offered by Estonia to mission premises of LuxembourgFootnote 102 (an excellent example of the principle of reciprocity).Footnote 103

The Agreement also permits Estonia to use code and encryption in its official communications, as well as to dispatch and receive its official communications by authorized diplomatic couriers.Footnote 104 Whilst the latter provision is similar to the provisions concerning the use of the diplomatic bag found in Article 27(1) of the VCDR.Footnote 105 Article 35(1) of the VCCR only refers to codes or ciphers, whilst Article 27(4) of the VCDR refers rather to encryption. It is indisputable that the ability to use code and encryption enhances the level of security of Estonian data hosted in the Data Embassy. Finally, in the case of force majeureFootnote 106 which results in partial or total interruption of communication, the premises are to enjoy the same priority treatment as is accorded to the diplomatic missions.Footnote 107 In particular, the VCDR and the VCCR guarantee the safety of consular premises, premises of the mission, archives and of interests of the sending State in exceptional circumstances,Footnote 108 and ‘the sending State may entrust the custody of the premises of the mission, together with its property and archives, to a third State acceptable to the receiving State’.Footnote 109

One matter which is less clear is whether the Data Embassy can use the Estonian flag and emblem. Although the Agreement does not address this, it seems clear that, once again, Estonia has an analogous right, flowing from the privilege of inviolability and this may be necessary to ensure that the exemption of the premises from search, requisition, attachment or execution is generally known. A further issue concerns when the inviolability of the Data Embassy premises begins and ends. It might be thought that, based on analogies with the VCDR and VCCR, this would be from when they are ready to be occupied and used for their designated functions. Nonetheless, Article 10(4) of the Agreement provides that

[a]fter the termination of the AgreementFootnote 110 the archives and the equipment and the licences of the Republic of Estonia shall only be handed over to the authorised representative of the Republic of Estonia. If the authorised representative of the Republic of Estonia is not possible to identify, the Grand Duchy of Luxembourg shall treat the archives and the equipment and the licences of the Republic of Estonia with the same level of protection as the archives of the Grand Duchy of Luxembourg and shall only hand them on to a legal representative of the Republic of Estonia.

This means that the inviolability of those premises ends with the termination of the Agreement. However, the Estonian archives, equipment and the licences remain inviolable — until they are handed over to an Estonian legal representative. If the premises were to be used in any manner incompatible with the purpose laid down in the Agreement or by other rules of public international law, the inviolability of the premises would also end (a contrario to Article 7 of the Agreement).Footnote 111

The Agreement also contains provisions on dispute settlement, which provide that any dispute arising between the Parties resulting from the interpretation or application of this Agreement, which is not settled by negotiation or other agreed mode of settlement, shall be referred for final decision to an arbitral tribunal of three arbitrators, to be constituted for each individual case.Footnote 112

It therefore is clear that the premises of the Data Embassy enjoy substantially the same privileges and immunities as premises of missions under VCDR Article 1(i). The only difference is that under the Agreement the sending State is not exempt from all national, regional or municipal dues and taxes in respect of the premises of the mission, whether owned or leased, other than such as represent payment for specific services rendered.Footnote 113 Moreover, the Agreement allows the officials of Luxembourg to enter the premises without the prior approval of the authorized representative of the Estonia, with such approval being assumed in case of fire or other emergencies that require immediate protective measures and could constitute a danger to safety.Footnote 114

The primary function of the premises of the Data Embassy is to host Estonian data, information systems and equipment, which are inviolable and exempt from search, requisition, attachment or execution. The fact that even in case of force majeure leading to a total or partial interruption of communications, the premises enjoy the same priority of treatment accorded to diplomatic missions, confirms the idea that the premises of the Data Embassy are a ‘special kind’ of premises of the mission.

4. Complementary Agreement between the State of the Grand Duchy of Luxembourg and the European Patent Organisation concerning the inviolability of the archives of the European Patent Organisation

The European Patent Organisation (EPO) was established pursuant to the 1973 Convention on the Grant of European Patents (CGEP).Footnote 115 The Preamble to the CGEP provides that Contracting States agreed to ‘strengthen co-operation between the States of Europe in respect of the protection of inventions’. The EPO is a public international organization, granting patents in Europe under the CGEP, and it has legal personality.Footnote 116 In each of the Contracting States, the EPO enjoys the most extensive legal capacity accorded to legal persons under the national law of that State. Moreover, the EPO ‘may in particular acquire or dispose of movable and immovable property and may be a party to legal proceedings’.Footnote 117 Since 1973, 38 European countries (including Luxembourg) have ratified the CGEP,Footnote 118 Article 32 of which provides that ‘[t]he European Patent Office shall place at the disposal of the Administrative Council, and of any committee established by it, such staff, premises and equipment as may be necessary for the performance of their duties’.

The CGEP does not define ‘premises’, but the Protocol on Privileges and Immunities (PPI) adopted at the same time sets out the conditions under which the EPO, the members of its Administrative Council, its employees and other persons specified in the Protocol as taking part in the work of the EPO, shall enjoy, in each Contracting State, the privileges and immunities necessary for the performance of their duties.Footnote 119 Article 1 of the PPI states that ‘the premises of the Organisation shall be inviolable’, whilst Article 2 confirms that the archives and any documents belonging to or held by the EPO are also inviolable,Footnote 120 and immune from any form of requisition, confiscation, expropriation and sequestration.Footnote 121 Similar to the Vienna Conventions and Agreement, the authorities of the States in which the EPO has its premises shall not enter those premises, except with the consent of the President of the European Patent Office (with such consent being assumed in cases of fire or other disasters requiring prompt protective action).Footnote 122 Furthermore, pursuant to Article 4(1) of the PPI, ‘[w]ithin the scope of its official activities the Organisation and its property and income shall be exempt from all direct taxes’. Finally, ‘with regard to its official communications and the transfer of all its documents, the EPO shall in each Contracting State enjoy the most favourable treatment accorded by that State to any other international organisation’.Footnote 123

The PPI also provides that the Administrative Council of the EPO can decide to conclude complementary agreements with one or more Contracting States to give effect to the provisions of the Protocol to ensure the efficient functioning of the Organisation and the safeguarding of its interests.Footnote 124 On 5 March 2018 a Complementary Agreement concerning the inviolability of the archives of the European Patent Organisation was signed between the EPO and the Grand Duchy of Luxembourg.Footnote 125 Whilst Article 2 of the PPI provides for the inviolability of archives and documents, this Complementary Agreement goes further and ensures that data in held in electronic form is also included in the scope of Article 2 of the PPI.Footnote 126 The Article 1 of the Complementary Agreement provides that

the inviolability referred to in Article 2 of the Protocol on Privileges and Immunities of the European Patent Organisation shall apply to the entire archives, correspondence, documents, manuscripts, photographs, films, recordings, computer and media data, data carriers and any other similar material belonging to or held by the Organisation, wherever they are located and by whomsoever they are held, and all the information contained therein.

The Administrative Council of the EPO stated that the Complementary Agreement ‘is needed to safeguard the Organisation's interests in connection with the planned externalisation of its data centres to Luxembourg, since the current wording of Article 2 PPI is not explicit enough to cover data in electronic form held by third parties at other sites’,Footnote 127 the scope of this agreement being limited to the territory of Luxembourg.Footnote 128

The Complementary Agreement has the effect of establishing the world's second Data Embassy, enhancing the level of protection accorded to data hosted on EPO premises in Luxembourg. It is also the first Data Embassy established between international organizations and States. It should be noted that the provisions of the VCDR and VCCR do not apply to the EPO since it is neither State, a member of the United Nations, nor is it a member of any of the specialized agencies mentioned in Article 48 of the VCDR and Article 78 of the VCCR.Footnote 129 Though the parties are, of course, free to draw on them when entering into any bilateral arrangement they might wish to make. Whatever its more general significance, the Complementary Agreement is an excellent example of ensuring the inviolability of electronic archives through innovative means.

IV. CONCLUSION

It is true that cyber attacks are one of the major threats in the 21st century. Thus, they may affect not only technological information systems, invented by people, but also the people themselves — that is — the international community as a whole.Footnote 130 In 2007, Estonia was a victim of the first DDoS attacks in history which initially rendered Estonia's entire public sector data communications network inoperable. The President of Estonia said that, ‘in the future, cyber attacks may, in the hands of criminals or terrorists, become a considerably more widespread and dangerous weapon than they are at present’.Footnote 131 Estonia took legal measures to counteract this phenomenon and to protect its data and is leading the search for a way of combatting this problem, paving the way to counteract cyberterrorism. Of course, there is still a possibility that DDoS or DoS attacks may threaten the Data Embassy, but the level of protection of the data hosted in these premises, ensured by the bilateral agreement, is unequivocally higher than under national legislation. The Agreement obliged the Grand Duchy of Luxembourg to ensure the appropriate level of protection. Additionally, the Estonian data will be hosted abroad, meaning in the event of a physical, military attack, the invader cannot capture Estonian data from the territory because it is hosted elsewhere.

The 2017 Agreement was the first bilateral arrangement to establish a new institution — the Data Embassy. The Agreement also reaffirms the effectiveness of co-operation in combatting the criminal misuse of information technology and in creating a global culture of cyber security. The 2018 EPO–Luxembourg Complementary Agreement builds on this by establishing the second Data Embassy, this time between an international organization and a State.

The Estonia–Luxembourg agreement modelled the status of the premises hosting the Data Embassy within the spirit of the VCDR, with almost all of the Agreement being analogous to it. This flows from the fact that the premises of the mission have increased protection in comparison with consular premises. Thus, the Agreement ensures the same level of protection for the premises of the Data Embassy as for the premises of the mission, thus deterring them from being subject to cyber attacks. The international character and importance of the mentioned Agreement only reaffirms this thesis. It should be stressed that if any country attacked the Estonian data hosted in the Data Embassy, it would not only infringe the diplomatic relations with Estonia, but also with Luxembourg.

It is indisputable that cyberspace touches every aspect of our lives. The UN Secretary-General has observed that ‘all states have a stake in making cyberspace more secure. Our efforts in this realm must uphold the global commitment to foster an open, safe and peaceful Internet’ and this can hardly be disagreed with.Footnote 132 As long ago as 2005 the UN General Assembly established a Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (GGE).Footnote 133 In 2013 the GGE achieved a ‘landmark consensus’, ‘which is regarded as a substantial development in the context of international cooperation on cyber security norms’Footnote 134 when it ‘affirmed the applicability of international law, especially the UN Charter to cyberspace’.Footnote 135 One of the main purposes of the Charter of the United NationsFootnote 136 is to maintain international peace and security, and to that end: to take effective collective measures for the prevention and removal of threats to peace.Footnote 137 Furthermore, pursuant to Article 2(4) of the Charter, all Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any State, or in any other manner inconsistent with the Purposes of the United Nations. Whilst this may not be directly applicable to non-State actors such as hackers, this would suggest that these prohibitions extend to State-sponsored cyber attacks.

Nevertheless, the Agreements considered above only binds the parties to them. Were they to be breached, the party responsible would have to make all efforts to bring the infringements to an end, restore the status quo ante and offer reparation for any resulting damage. This obviously falls short of absolute protection.

Following Estonia's experience of cyberwar, the establishment of the Data Embassy offers an innovative response to the observation of the UN Secretary-General that ‘[m]aking cyberspace stable and secure can be achieved only through international cooperation, and the foundation of this cooperation must be international law’.Footnote 138 The Data Embassy is an important development, reaffirming the effectiveness of cooperation in combatting the illegal targeting of data and in creating a global culture of cyber security.Footnote 139 It also seems that Luxembourg is leading the world as an emergent centre for Data Embassies, whilst this Estonian initiative may ‘set an example to the rest of the world’.Footnote 140

References

1 See Moslemzadeh, TP, Cyberterrorism: The Legal and Enforcement Issues (World Scientific Publishing Europe Ltd 2017) xvGoogle Scholar.

2 Alenius, K, ‘An Exceptional War That Ended in Victory for Estonia, or an Ordinary e-Disturbance? Estonian Narratives of the Cyber Attacks in 2007’ in Warren, M (ed), Case Studies in Information Warfare and Security: For Researchers, Teachers and Students (Academic Conferences and Publishing International Limited 2013) 55Google Scholar; See Eggers, WD, Delivering on Digital: The Innovators and Technologies That Are Transforming Government (RosettaBooks 2016) 182Google Scholar; See also Kulesza, J, ‘State Responsibility for Cyberattacks on International Peace and Security’ (2009) XXIX PolishYBIntlL 139Google Scholar.

3 Stiennon, R, Surviving Cyberwar (Government Institutes 2010) 88Google Scholar.

4 Nazario, J, ‘Politically Motivated Denial of Service Attacks’ in Czosseck, Ch and Geers, K (eds.) The Virtual Battlefield: Perspectives on Cyber Warfare (IOS Press, 2009) 166Google Scholar.

5 Denial-of-service attacks (DoS attacks) were also present. See Tikk, E and Oorn, R, ‘Legal and Policy Evaluation: International Coordination of Prosecution and Prevention of Cyber Terrorism’ in Centre of Excellence Defence Against Terrorism, Ankara, Turkey (ed), Responses to Cyber Terrorism, NATO Science for Peace and Security Series. E: Human and Societal Dynamics (vol 34, IOS Press 2008) 90Google Scholar; see also Russell, AL, Cyber Blockades (Georgetown University Press 2014) 69Google Scholar.

6 Tikk, E, Kaska, K and Vihul, L, International Cyber Incidents: Legal Considerations (Cooperative Cyber Defence Centre of Excellence 2010) 19Google Scholar; see also Stiennon (n 3) 88.

7 Tikk, Kaska and Vihul (n 6) 107.

8 ‘Declaration of the Minister of Foreign Affairs of the Republic of Estonia, 1 May 2007’ at <https://www.valitsus.ee/en/news/declaration-minister-foreign-affairs-republic-estonia>.

9 ‘Dni które wstrząsnęły Estonią’ (Days Which Shook Estonia) at <https://www.eesti.pl/dni-ktore-wstrzasnely-estonia-11963.html>.

10 Carr, J, Inside Cyber Warfare: Mapping the Cyber Underworld (2nd edn, O'Reilly 2012) 161Google Scholar.

11 See also Stiennon, R, ‘A Short History of Cyber Crime’ in Green, JA (ed), Cyber Warfare: A Multidisciplinary Analysis (Routledge 2015) 9Google Scholar and 18.

12 Held in New York on 25 September 2007.

13 ‘Address by H.E. Mr. Toomas Hendrik Ilves President of the Republic of Estonia to the 62nd session of the United Nations General Assembly’ available at <http://www.un.org/webcast/ga/62/2007/pdfs/estonia-eng.pdf>.

14 ibid.

15 Andorra, Austria, Azerbaijan, Czech Republic, Finland, Georgia, Germany, Italy, Liechtenstein, Luxembourg, Malta, Monaco, Montenegro, Poland, Portugal, Moldova, Serbia, Slovakia, Spain, Switzerland, Turkey, Great Britain, Australia, Canada, Chile, Costa Rica, Dominican Republic, Israel, Japan, Mauritius, Panama, Senegal, Sri Lanka, Tonga.

16 2001 Convention on Cybercrime of the Council of Europe, ETS No 185.

17 In 2008 the Government of Estonia amended the provisions of the Penal Code. For example, ‘the punishment prescribed by law for computer crimes (…) was pecuniary punishment or a maximum one year of imprisonment’. See sections 206–208 of the Estonian Penal Code (Passed 06.06.2001, RT I 2001, 61, 364); ‘Implementation of the Virtual Data Embassy Solution. Summary Report of the Research Project on Public Cloud Usage for Government, Conducted by Estonian Ministry of Economic Affairs and Communications and Microsoft Corporation’ at at <https://www.mkm.ee/sites/default/files/implementation_of_the_virtual_data_embassy_solution_summary_report.pdf>.

18 Tikk, Kaska and Vihul (n 6) 18. See also Stiennon (n 3) 29.

19 Tikk, Kaska and Vihul (n 6) 5.

20 ibid 30.

21 Loi du 1er décembre 2017 portant approbation du « Agreement between the Grand Duchy of Luxembourg and the Republic of Estonia on the hosting of data and information systems », signé à Luxembourg, le 20 juin 2017, Doc. parl. 7185; sess. ord. 2016–2017 et 2017–2018 at <http://legilux.public.lu/eli/etat/leg/loi/2017/12/01/a1029/jo>.

22 Art 1(a) of the Agreement states that ‘the data centre’ shall mean a facility used to host the data and information systems, the equipment and licences and associated components, such as telecommunications and storage systems.

23 For example Estonia was the first country to allow online voting in the general election in 2007. Seven years later Estonia offered an ‘e-residency’ to any person in the world. See Ross, A, The Industries of the Future (Simon & Schuster 2016) 210Google Scholar.

24 ‘Implementation of the Virtual Data Embassy Solution’ (n 17).

25 Accord complémentaire entre l’État du Grand-Duché de Luxembourg et l'Organisation européenne des brevets concernant l'inviolabilité des archives de l'Organisation européenne des brevets, fait à Luxembourg, le 5 mars 2018 (Journal Officiel du Grand-Duché de Luxembourg, Mémorial A n° 640 de 2018); see at <http://legilux.public.lu/eli/etat/leg/div/2018/07/20/a640/jo> and <https://gouvernement.lu/fr/gouvernement/francois-bausch/actualites.gouvernement%2Bfr%2Bactualites%2Btoutes_actualites%2Bcommuniques%2B2018%2B03-mars%2B30-conseil-gouvernement.html>.

26 Pursuant to Art 3 of the Complementary Agreement.

27 See at <https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche/RoleDesAffaires?action=doDocpaDetails&id=7294>.

28 J Nazario (n 4) 165; see also Singer, PW and Friedman, A, Cybersecurity and Cyberwar: What Everyone Needs to Know® (Oxford University Press 2014) 111CrossRefGoogle Scholar.

29 Alenius (n 2) 58.

30 ‘Declaration of the Minister of Foreign Affairs’ (n 8).

31 Immediately after the riots in Tallinn the normal functioning of the Estonian embassy in Moscow was blocked for seven days by hostile demonstrators from the Russian pro-government youth organization ‘Nashi’, which resulted in physical attacks on the Estonian and Swedish Ambassadors, threats to demolish the embassy building, the tearing down of the Estonian flag situated on embassy territory, and the labelling of Estonia as a ‘fascist’ country. European Parliament resolution of 24 May 2007 on Estonia, P6_TA(2007)0215, available at <http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//TEXT+TA+P6-TA-2007-0215+0+DOC+XML+V0//EN>.

32 European Parliament resolution of 10 May 2007 on the EU–Russia Summit to be held in Samara on 18 May 2007, Official Journal of the European Union from 27.3.2008, C 76 E/97, P6_TA(2007)0178.

33 See also Gardner, H, ‘War and the Media Paradox’ in Karatzogianni, A (ed), Cyber-Conflict and Global Politics (Routledge 2009) 29Google Scholar.

34 ‘Declaration of the Minister of Foreign Affairs’ (n 8).

35 Tikk, Kaska and Vihul (n 6) 18; see also Stiennon (n 3) 23; and Alenius (n 2) 59.

36 Tikk, Kaska and Vihul (n 6) 107.

37 ibid 20.

38 ‘Dni które wstrząsnęły Estonią’ (n 9).

39 Tikk, Kaska and Vihul (n 6) 107.

40 ibid 107.

41 ‘Hardening’ infrastructure is the adding of additional security. See also R Stiennon, above n 3, at 88.

42 See Tikk and Oorn, above n 3, at 98.

43 Tikk, Kaska and Vihul (n 6) 20.

44 European Parliament resolution of 10 May 2007 (n 32).

45 European Parliament resolution of 24 May 2007 (n 31). It is noteworthy that in March 2009 (after a series of Russian denials), Sergei Markov (a State Duma Deputy from the pro-Kremlin Unified Russia Party) stated that it was with his [financial] assistance that all of the cyber attacks had been conducted in April and May 2007 in Estonia. However this claim has not been corroborated. See also: Tikk and Oorn (n 5) 98.

46 European Parliament resolution of 24 May 2007 (n 31).

47 Tikk, Kaska and Vihul (n 6) 18. See also Stiennon (n 3) 24.

48 Tikk and Oorn (n 5) 98.

49 The Complementary Agreement of 5 March 2018 entered into force on 25 July 2018, by notification, pursuant to Article 3 of the mentioned arrangement.

50 It should be pointed out that the first Data Embassy will be based in a high-security data centre in Betzdorf, a commune in eastern Luxembourg. ‘Estonia to Open the World's First Data Embassy in Luxembourg’ at <https://e-estonia.com/estonia-to-open-the-worlds-first-data-embassy-in-luxembourg/>.

51 1961 Vienna Convention on Diplomatic Relations, United Nations, Treaty Series, vol 500, at 95.

52 Aust, A, Handbook of International Law (Cambridge University Press 2010) 113CrossRefGoogle Scholar; See also Dembinski, L, The Modern Law of Diplomacy: External Missions of States and International Organizations (Martinus Nijhoff 1988) 85Google Scholar; see also Denza, E, Diplomatic Law: Commentary on the Vienna Convention on Diplomatic Relations (3rd edn, Oxford University Press 2008) 21CrossRefGoogle Scholar.

53 Muszyński, M, Konwencja wiedeńska o stosunkach dyplomatycznych. Komentarz (Vienna Convention on Diplomatic Relations: Commentary) (STO 2004) 32Google Scholar.

54 Art 1(i) in fine of the VCDR.

55 Muszyński (n 53) 33.

56 The Diplomatic and Consular Premises Act 1987 (from 15th May 1987, Ch 46) at <https://www.legislation.gov.uk/ukpga/1987/46>.

57 Aust (n 52) 114.

58 See Bao, Y, ‘The Protection of Public Safety and Human Life vs the Inviolability of Mission Premises: A Dilemma Faced by the Receiving State’ in Behrens, P (ed), Diplomatic Law in a New Millennium (Oxford University Press 2017) 149Google Scholar; see also Denza (n 52) 135.

59 Art 24 of the VCDR; see also Hardy, M, Modern Diplomatic Law (Manchester University Press 1968) 49Google Scholar.

60 Art 30(1) of the VCDR.

61 Even when the receiving State wonders if the function of the premises of the mission is flouted by the sending State; see Wouters, J, Duquet, S and Meuwissen, K, ‘The Vienna Conventions on Diplomatic and Consular Relations’ in Cooper, AF, Heine, J and Thakur, R (eds), The Oxford Handbook of Modern Diplomacy (Oxford University Press 2014) 518Google Scholar; see also Sen, B, A Diplomat's Handbook of International Law and Practice (Martinus Nijhoff 1965) 94CrossRefGoogle Scholar.

62 United States of America v Iran [1980] ICJ Rep 3, para 86.

63 Art 22(3) of the VCDR.

64 Sutor, J, ‘Sytuacja prawna nieruchomości dyplomatycznych i konsularnych’ (The Legal Status of Diplomatic and Consular Properties) (2014) Palestra, vol 7–8, at 82Google Scholar.

65 Feltham, RG, Diplomatic Handbook (Martinus Nijhoff 2012) 35Google Scholar.

66 Aust (n 52) 117.

67 Chatterjee, C, International Law and Diplomacy (Routledge 2007) 199Google Scholar.

68 Denza (n 52) 166.

69 Chatterjee (n 67) 200.

70 Art 20 of the VCDR. See Dembinski (n 52) 87; also Sen (n 61) 149.

71 Moreover, the sending State is exempt from all national, regional or municipal dues and taxes in respect of the premises of the mission, whether owned or leased, other than those which represent payment for specific services rendered. Art 23(1) of the VCDR; see Feltham (n 65) 37.

72 Art 21(1) of the VCDR. It shall also, under art 21(2) of the VCDR, where necessary, assist missions in obtaining suitable accommodation for their members. See also Denza (n 52) 128.

73 Muszyński (n 53) 65.

74 Aust (n 52) 114.

75 Albeit according to any special agreements in force between the sending and the receiving State. See Denza (n 52) 460.

76 Aust (n 52) 118.

77 1963 The Vienna Convention on Consular Relations, United Nations, Treaty Series, vo1 596, at 261.

78 Wouters, Duquet and Meuwissen (n 61) 518. However, both the consular premises and the consular residence may use the national flag and coat-of-arms. Furthermore, both should be exempt from all national, regional or municipal dues and taxes whatsoever, other than those which represent payment for specific services rendered. See Cassese, A, International Law (Oxford University Press 2005) 116Google Scholar.

79 Lee, LT and Quigley, J, Consular Law and Practice (Oxford University Press 2008) 360Google Scholar; see also Muszyński, M, Konwencja wiedeńska o stosunkach konsularnych. Komentarz (Vienna Convention on Consular Relations. Commentary) (STO 2003) 26Google Scholar.

80 Art 31(4) of the VCCR provides that if expropriation is necessary, all possible steps shall be taken to avoid impeding the performance of consular functions, and prompt, adequate and effective compensation shall be paid to the sending State.

81 Nonetheless, there is one exception to this rule. The consent of the head of the consular post may be assumed in case of fire or other disaster requiring prompt protective action. See Wouters, Duquet and Meuwissen (n 61) 518.

82 Arts 3(3) and 59 of the VCCR; see also Dembinski (n 52) 193.

83 Art 28 of the VCCR.

84 Art 30(1) of the VCCR; see also Muszyński (n 79) 76.

85 Art 30(2) of the VCCR.

86 Art 55(2) of the VCCR.

87 Res A/RES/71/145 adopted by the UNGA 13 December 2016; Res A/RES/67/94 adopted by the UNGA 14 December 2012; Res A/RES/69/121 adopted by the UNGA 10 December 2014.

88 Which states that ‘[t]he Grand Duchy of Luxembourg shall make available the premises to the Republic of Estonia for the lease cost as set out in the conditions agreed upon by the competent authorities of the Parties’.

89 Art 2(1) of the Agreement.

90 Art 7 of the Agreement. cf VCDR art 43(1).

91 The Estonia is to notify Luxembourg, through diplomatic channels, of its authorized representative for the implementation of this Agreement. The Estonian representative does not have the legal status of a member of the mission. This means that the representative does not benefit from the privileges and immunities from the VCDR (VCDR arts 29–36). But Estonia could authorize an existing member of the mission as its representative under the Agreement. See art 10(2).

92 Art 2(3) of the Agreement.

93 Art 3(2) of the Agreement.

94 Art 3(1) of the Agreement.

95 See art 22(1) of the VCDR.

96 Art 31(4) of the VCCR.

97 Art 6(1) and (2) of the Agreement; also protected are storage devices (eg publications, magnetic tapes, optical disks, diskettes, still pictures and films and visual or sound recordings)—see art 6(5) of the Agreement.

98 Art 22(1) of the VCDR and art 33 of the VCCR.

99 The equipment and licences shall mean the assets owned by the Republic of Estonia and used for the storage of data and information systems which will be agreed upon by the competent authorities of the Parties (art 1(d) of the Agreement).

100 Art 5 of the Agreement.

101 cf art 27(1) of the VCDR which provides that ‘the receiving State shall permit and protect free communication on the part of the mission for all official purposes’. Art 35(1) of the VCCR also states that ‘the packages constituting the consular bag shall bear visible external marks of their character and may contain only official correspondence and documents or articles intended exclusively for official use’.

102 Art 4 of the Agreement.

103 SN Fard, Reciprocity in International Law: Its Impact and Function (Routledge 2016) 15. See also Paulus, A, ‘Whether Universal Values can Prevail over Bilateralism and Reciprocity’ in Cassese, A (ed), Realizing Utopia: The Future of International Law (Oxford University Press 2012) 92Google Scholar; Kolb, R, Theory of International Law (Hart Publishing 2016) 406Google Scholar; see also Paris, F and Ghei, N, ‘The Role of Reciprocity in International Law’ (2003) 36(1) CornellIntlLJ 93Google Scholar.

104 Art 6(4) of the Agreement. This kind of official communications is protected by the provisions of the VCDR — see art 27(2) of the VCDR.

105 Art 27(1) of the VCDR provides that ‘in communicating with the Government and the other missions and consulates of the sending State, wherever situated, the mission may employ all appropriate means, including diplomatic couriers and messages in code or cipher’.

106 Art 1(f) of the Agreement states that ‘force majeure’ shall mean any unforeseeable situation or event beyond the control of the Parties that was not attributable to error or negligence on their part, and which prevents them from fulfilling any or all of their obligations under this Agreement and any regulation pertaining to it.

107 Art 6(6) of the Agreement.

108 VCDR, arts 45(a)–(b). Analogous obligations are set out in VCCR arts 27(1)(a)–(c).

109 ibid.

110 Either Party may terminate this Agreement by means of a written notice to the other Party. Termination shall take effect 24 months following the date of the notifications (art 10(3) of the Agreement).

111 Further, under art 8(1) of the Agreement, ‘this Agreement shall be governed by and interpreted under international and European Union law supplemented, where applicable, by the laws and regulations of the Grand Duchy of Luxembourg’.

112 Art 8 of the Agreement provides that within two months of the receipt of the request for arbitration, each Party shall appoint one member of the tribunal. The two members so appointed shall then select a third arbitrator, who is not a national of either Party, who will be the President of the tribunal.112 The decisions of the tribunal shall be final and binding. The tribunal shall adopt its own rules of procedure and its findings shall be binding.

113 See art 23(1) of the VCDR.

114 See art 3(2) of the Agreement.

115 The Convention on the Grant of European Patents signed in Munich on 5 October 1973 — the new text of the Convention adopted by the Administrative Council of the European Patent Organisation by decision of 28 June 2001 (see OJ EPO 2001, Special edn No 4, at 55) has become an integral part of the Revision Act of 29 November 2000 under art 3(2), second sentence, of that Act.

116 Art 5(1) of the CGEP.

117 Art (2) of the CGEP.

118 See < https://www.epo.org/about-us/foundation/member-states.html >.

119 See art 8 of the CGEP.

120 Art 2 of the PPI.

121 Art 3(2) of the PPI.

122 Art 1(2) of the PPI.

123 Art 10(1) of the PPI.

124 Art 25 of the PPI.

125 The final version of the Complementary Agreement is published at <https://www.epo.org/modules/epoweb/acdocument/epoweb2/296/en/CA-119-17_en.pdf>. The official text of the Complementary Agreement is published on Journal Officiel du Grand-Duché de Luxembourg, Mémorial A n° 640 de 2018 at <http://legilux.public.lu/eli/etat/leg/div/2018/07/20/a640/jo>.

126 See at <https://www.chd.lu/wps/PA_RoleDesAffaires/FTSByteServingServletImpl?path=80FC542DE7DA9598DCE1E93CF0CB3956080348E9328A54560EB986897E45704613B2332EC139F8D56FC4856E7D27C84E$21F5A7A1ACC1E5FE001F96D331C6E40D>.

127 See at <https://www.epo.org/modules/epoweb/acdocument/epoweb2/296/en/CA-119-17_en.pdf>.

128 Art 2 of the Complementary Agreement.

129 However, art 13 of the PPI states that ‘[s]ubject to the provisions of Article 6, the President of the European Patent Office shall enjoy the privileges and immunities accorded to diplomatic agents under the Vienna Convention on Diplomatic Relations of 18 April 1961’.

130 See also ‘Address by H.E. Mr. Toomas Hendrik Ilves’ (n 13).

131 ibid.

132 Document A/70/174 adopted by the General Assembly of the United Nations on 22 July 2015.

133 Res A/RES/60/45 adopted by the General Assembly on 8 December 2005.

134 See <https://ccdcoe.org/un.html>.

135 ibid.

136 Charter of the United Nations (1945) at <http://www.un.org/en/charter-united-nations/index.html>.

137 And for the suppression of acts of aggression or other breaches of the peace, and to bring about by peaceful means, and in conformity with the principles of justice and international law, adjustment or settlement of international disputes or situations which might lead to a breach of the peace — see art 1(1) of the Charter.

138 See (n 132).

139 See Res A/RES/64/211 adopted by the General Assembly on 21 December 2009.

140 ‘Estonia to Open the World's First Data Embassy in Luxembourg’ at <https://e-estonia.com/estonia-to-open-the-worlds-first-data-embassy-in-luxembourg/>.