Cyber Espionage and International Law by Russell Buchan is a clever and well-argued book, which tackles a dramatically important issue of current international affairs: the international legal regulation of cyber espionage. Clearly, the very issue is topical in its own right because of the current massive use of cyber means to collect and store reserved data, which is becoming commonplace as a result of the increased availability of the relevant sophisticated technology. So far, no significant monograph has been published on this topic, although the author of the book under reviewFootnote ¹ and other scholars have offered some shorter reflections.Footnote ² The book offers an engaging overview of the international legal framework applicable to espionage tout court, besides the specific realm of cyber espionage, which will last irrespective of the future evolution of espionage and of scholarship on this subject matter.

The analysis is divided into an introduction and eight chapters. The introduction sets out the scope of the book and its main argument, according to which although international law does not prohibit political and economic cyber espionage, it significantly constrains the way in which cyber espionage may be lawfully conducted. The author argues that the traditional view of the neutrality of international law towards cyber espionageFootnote ³ is an illusion as cyber espionage is a state activity which must comply with a variety of international customary and treaty rules (pp 4–8). Accordingly, the author's argument implies a rejection of the opinion that states have a right to spy under international law.Footnote ⁴

The author's argument is demonstrated over the eight thematic chapters, which explore the definition of cyber espionage (Chapter 1), the role of cyber espionage as a threat to international peace and security (Chapter 2), and the legality of cyber espionage in relation to some international law rules and regimes. In particular, Chapter 3 addresses the relevance of the rules on territorial sovereignty, non-intervention and non-use of force; Chapter 4 focuses on diplomatic and consular law; Chapter 5 explores international human rights law (with a specific focus on the extraterritorial application of human rights instruments and the right to privacy); and Chapter 6 engages with World Trade Organization rules. The book closes with two chapters on the existence of rules that allow states to conduct cyber espionage notwithstanding the legal constraints addressed in the earlier chapters, both as customary exceptions (Chapter 7) and as exclusions of international responsibility based on self-defence and necessity (Chapter 8). A general conclusion summarises the main results achieved through the book.

As it is not feasible to address here all the arguments presented by Buchan's book, this review will focus only on the points that most caught my attention. The first notation is on methodology. Buchan addresses the fact that cyber espionage may violate some customary and treaty international rules through persuasive deductive reasoning. The author first analyses a specific legal framework and the competing views of other scholars, then suggests his interpretation and finds in state practice and judicial decisions confirmation of his conclusions (for example, pp 51–55, 56–59 and 99–101). This method rests on the author's impressive knowledge of a variety of international law issues so that, by the end of the book, the reader has the satisfying feeling of having read an excellent work on general international law occasioned by a discussion of cyber espionage, rather than a monograph on a specific and narrow topic. This is a very positive feature, especially when compared with the ongoing trend of high specialisation in the study of just one specific area of international law.

Moreover, the author deserves praise for his courage in challenging the mainstream view according to which cyber espionage does not constitute in itself a violation of territorial sovereignty. Contrary to the finding of the Tallinn Manual,Footnote ⁵ Buchan argues that cyber espionage violates territorial sovereignty even in the absence of any ‘real-world physical damage’ or ‘destructive effects in cyberspace’ (p 53). Compellingly, he argues that the exercise of territorial sovereignty over cyber infrastructures should be assessed in the same way as the exercise of territorial sovereignty over physical territory, which is violated every time there is an intrusion with the aim of undertaking espionage activities (p 54). In this regard, the book offers an alternative view, which must be kept at the centre of the legal debate along with the views suggested by other scholarly works.

The familiarity of the author with broader issues of international law, and his capacity to apply them to the context of cyber espionage, are demonstrated also by his analysis of alleged customary exceptions that allow states to conduct cyber espionage. The author shows that covert actions cannot be taken into account in the assessment of state practice that is relevant for the emergence of customary international law (p 154), demonstrating that the existence of such exceptions is not supported by sufficiently uniform state practice (pp 155–59) and opinio juris (pp 160–63). This conclusion is in line with past scholarshipFootnote ⁶ and the assumption that international customary rules cannot be altered by violations of international law.Footnote ⁷

All in all, the book under review is an excellent monograph, which addresses a very topical issue through the lens of a variety of international law rules. The conclusions of the author are always reached after a careful examination of international scholarship and take into account a wealth of domestic and international decisions, as well as episodes of state practice. As mentioned, the book does not hesitate to engage with the mainstream views, discussing them and offering original solutions that will be relevant to future studies of cyber espionage under international law. The book is written in such a frank and honest style that the author does not hesitate to acknowledge that his view of the relationship between cyber espionage and the principle of non-intervention has evolved (p 65, note 81, referring to an earlier chapter written by the author).

This very well-argued book presents only very marginal shortcomings related to the fact that the reader, at times, may have the impression that there is something missing. For instance, as a matter of content, it would have been interesting to read the author's opinion on cyber espionage in times of armed conflict (which is outside the scope of the book – see p 26), especially because Buchan is a proficient international humanitarian lawyer in his own right.Footnote ⁸ Indeed, the regulation of espionage in armed conflict is different from that conducted in peacetime: international humanitarian law allows the collection of intelligenceFootnote ⁹ but punishes the spy caught in enemy territory with denial of prisoner of war status.Footnote ¹⁰ It would have been interesting to read Buchan's view on the application of these rules to cyber espionage, where the operator is usually located far from the theatre of the conflict.Footnote ¹¹

Moreover, the analysis of international human rights law instruments is limited to the International Covenant on Civil and Political RightsFootnote ¹² and the European Convention on Human RightsFootnote ¹³ (pp 97–105). The book could have benefited from an engagement with the protection of the right to privacy provided by the Inter-American system, especially in light of the case law and practice of the Inter-American Commission on Human Rights and the Inter-American Court of Human Rights.

Finally, the bibliography cites only one piece of scholarship that is not written in English,Footnote ¹⁴ in line with the mainstream, but nonetheless regrettable, trend of largely ignoring works written in other languages. Works on espionage that Buchan could have taken into account in his analysis of cyber espionage have been written in French and German.Footnote ¹⁵

Notwithstanding these remarks, it is irrefutable that Russel Buchan's Cyber Espionage and International Law is one of the most important and complete works on cyber espionage in international scholarship, and it will be studied and analysed for many years in the future to understand the complex relationship between cyber espionage and a number of international law rules. The book's compelling arguments, its fresh and frank style, and its sound knowledge of international law rules make this monograph a fascinating and pleasant read.