Respect for Sovereignty in Cyberspace

I. Discord Regarding Sovereignty

In the late 1990s, the international legal community’s attention began to turn to a new form of warfare, then labeled “computer network attack,” a type of information operations.^[1] At the time, the Department of Defense (DoD) was at the cutting edge of thought regarding the legal significance of these operations. By 1999 its consideration of the issue had matured, and the Office of the General Counsel released An Assessment of International Legal Issues in Information Operations,^[2] which considered the application of the jus ad bellum and jus in bello rules, space law, international telecommunication law, the law governing espionage activities, specific treaty regimes, and domestic law to military operations in cyberspace. Information Operations operated from the premise that international law applies in cyberspace. This remains the U.S. approach nearly two decades later.^[3]

Yet, the document was cautionary. As it perceptively noted, the international legal system is reactive in the sense that it typically develops in response to particular situations and their consequences.^[4] This being so, the assessment warned, “we can make some educated guesses as to how the international legal system will respond to information operations, but the direction that response actually ends up taking may depend a great deal on the nature of the events that draw the nations’ attention to the issue.”^[5] Evolution in the law’s interpretation in the cyber context was therefore inevitable.

What appears to have changed since then is the DoD’s position on sovereignty in cyberspace. In 1999, the question was not whether a State could violate another State’s sovereignty as a matter of law; rather, the challenge was identifying when cyber operations do so. That the prohibition on violation of sovereignty is a substantive rule of international law was an assumption that permeated the assessment. For example, it noted that in air law the entry by one State’s aircraft into another’s national airspace was “regarded as a violation of its sovereignty and territorial integrity.”^[6] In the maritime environment, the document pointed to the 1949 Corfu Channel case,^[7] in which the International Court of Justice held that the penetration of Albanian territorial waters by British warships, and the minesweeping operation therein, without legal justification amounted to a violation of Albanian sovereignty.^[8]

Regarding cyber operations, the document observed that “[a]n unauthorized electronic intrusion into another nation’s computer systems may very well end up being regarded as a violation of the victim’s sovereignty. It may even be regarded as equivalent to a physical trespass into a nation’s territory . . . .”^[9] And with respect to responding by cyber means against individuals or groups operating from other States, it noted that:

[e]ven if it were possible to conduct a precise computer network attack on the equipment used by such individual actors, the state in which the effects of such an attack were felt, if it became aware of it, could well take the position that its sovereignty and territorial integrity had been violated.^[10]

Thus, as framed in the 1999 DoD assessment, certain State cyber operations against other States might violate the latter’s sovereignty, that is, constitute an “internationally wrongful act.”^[11] In the same vein, and over a decade later, the premise of sovereignty as a primary rule of international law capable of being violated was accepted unanimously by the international law scholars and practitioners who prepared the 2013 Tallinn Manual on the International Law Applicable to Cyber Warfare, as well as those who produced its 2017 successor, Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations.^[12]

Recently, the DoD has indicated that it may have reassessed its position that sovereignty can be violated as a matter of international law in the cyber context. The prospect surfaced publicly in a panel presentation by Colonel Gary Corn, the Staff Judge Advocate of U.S. Cyber Command, at the 2016 “CyCon U.S.” conference.^[13] Then, on the day before the President’s inauguration, Jennifer O’Connor, the Department’s General Counsel, issued a memorandum titled “International Law Framework for Employing Cyber Capabilities in Military Operations” that dealt with, inter alia, the subject of sovereignty.^[14]

Addressed to the Commanders of the Combatant Commands and very senior lawyers throughout the DoD, the memorandum was initially unclassified and circulated widely internationally. However, it was later designated as “for internal use only,” and distribution is now restricted.^[15] Nevertheless, Corn and former Principal Deputy General Counsel of the DoD Robert Taylor have since published on the subject.^[16] Considering their positions as, respectively, the most senior legal advisor for the U.S. organization that engages in military cyber operations, the author of the memorandum, and a highly placed DoD attorney at the time it was issued, it is reasonable to assume that their views are consistent with the DoD’s position.

By their approach, sovereignty does not operate as a rule of international law, the violation of which results in international legal responsibility.^[17] Instead, it is a “baseline principle . . . undergirding binding norms,”^[18] particularly the U.N. Charter Article 2(4) prohibition on the use of force and the customary international law prohibition on coercive intervention.^[19] This article examines the point of contention between the DoD’s earlier view, as well as the Tallinn Manuals’, and that which now appears to be the revised DoD position. Part II assesses the legal logic underlying the argument against the existence of such a rule and sets forth the position of the authors on the matter. Drawing on the approach adopted in Tallinn Manual 2.0, it focuses on territorial sovereignty and its inviolability by other States. In Part III, evidence that the prohibition on violating sovereignty reflects customary international law is surveyed. Included are discussions of treatment of the matter by international tribunals, States, and international organizations. A brief illustration of how the two views might play out in practice is offered in Part IV, together with the authors’ thoughts on the possible consequences of the debate.

II. Assessing the Argument Against a Primary Rule on Violations of Sovereignty

As noted, the authors of the two Tallinn Manuals unanimously agreed that the principle of sovereignty proscribes certain cyber operations conducted by States against other States. Tallinn Manual 2.0 accordingly provides in Rule 4 that “[a] State must not conduct cyber operations that violate the sovereignty of another State.”^[20] Corn took issue with the substance of the rule in a Just Security post that followed publication of the Manual and was subsequently joined by Taylor in an AJIL Unbound piece further developing the position.^[21]

Much of the argument they put forth is uncontroversial. For instance, both sides of the debate agree that the principle of sovereignty is the basis for the international law prohibitions of intervention and use of force.^[22] Yet, advocates of the “sovereignty-as-principle-only” approach draw the line at these two internationally wrongful acts, rejecting any directly operative effect of the principle itself, such as a rule prohibiting the breach of territorial inviolability. According to Corn and Taylor:

[I]t is widely recognized that states have unquestioned authority to prohibit espionage within their territory under their domestic laws, but it is also widely recognized that international law does not prohibit espionage. States have long engaged in espionage operations that involve undisclosed entry and activities within the territory of other states, subject only to the risk of diplomatic consequences or the exercise of domestic jurisdiction over intelligence operatives if discovered and caught. Within this framework, it is understood that espionage may violate international law only when the modalities employed otherwise constitute a violation of a specific provision of international law, such as an unlawful intervention or a prohibited use of force. Thus states conduct intelligence activities in and through cyberspace, and generally, “to the extent that cyber operations resemble traditional intelligence and counter-intelligence activities . . . such cyber operations would likely be treated similarly under international law.” This framework applies equally to cyber operations directed at terrorist cyber infrastructure located within the territory of another state.

Further, the differences in how sovereignty is reflected in international law with respect to the domains of space, air, and the seas further supports the view that sovereignty is a principle, subject to adjustment depending on the domain and the practical imperatives of states rather than a hard and fast rule. For instance, in the case of the space domain, objects in orbit are beyond the territorial claims of any nation, and outer space – including outer space above another state’s territory – is available for exploitation by all. In the case of the air domain, the regime is highly restrictive, such that any unconsented entry into the airspace of another state is regarded as a serious violation of international law subject to such exceptions as self-defense, Security Council authorization, or force majeure. In the case of the seas, many entries into and travels through the territory of another state are permissible without the consent of that state, but there are conditions under which such entry would be a violation of international law – it depends on the particular facts and circumstances. The fact that states have developed vastly different regimes to govern the air, space, and maritime domains underscores the fallacy of a universal rule of sovereignty with a clear application to the domain of cyberspace. The principle of sovereignty is universal, but its application to the unique particularities of the cyberspace domain remains for states to determine through state practice and/‌or the development of treaty rules.^[23]

This is where their argument breaks down, for it fails to recognize that each of the legal regimes cited—air, space, maritime, and that governing espionage—are premised on territorial integrity and inviolability. Regarding the air domain, consider a Russian military aircraft that briefly “cuts the corner” into Estonian airspace. There is no State practice supporting treatment of these incidents, which are the subject of the ongoing NATO Baltic Air Policing mission, as a use of force or coercive intervention.^[24] On the contrary, they constitute violations of Estonian national airspace,^[25] and thereby its territorial sovereignty. As will be seen, this is the generally consistent approach States take to aerial intrusions into inviolable national airspace.^[26]

With respect to outer space, States have confirmed in treaty law that it is not subject to national appropriation by claim of sovereignty.^[27] This indicates that but for that rule, which is now accepted as customary in nature, territorial sovereignty would by default be viewed as extending beyond the airspace above a State’s sovereign territory into outer space. Space law is therefore lex specialis that allows, for instance, States to place space objects into geostationary orbit above the subjacent territory of other States.^[28] It is a legal accommodation agreed to by States that is designed to permit them to operate in outer space in ways that might otherwise be prohibited through application of the lex generalis rules of territorial sovereignty.

The law of the sea also supports the primary-rule status of territorial sovereignty. Recall that Corn and Taylor opine, in reference to maritime activities, that “many entries into and travels through the territory of another State are permissible without the consent of that State, but there are conditions under which such entry would be a violation of international law—it depends on the facts and circumstances.”^[29] While their statement of the law is correct, the authors fail to acknowledge the reason why consent of the coastal States need not be obtained when another State’s vessel wishes to sail through the former’s territorial sea. States have long enjoyed territorial inviolability vis-à-vis their coastal waters. The regimes of innocent, transit, and archipelagic passage developed as customary and treaty-law exceptions to the territorial sea’s inviolability;^[30] they modify the baseline principle that maritime borders may not be pierced by other States.^[31] Territorial inviolability remains intact, subject to the exceptions.

Finally, the issue of espionage can also be viewed through the prism of territorial sovereignty. Corn and Taylor point to the long-standing State practice of engaging in espionage activities on foreign territory, which they suggest is not viewed by States as a violation of international law.^[32] Although they do not set forth the legal basis for this conclusion, a plausible argument supporting it is that, based on the extensive State practice of conducting espionage abroad, espionage constitutes a customary exception to the general rule that territorial sovereignty is inviolable. The weakness in this rationale is the limited amount of opinio juris on point, for a new customary international law rule must be grounded in both State practice and opinio juris.

By the opposing view, espionage on another State’s territory is de jure a violation of that State’s territorial sovereignty.^[33] For those advocating this position, the question in the case of remotely conducted cyber-espionage operations, therefore, would be identical to that which must be asked of any other cyber operation—at what point does an operation that does not entail physical presence on another State’s territory qualify as a violation of territorial sovereignty? The manner in which the Tallinn Manual 2.0 answers this question is set out below. But irrespective of which side of the debate one takes, territorial sovereignty resides at the heart of the underlying legal logic.

To bolster their position on territorial sovereignty, Corn and Taylor turn to the work of scholars, principally Ian Brownlie’s classic work, International Law.^[34] It is true that Brownlie characterizes the term “sovereignty” as “rather descriptive in character, referring in a ‘catch-all’ sense to the collection of rights held by a state.”^[35] What they fail to note, however, is that Brownlie, citing Corfu Channel, undeniably sees territorial inviolability as one of those rights and observes that other States accordingly shoulder a “correlative duty of respect for territorial sovereignty.”^[36]

The seminal treatise in the field, Lassa Oppenheim’s International Law, also endorses the notion that territorial sovereignty must be respected and that failure to do so constitutes a violation of international law. This view was advanced in the book’s first edition, published in 1905.

The duty of every State to abstain itself and to prevent its organs and subjects from any act which contains a violation of another State’s independence or territorial and personal supremacy is correlative to the respective right of the other State. It is impossible to enumerate all such actions as might contain a violation of this duty. But it is of value to give some illustrative examples. . . . Further, in the interest of the territorial supremacy of other States, a State is not allowed to send its troops, its men-of-war, and its police forces into or through foreign territory, or to exercise an act of administration or jurisdiction on foreign territory, without permission.^[37]

It has stood the test of time, for, although revised to accommodate new factual circumstances and the maturation of international law, the analysis was maintained by each of the book’s distinguished subsequent editors.^[38] The most recent edition (9th), published in 1992, provides,

All states are under an international legal obligation not to commit any violation of the independence, or territorial or personal authority, of any other state.

. . . .

It is not feasible to enumerate all such actions as might constitute a breach of a state’s duty not to violate another state’s independence or territorial or personal authority. But it is useful to give some illustrative examples. . . . A state is not allowed to send its troops, its warships, or its police forces into or through foreign territory, or its aircraft over it, or to carry out official investigations on foreign territory or to let its agents conduct clandestine operations there, or to exercise an act of administration or jurisdiction on foreign territory, without permission.^[39]

As is apparent, it is misguided to assert that there must exist a cyber-specific rule for cyber operations not amounting to a wrongful use of force or coercive intervention, but manifesting on another State’s territory, to qualify as violations of territorial sovereignty. The pressing task is, instead, to identify the criteria for violation thereof by means of cyber operations. Only if lex specialis subsequently emerges through treaty or crystallization of customary law, as in the case of outer space, will cyber operations that would otherwise violate a State’s territorial sovereignty be permissible.

Treating violations of sovereignty as a primary rule of international law, Tallinn Manual 2.0 seeks to add granularity to the circumstances in which a cyber operation might violate a State’s territorial sovereignty. The commentary to Rule 4, set out above, provides that, as a general matter, “[c]yber operations that prevent or disregard another State’s exercise of its sovereign prerogatives constitute a violation of such sovereignty and are prohibited by international law.”^[40] States enjoy sovereignty over cyber infrastructure, persons, and cyber activities located on their territory.^[41] This includes both public and private cyber infrastructure.^[42]

For the experts who produced Tallinn Manual 2.0, the difficulty lay in identifying those cyber operations that would violate it. They conducted their analysis along two axes: “(1) the degree of infringement upon the target State’s territorial integrity; and (2) whether there has been an interference with or usurpation of inherently governmental functions.”^[43]

With respect to infringement on territorial integrity, there was consensus that a State’s cyber operation causing physical damage or injury on the territory of another State violates the latter State’s territorial sovereignty. The group also concurred that a cyber operation resulting in a loss of functionality (such that the targeted cyber infrastructure or the equipment upon which it relies needs to be repaired or replaced) qualifies as a violation. No consensus could be achieved, however, as to remote cyber operations generating other consequences. Some experts treated the aforementioned consequences as the threshold for violation. Others suggested that violations of sovereignty might include additional operations but were unable to agree upon a definitive threshold to apply.^[44]

Clearly, however, not all cyber operations that manifest, either partially or totally, on another State’s cyber infrastructure infringe that State’s territorial inviolability.^[45] As an example, the transmission of propaganda by one State into other States from platforms in outer space or on the high seas is not considered to violate sovereignty, even when done against the target States’ wills.^[46] The examples cited by Corn and Taylor would generally fall into this category. It is correct that cyber operations involving “cyber effects in, yet invisible to, the territorial State, but that only manifest operationally in the area of hostilities”^[47] are generally permissible. Similarly, “[w]here the proposed cyber action is focused solely against the individual accounts or facilities of terrorists or terrorist organizations widely recognized as such, and when the cyber actions will generate only de minimis effects on nonterrorist infrastructure within the host State, international law does not preclude those cyber actions.”^[48] Yet, citing select examples of cyber operations that States are unlikely to consider violations of territorial sovereignty does not disprove the existence of a primary rule prohibiting breaches of territorial inviolability in other cases. On the contrary, it demonstrates the need to develop interpretive criteria by which that rule will be applied.

Tallinn Manual 2.0 additionally notes that a violation of sovereignty occurs whenever a cyber operation interferes with or usurps another State’s inherently governmental functions.^[49] This is the natural consequence of the fact that, pursuant to the notions of internal and external sovereignty,^[50] these functions fall within the exclusive purview of the State. Such violations need not be accompanied by any damage or injury, and unlike the prohibition on intervention into a State’s domaine réservé, no coercive intent or effect is required. However, as the focus of the debate over sovereignty is on its territorial aspect, the discussion that follows shall be limited to territorial sovereignty and its inviolability.

The Tallinn Manual 2.0 approach to sovereignty appears to be widely shared. Little criticism of the “sovereignty-as-rule” position, which was also reflected in the first edition of the Tallinn Manual,^[51] was heard during the nearly four years between publication of the two editions. On the contrary, discussion of sovereignty in the cyber context surrounded the identification of those cyber activities that might violate another State’s sovereignty.

Additionally, a draft of the Tallinn Manual 2.0 rule on violation of sovereignty and its accompanying commentary was discussed in three meetings of over fifty States and international organizations that were convened by the Dutch Ministry of Foreign Affairs in 2015 and 2016.^[52] Many of the States subsequently provided voluminous unofficial written comments. They voiced no meaningful objection to Rule 4. Instead, the comments focused on application of the rule to specific situations. There was even consideration of whether the prohibition encompassed cyber activities by non-State groups, a view acknowledged, but not accepted, in the Manual.^[53] Throughout this process, it appeared to be received knowledge that a primary rule on territorial-sovereignty violations existed and applied to cyber operations.

III. Evidence of a Primary Rule on Violations of Sovereignty

The question at hand is whether the principle of sovereignty operates as a primary rule of customary international law, imposing an obligation on States to respect the inviolability of other States’ territories.^[54] If so, it imposes significant operational limits on State activities on, or with effects in, the territory of those States.

In the view of the authors, overwhelming evidence of State practice and opinio juris—the foundational elements of customary international law—supports the assertion that a primary rule not to violate the territorial sovereignty of other States exists. Examples of such practice and opinio juris are offered below. Additionally, pursuant to Article 38(1)(d) of the Statute of the International Court of Justice, “judicial decisions and the teachings of the most highly qualified publicists of the various nations” constitute “subsidiary means for the determination of rules of law.”^[55] Since judicial decisions, in particular those of the International Court of Justice, are especially persuasive subsidiary means for assessing whether a customary law rule has crystallized,^[56] the examination of the supporting evidence begins with an appraisal of a number of key cases. As to the work of highly qualified publicists (scholars), the scholarship cited earlier self-evidently qualifies as such. Significant in the cyber context are the two Tallinn Manuals, the collective work of nearly forty scholars, many of whom are internationally renowned. They too would meet the requirements of Article 38(1)(d).^[57] Although length constraints preclude a comprehensive catalogue of support for the existence of a primary rule on sovereignty, that which is set forth below is proffered regarding the substance of the norm as well as to indicate the breadth and depth of the corroborating evidence.

A. Judicial Treatment

The premise that it is unlawful for a State to act on the territory of another State without the latter’s consent has long been recognized by international tribunals. In the 1927 Lotus Case, the Permanent Court of International Justice observed that “the first and foremost restriction imposed by international law upon a State is that—failing the existence of a permissive rule to the contrary—it may not exercise its power in any form in the territory of another State.”^[58] In other words, the court treated the principle as one that sets binding limits on a State’s activities on foreign territory; when a State acts without the territorial State’s consent, the former is in breach of an obligation owed the latter to respect its sovereignty.

This view of the law has been adopted by the Permanent Court’s successor, the International Court of Justice. Indeed, in its first case, Corfu Channel, the court dealt with accusations of violations of sovereignty.^[59] The case involved an incident in which British warships passing through the Corfu Channel in Albanian territorial waters in 1946 struck naval mines.^[60] Following the incident, the Royal Navy again sailed through the waters, this time to conduct minesweeping operations.^[61] The United Kingdom sought a finding that Albania was responsible for the damage to two of its vessels and the ensuing loss of life, and an order that it pay compensation.^[62] Albania counterclaimed, asking the court to decide whether the “United Kingdom under international law violated the sovereignty of the Albanian People’s Republic by reason of the acts of the Royal Navy in Albanian waters,” and, if so, whether there was a duty to provide satisfaction.^[63]

The court held Albania responsible for the damage and loss of life on the basis that it had failed to warn the United Kingdom of the dangers posed by transit through the Corfu Channel.^[64] More important to the territorial-sovereignty issue were the findings of the court relative to Albania’s claim. The United Kingdom did not contest Albania’s sovereignty over the waters, nor did it suggest the absence of a norm precluding violations of sovereignty. Instead, it argued that a special maritime legal regime, innocent passage, allowed for transit through international straits lying in a State’s territorial sea, even in the absence of consent.^[65] The court agreed and therefore was “unable to accept the Albanian contention that the Government of the United Kingdom ha[d] violated Albanian sovereignty by sending the warships through the Strait without having obtained the previous authorization of the Albanian Government.”^[66] The waters were subject to territorial sovereignty, but an exception applied.

An opposite conclusion was reached with respect to the minesweeping. Because the operations were conducted without Albania’s consent, and no exception operated, the court concluded that:

Between independent States, respect for territorial sovereignty is an essential foundation of international relations. The Court recognizes that the Albanian Government’s complete failure to carry out its duties after the explosions, and the dilatory nature of its diplomatic notes, are extenuating circumstances for the action of the United Kingdom Government. But to ensure respect for international law, of which it is the organ, the Court must declare that the action of the British Navy co[n]stituted a violation of Albanian sovereignty.^[67]

Since the 1949 Corfu Channel judgment, the International Court of Justice has continued to address the issue of, and often find, internationally wrongful violations of sovereignty. In 1973, it considered the legality of French atmospheric nuclear testing in the South Pacific.^[68] The case, Nuclear Tests, involved an Australian request for a declaratory judgment that the French testing violated international law, as well as a permanent order prohibiting France from carrying out further tests.^[69] Although it was dismissed on procedural grounds, what is relevant to the issue of breach of sovereignty as a primary rule is the Australian government’s position that the “deposit of radio-active fall-out on the territory of Australia and its dispersion in Australia’s airspace without Australia’s consent . . . violates Australian sovereignty over its territory.”^[70]

In its Memorial, Australia set forth its legal logic in making the claim:

The Government of Australia repeats that its case rests upon several bases: on the mere fact of trespass, on the harmful effects associated with trespass, and on the impairment of its independent right to determine what acts shall take place within its territory. In this connection, the Government of Australia wants to emphasize that the mere fact of trespass, the harmful effects which flow from such fall-out and the impairment of its independence, each clearly constitute a violation of the affected State’s sovereignty over and in respect of its territory.^[71]

The court then addressed the issue of a legal right to allege a violation of sovereignty.

The evident character of Australia’s legal interest in a claim alleging violation of its sovereignty over and in respect of its territory is such as to make any extended argument upon this point superfluous. It is, indeed, quite obvious that a State possesses a legal interest in the protection of its territory from any form of external harmful action, as well as in the defence of the well-being of its population and in the protection of national integrity and independence. It would indeed be positively absurd to suggest otherwise. If a State did not possess a legal interest in such matters, how could Portugal have brought the Naulilaa case against Germany . . . ; how could Albania have brought against the United Kingdom in the Corfu Channel case . . . the claim arising out of the sweeping of mines in Albanian territorial waters? The point does not require elaboration.^[72]

At least from the Australian perspective, even unintentional effects manifesting on its territory sufficed to breach territorial inviolability.

The International Court of Justice again faced the issue of territorial sovereignty in its 1986 Nicaragua judgment.^[73] The case involved Nicaragua’s assertion that the United States had breached its obligations under “general and customary international law” and “violated and is violating the sovereignty of Nicaragua” by “armed attacks against Nicaragua by air, land and sea”; “incursions into Nicaraguan territorial waters”; “aerial trespass into Nicaraguan airspace”; and “efforts by direct and indirect means to coerce and intimidate the Government of Nicaragua.”^[74]

When considering these claims, the court acknowledged linkage between State sovereignty and the prohibitions of the use of force and coercive intervention, but unambiguously differentiated between them, noting that a single act may violate more than one of the prescriptive norms:

The effects of the principle of respect for territorial sovereignty inevitably overlap with those of the principles of the prohibition of the use of force and of nonintervention. Thus the assistance to the contras, as well as the direct attacks on Nicaraguan ports, oil installations, etc., . . . not only amount to an unlawful use of force, but also constitute infringements of the territorial sovereignty of Nicaragua, and incursions into its territorial and internal waters. Similarly, the mining operations in the Nicaraguan ports not only constitute breaches of the principle of the nonuse of force, but also affect Nicaragua’s sovereignty over certain maritime expanses. The Court has in fact found that these operations were carried on in Nicaragua’s territorial or internal waters or both . . . and accordingly they constitute a violation of Nicaragua’s sovereignty. The principle of respect for territorial sovereignty is also directly infringed by the unauthorized overflight of a State’s territory by aircraft belonging to or under the control of the government of another State.^[75]

In the opinion of the court, then, territorial sovereignty enjoys independent valence. Indeed, it felt obligated to apprise the facts based on the “duty of every State to respect the territorial sovereignty of others.”^[76] Ultimately, the court found that the United States, through various actions, breached obligations under customary law with respect to intervention, use of force, and violation of territorial sovereignty.^[77] In doing so, it treated violation of territorial sovereignty as a self-standing primary norm with no less normative force than the other two.

In 2015, the International Court of Justice examined Costa Rica’s allegations that Nicaragua had sent armed forces into Costa Rican territory and dug a channel thereon, and Nicaragua’s contentions that Costa Rica had built a road in the contested area and caused transboundary environmental damage to Nicaragua.^[78] Both sides claimed that these actions violated their respective sovereignties. They disputed their opponent’s claims on the basis that no violation had occurred because the other side did not enjoy sovereignty over the areas in question. Extracts from the judgment exemplify the legal argumentation of the two States:

Costa Rica alleges that Nicaragua violated its territorial sovereignty in the area of Isla Portillos in particular by excavating in 2010 a caño with the aim of connecting the San Juan River with the Harbor Head Lagoon and laying claim to Costa Rican territory. According to Costa Rica, this violation of sovereignty was exacerbated by Nicaragua’s establishment of a military presence in the area and by its excavation in 2013 of two other caños located near the northern tip of Isla Portillos.^[79]

. . . .

Nicaragua does not contest that it dredged the three caños, but maintains that “Nicaragua enjoys full sovereignty over the caño joining Harbor Head Lagoon with the San Juan River proper, the right bank of which constitutes the land boundary as established by the 1858 Treaty . . . .” Nicaragua further submits that “Costa Rica is under an obligation to respect the sovereignty and territorial integrity of Nicaragua, within the boundaries delimited by the 1858 Treaty of Limits . . . .”^[80]

For its part, the court adopted the same territorial sovereignty-based line of analysis. As an example, it observed, “[s]ince it is uncontested that Nicaragua conducted certain activities in the disputed territory, it is necessary, in order to establish whether there was a breach of Costa Rica’s territorial sovereignty, to determine which State has sovereignty over that territory.”^[81] After answering that question, it unanimously found that “by excavating three caños and establishing a military presence on Costa Rican territory, Nicaragua has violated the territorial sovereignty of Costa Rica.”^[82]

In fact, the court left no room for debate regarding whether sovereignty can be violated as a matter of international law; it employed classic terms and concepts from the law of State responsibility, including “breach,” “responsible for breach,” and “obligation to make reparation,” thereby affirming that the obligation to respect territorial sovereignty is legally binding.^[83] Moreover, because the court found that Nicaragua had violated Costa Rica’s sovereignty, it held that it did not have to determine whether Nicaragua’s conduct amounted to a breach of the prohibition on the threat or use of force under the U.N. Charter or the Charter of the Organization of American States.^[84] Finally, the court also noted that its determination that Nicaragua had breached the territorial sovereignty of Costa Rica “provides adequate satisfaction for the nonmaterial injury suffered on this account.”^[85]

At no time in the case did either party assert the absence of a primary rule prohibiting violations of sovereignty. On the contrary, that rule lay at the heart of both sides’ claims. Nor did the court consider that option. All involved took the rule’s existence as a normative given, and the court rendered its judgment on that basis.

B. State Practice and Opinio Juris

Unlike judicial decisions, State practice and expressions of opinio juris are obligatory elements of any claim that an obligation to respect sovereignty is legally binding in customary international law. In this regard, it must be noted that States sometimes act in ways that affect, but do not violate, the exercise of sovereign rights of other States, such as imposing sanctions that impact another State’s domestic economic activities.^[86] Additionally, the term “sovereignty” frequently appears in political statements without necessarily carrying legal weight. Thus, it is essential to be sensitive to customary law’s formal components of State practice and opinio juris when examining what States do, how they react to actions by other States, and what their officials say publicly. The examples that follow have been carefully selected as illustrations of the way in which States treat the issue of sovereignty in international law, rather than as an international relations concept.

States have characterized a plethora of incidents as violations of their territorial sovereignty.^[87] It must be cautioned that some involved the armed forces and therefore may also have implicated the prohibitions of the use of force or coercive intervention. The fact that States at times chose to discuss an incident as a breach of their territorial inviolability when the actions might also have crossed the use-of-force or coercive-intervention thresholds demonstrates that States consider the former to be a primary rule distinct from other primary rules that are based in the principle of sovereignty.

Unconsented-to aerial intrusions have long been considered a violation of the subjacent State’s territorial sovereignty. Noteworthy in this regard is the incident involving the downing of an unarmed American U-2 reconnaissance aircraft by the Soviet Union and the capture of its pilot in 1960.^[88] The United States did not protest the shoot-down. This reaction contrasts sharply with U.S. condemnation of the downing of an RB-47 reconnaissance aircraft by Soviet fighters and the imprisonment of its crew the same year.^[89]

The difference can only be explained by virtue of the locations of the aircraft at the time of the shoot-downs, since both incidents involved military aircraft performing similar missions in the same year. In the case of the U-2, the aircraft was in Soviet national airspace, which both sides appeared to acknowledge was subject to Soviet sovereignty.^[90] By contrast, the RB-47 was flying in what the United States characterized as international airspace above the high seas.^[91] Accordingly, while the former involved a violation of national airspace, and thereby the Soviet Union’s territorial sovereignty, the latter, at least in the U.S. view, did not.

Four decades later, in 2001, U.S. military personnel aboard an unarmed EP-3 reconnaissance aircraft were detained after making a forced landing on a Chinese island following a mid-air collision with a Chinese fighter. China protested the nonconsensual landing, claiming, in part, that the American aircraft had “entered China’s airspace without permission, [thereby] seriously violating China’s territorial sovereignty.”^[92] The United States responded that the aircraft had been outside Chinese national airspace at the time of the collision and only entered it once in distress. It argued that while “military aircraft normally require permission to enter the territorial airspace of another nation,” the wrongfulness of penetrating foreign airspace while in distress is precluded.^[93] The dispute in the case was not over the existence of a rule prohibiting unconsented-to entry into another State’s sovereign airspace, but rather the application of a circumstance precluding wrongfulness. Indeed, by relying on the notion of distress, it can only be concluded that the United States accepted that the action would, absent such a circumstance, have amounted to an internationally wrongful act.

The debate over counterterrorist drone strikes similarly have focused attention on respect for sovereignty and territorial integrity. Although drone operations implicate the prohibition on the use of force, States regularly characterize them as sovereignty violations. For instance, Pakistan has repeatedly taken the position that “drone strikes on its territory are counterproductive, contrary to international law, a violation of Pakistani sovereignty and territorial integrity, and should cease immediately.”^[94] Russian Foreign Minister Sergey Lavrov has echoed this position, stating, “It is not right to violate the sovereignty and integrity of any State. We fully support Pakistan’s stance.”^[95] As explained below, the U.S. justification for the strikes likewise is framed in the narrative of sovereignty.

Analogous incidents have taken place at sea. In March 2007, fifteen British military personnel from the HMS Cornwall were searching a merchant dhow in the Persian Gulf^[96] when they were captured and subsequently detained for nearly two weeks by Iranian Islamic Revolutionary Guard forces.^[97] Each side claimed the other had acted unlawfully based on the location of the incident; the United Kingdom stated that its forces were in Iraqi territorial waters, whereas Iran asserted that they were operating in Iranian waters. An Iranian Foreign Ministry spokesman, for example, argued that the British forces were “violating the sovereign boundaries” of Iran at the time of their seizure.^[98] An investigation by the British Ministry of Defence concluded that a factor contributing to the incident was “[t]he absence of an internationally agreed delineation of Territorial Waters (TTW) and [Northern Arabian Gulf] water-space coordination measures between Iraq, Iran and Coalition Authorities.”^[99] The dispute was conducted in the vernacular of the violation of territorial sovereignty.

Nine years after the British–Iranian incident, the Iranian Islamic Revolutionary Guard Corps captured two U.S. Navy riverine craft with military personnel aboard after they mistakenly penetrated Iranian territorial waters. The Revolutionary Guards labeled the incident an “illegal entry into the Islamic Republic of Iran’s waters.”^[100] Following negotiations, the ten individuals were released and the boats returned. Far from criticizing Iran for its actions in seizing the crew, Secretary of State John Kerry thanked them for their cooperation.^[101] The United States understood the boats had violated Iranian sovereignty, albeit mistakenly.

Standing maritime territorial disputes regularly generate breach of territorial sovereignty claims. Most well known are those over South China Sea maritime boundaries, which are disputed by multiple countries in the region. The U.S. Navy conducts “Freedom of Navigation” (FON) operations in areas where it believes China has made excessive maritime claims, and China typically shadows the warships and warns them out of its purported territory.^[102] Such disputes even arise among close allies. For instance, in a well-known 1985 incident, a Coast Guard icebreaker navigated through the Northwest Passage, which the United States claims is an international strait, without seeking Canadian permission.^[103] In response, Canada “granted permission” (despite the lack of a request to that effect) for the voyage and, although the two countries agreed to the presence of Canadian observers onboard, the United States still disputed the Canadian claim of sovereignty over the waters.^[104]

On land, the abduction of Adolph Eichmann is a classic case regarding territorial sovereignty. Eichmann had headed the Gestapo’s Section for Jewish Affairs and was responsible for implementation of the Final Solution.^[105] Following the war, he fled to Argentina.^[106] In May 1960, the Israeli Mossad abducted Eichmann from Argentina and brought him to Israel for trial in the District Court of Jerusalem.^[107]

Following the incident, but before trial, Argentina elevated the issue to the U.N. Security Council. In a letter to the Security Council, it submitted that “[t]he illicit and clandestine transfer of Eichmann from Argentine territory constitutes a flagrant violation of the Argentine State’s right of sovereignty.”^[108] After considering the matter, the Council adopted Resolution 138, in which it observed that the “violation of the sovereignty of a Member State is incompatible with the Charter of the United Nations,” and requested that the Israeli government make appropriate reparation for its actions.^[109] Israel and Argentina subsequently issued a joint communiqué stating that they viewed as settled “the incident which was caused through the action of citizens of Israel that has violated the basic rights of the State of Argentina.”^[110]

In dealing with the question of whether a covert abduction operation in another country without that country’s consent negated its jurisdiction, the District Court did not question the position that disrespect for territorial sovereignty can constitute a violation of international law. Clearly operating from the premise that such activities can do so, it concluded:

[N]ow that the Governments of Argentina and Israel have issued their joint communique . . . to the effect that both governments have decided to view as liquidated the “incident” whereby the sovereignty of Argentina was violated, the Accused in this case can certainly retain no right to base himself on the “violated sovereignty” of the State of Argentina. The indictment in this case was presented after Argentina had forgiven Israel for that violation of her sovereignty, so that there no longer subsisted any violation of international law. In these circumstances, the Accused cannot presume to be speaking on behalf of Argentina and cannot claim rights which that sovereign state has waived.^[111]

That an extraterritorial exercise of enforcement jurisdiction amounts to a violation of sovereignty of the State in which it occurs is now well settled in international law.^[112]

An interesting incident concerning territorial sovereignty over both national airspace and land occurred in 1978, when a Soviet spacecraft with a nuclear reactor onboard, Cosmos 954, reentered the earth’s atmosphere into Canadian airspace.^[113] During reentry, the spacecraft disintegrated and debris was scattered across a wide swath of Canada. Canada claimed for compensation, both on the basis of the Convention on International Liability for Damage Caused by Space Objects^[114] and “general principles of international law.”^[115] The dispute was settled in 1981 by means of a protocol between Canada and the Soviet Union.^[116] Of particular relevance to the issue of territorial sovereignty was the approach taken by Canada in its Statement of Claim:

The intrusion of the Cosmos 954 satellite into Canada’s air space and the deposit on Canadian territory of hazardous radioactive debris from the satellite constitutes a violation of Canada’s sovereignty. This violation is established by the mere fact of the trespass of the satellite, the harmful consequences of this intrusion, being the damage caused to Canada by the presence of hazardous radioactive debris and the interference with the sovereign right of Canada to determine the acts that will be performed on its territory. International precedents recognize that a violation of sovereignty gives rise to an obligation to pay compensation.^[117]

Regarding opinio juris, senior government officials in many nations have referred for decades to the violation of sovereignty in a fashion that qualifies as such. Soviet Prime Minister Khrushchev, for example, in pointing to the notion of coexistence, stated in 1959 that:

Apart from the commitment to nonaggression, [coexistence] also presupposes an obligation on the part of all states to desist from violating each other’s territorial integrity and sovereignty in any form and under any pretext whatsoever. The principle of peaceful coexistence signifies a renunciation of interference in the internal affairs of other countries with the object of altering their system of government or mode of life or for any other motives.^[118]

Note that Khrushchev not only confirmed Soviet acceptance of a rule prohibiting violation of territorial sovereignty, but also treated it separately from interference in internal affairs (coercive intervention).

Similarly, U.S. government representatives regularly offer expressions of opinio juris that operate from the premise of territorial sovereignty’s inviolability. To illustrate, numerous statements, including ones issued with other States, were made on this basis during, and in the aftermath of, the conflict between Georgia and Russia in 2009. Following the ceasefire, for example, the State Department’s spokesperson noted that Russia’s plans to build up its military presence in the Georgian regions of Abkhazia and South Ossetia would not only breach the ceasefire agreement but also violate Georgia’s sovereignty and territorial integrity.^[119]

More recently, Russian activities with respect to the Ukraine conflict, including Russia’s belligerent occupation of the Crimean peninsula since 2014, have consistently been portrayed as violations of sovereignty. President Obama characterized Russian actions as such when discussing the matter with President Putin in March 2014.^[120] The same month, the United States delivered a statement at the U.N. Human Rights Council on behalf of forty-two nations expressing concern over Russia’s “ongoing violation of Ukraine’s sovereignty and territorial integrity”;^[121] the G-7 did likewise.^[122] President Obama then stated that Russia “flagrantly violated the sovereignty and territory of an independent European nation, Ukraine” during his “Address to the People of Europe” in April,^[123] a claim he repeated at the NATO Warsaw Summit the same year.^[124]

Many relevant statements have been made with respect to counterterrorist operations. In a speech at National Defense University in 2013, President Obama noted that “our actions are bound by consultations with partners, and respect for state sovereignty.”^[125] Other members of his administration repeatedly made the same point.^[126] Attorney General Eric Holder, speaking at Northwestern University School of Law, earlier had confirmed that “[i]nternational legal principles, including respect for another nation’s sovereignty, constrain our ability to act unilaterally.”^[127] His comments were especially salient, for the Justice Department renders the final decision on questions of law for the Executive Branch.^[128] The thread running through all of the statements has been recognition of an affirmative legal duty to respect the territorial sovereignty of other States in the conduct of U.S. counterterrorist operations; as a legal obligation, the duty represents a substantive rule, not simply the articulation of a broad normative principle or a restatement of the prohibitions of the use of force or coercive intervention.

Increasingly, senior U.S. government officials have acknowledged this duty with respect to activities in cyberspace. State Department Legal Adviser Harold Koh offered the first major statement on the matter in 2012 at an interagency legal conference convened at U.S. Cyber Command.^[129] In the speech, he addressed the issue of sovereignty head on.

States conducting activities in cyberspace must take into account the sovereignty of other States, including outside the context of armed conflict. The physical infrastructure that supports the internet and cyber activities is generally located in sovereign territory and subject to the jurisdiction of the territorial State. Because of the interconnected, interoperable nature of cyberspace, operations targeting networked information infrastructures in one country may create effects in another country. Whenever a State contemplates conducting activities in cyberspace, the sovereignty of other States needs to be considered.^[130]

The position was clear. Remote cyber operations that cause effects in other States implicate, inter alia, the territorial sovereignty of those States. Koh spoke to the fact that it is incumbent on the State planning a remote cyber operation to consider whether the effects generated abroad breach the obligation to respect other States’ territorial sovereignty; while he did not answer the question of when cyber operations violate sovereignty, he clearly accepted that in certain circumstances they do.

In a 2016 address at Berkeley Law School, Koh’s successor, Brian Egan, explicitly confirmed this point.

The very design of the Internet may lead to some encroachment on other sovereign jurisdictions. Precisely when a nonconsensual cyber operation violates the sovereignty of another State is a question lawyers within the U.S. government continue to study carefully, and it is one that ultimately will be resolved through the practice and opinio juris of States.^[131]

There was no suggestion that either of the former State Department Legal Advisers believed that sovereignty-related internationally wrongful acts in cyberspace were limited to uses of force or coercive intervention. On the contrary, both acknowledged that the principle of sovereignty applies in the cyber context and, by virtue of its legally binding nature, has operational significance.

This position tracks that contained in the 2014 U.S. submission to the U.N. Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (GGE). Stressing the application of sovereignty rules to the extraterritorial causation of effects, it noted,

Most cyber activities undertaken by States and other actors fall below the threshold of the use of force and outside of the context of armed conflict. Such activities, however, do not take place in a legal vacuum. Instead, they are governed by, inter alia, international legal principles that pertain to State sovereignty, human rights, and State responsibility.

. . . .

State sovereignty, among other long-standing international legal principles, must be taken into account in the conduct of activities in cyberspace, including outside of the context of armed conflict. Because of the interconnected, interoperable nature of cyberspace, operations targeting networked information infrastructures in one country can have effects in many countries around the world. Whenever a State contemplates conducting activities in cyberspace, the sovereignty of other States needs to be considered.^[132]

Other States also apply a substantive, vice foundational, rule of territorial inviolability to cyber activities, distinguishing it from separate relevant primary rules of international law. For instance, indicative of the Netherlands government’s views were the opening comments of the Foreign Minister Bert Koenders at the 2017 European launch of Tallinn Manual 2.0.^[133] In his speech, he noted that “we mustn’t be naive. Cyber operations against institutions, political parties and individuals underline why we need the international legal principles of sovereignty and nonintervention in the affairs of other states.”^[134] In light of the hostile cyber operations he cited, the Minister can only have attributed operational consequence to the principle of sovereignty, which he distinguished from nonintervention. He went on to emphasize that “[t]he Tallinn Manual provides guidance on the application of long-established legal principles in the cyber domain: sovereignty, nonintervention, due diligence, and state responsibility.”^[135] That guidance, as explained, attributes primary-rule significance to sovereignty, a point that could not have been lost on the Netherlands Ministry of Foreign Affairs.

C. Sovereignty in International Fora

Both the U.N. Security Council and the General Assembly have treated the violation of sovereignty as a primary rule. For example, the Security Council resolution cited above in the Eichmann case specifically referred to “violation of the sovereignty of a Member State.”^[136] But among resolutions by U.N. organs, the General Assembly’s 1970 Declaration on Friendly Relations is perhaps the most significant general pronouncement of law bearing on the existence of such a rule.^[137]

The resolution’s text is especially noteworthy because it represents an unusual consensus during the divisive Cold War. In the Declaration, the General Assembly reaffirms “the basic importance of sovereign equality and [stresses] that the purposes of the United Nations can be implemented only if States enjoy sovereign equality and comply fully with the requirements of this principle in their international relations.”^[138] This carefully negotiated verbiage implies that there are certain State actions that are not in compliance with—that is, violate—the principle of sovereign equality. This can only be so if sovereignty is more than an underlying principle; it must have operative effect.

Sovereign equality is one of seven principles highlighted by the Declaration. As to the principle, the resolution observes: “In particular, sovereign equality includes the following elements: . . . (d) [t]he territorial integrity and political independence of the State are inviolable . . . .”^[139] It is telling that the reference to territorial inviolability appears with regard to a principle, sovereign equality, that is set out separately from the principle requiring States to refrain from the threat or use of force against the territorial integrity or political independence of other States.^[140] This being so, it can only be understood as applicable in its own right.

Treaty law sheds further light on the existence of a rule prohibiting violations of territorial sovereignty. The U.N. Convention Against Transnational Organized Crime, for example, provides,

States Parties shall carry out their obligations under this Convention in a manner consistent with the principles of sovereign equality and territorial integrity of States and that of nonintervention in the domestic affairs of other States.

. . . Nothing in this Convention entitles a State Party to undertake in the territory of another State the exercise of jurisdiction and performance of functions that are reserved exclusively for the authorities of that other State by its domestic law.^[141]

Note how the first subparagraph distinguishes an act implicating sovereign equality and territorial integrity from one involving prohibited intervention, while the second deals with functions that are reserved to another State, which, as explained above, is an additional basis for finding that an act violates sovereignty.

Other treaties likewise acknowledge the inviolability of territory. For instance, the Rio Treaty refers to “the inviolability or the integrity of the territory or the sovereignty or political independence of any American State.”^[142] The Charter of the Organization of American States provides that “[t]he territory of a State is inviolable.”^[143] It also sets forth a collective security scheme that applies “[i]f the inviolability or the integrity of the territory or the sovereignty or political independence of any American State should be affected by . . . any . . . fact or situation that might endanger the peace of America.”^[144]

Statements on sovereignty in the context of cyber operations have also begun to appear in international fora. In its 2013 report, the U.N. GGE, composed of representatives from fifteen States, stated that “State sovereignty and international norms and principles that flow from sovereignty apply to State conduct of ICT-related activities, and to their jurisdiction over ICT infrastructure within their territory.”^[145] Note how the GGE differentiates State sovereignty from the norms and principles that derive from sovereignty, thereby indicating a distinction between them. Also significant is the GGE’s treatment of the applicability of sovereignty to cyber conduct in a way that distinguishes it from the mere exercise of jurisdiction over cyber activities.

The GGE’s 2015 report expanded on this distinction:

In their use of ICTs, States must observe, among other principles of international law, State sovereignty, sovereign equality, the settlement of disputes by peaceful means and nonintervention in the internal affairs of other States. Existing obligations under international law are applicable to State use of ICTs.^[146]

In other words, the GGE singled out the principle of State sovereignty, differentiating it from that of nonintervention. Moreover, the GGE did so in a paragraph that discusses the law that regulates State cyber operations, thereby accepting that the principle of sovereignty limits the “use” of cyber technologies vis-à-vis other States as a matter of international law.

Finally, in 2016, the heads of State of the Shanghai Cooperation Organization issued a joint declaration in which they “call[ed] on the international community to develop a peaceful, secure, fair and open information space based on the principles of cooperation and respect for national sovereignty and noninterference in the internal affairs of other countries.”^[147] It is clear that the obligation to respect the sovereignty of other States enjoys wide recognition globally, including in the cyber context.

IV. Concluding Thoughts

Corn and Taylor worry that a rule requiring respect for territorial sovereignty would impede important operations necessary to national security. They warn,

If the view were adopted that sovereignty is a rule violated by any action illegal under the domestic law of a state, states seeking to disrupt distributed terrorist cyber infrastructure would be under an obligation to either seek Security Council authorization or the consent of the state in whose territory the infrastructure resides. The nature of cyber operations and capabilities often require high degrees of operational security and the flexibility to act with speed and agility. Operating through a consent model could in important cases surrender operational initiative to the terrorist adversary or render response options unworkable.^[148]

Their concern is misplaced, for they treat the rule prohibiting violation of territorial sovereignty as absolute. This badly misstates the view of those supporting its validity. The rule’s proponents are clear that it does not apply to every remotely conducted cyber operation into another State’s territory. Indeed, they are divided over those operations that do breach inviolability.^[149] The assertion that the rule on sovereignty somehow would leave a State defenseless in the face of serious threats to national security is also counter-normative. International law provides a robust toolbox for a State wishing to respond to hostile cyber operations that includes retorsion,^[150] countermeasures,^[151] actions based on the plea of necessity,^[152] and self-defense.^[153]

Moreover, the consequences of the absence of such a rule for States that are the target of hostile cyber operations would be unacceptable. Although the precise threshold at which a cyber operation constitutes a use of force is unsettled in international law, it is undisputed that an offending operation must reach a high degree of severity. By the Corn and Taylor approach, operations falling below that threshold would be governed solely by the prohibition on coercive intervention. Yet a cyber operation that either does not affect a State’s domaine réservé or that is not coercive would not be encompassed in the prohibition. As an example, consider a State’s disruptive cyber operations directed against commercial cyber infrastructure in another State intended to give the former’s own companies a competitive advantage. The operations would lie beyond the prohibition because such activities are generally not considered to fall within the domaine réservé. Also problematic is the fact that cyber operations that are merely malicious or vindictive lack the requisite element of coercion.

In law as in life, what one sees depends on where one stands. Corn and Taylor take the perspective of those charged with conducting cyber operations into other States to defend the United States or otherwise advance its national interests. Thus, it is unsurprising that, given the ease by which cyber operations cross borders and their increasing frequency and severity, they do not want the hands of the Department of Defense tied.

But one must wonder whether government departments charged with the conduct of diplomacy or fashioning policy responses to hostile cyber operations will be amenable to forgoing the option of labeling other States’ hostile cyber operations as unlawful unless they cross the coercive-intervention or use-of-force thresholds, especially in light of the fact that the vast majority of the operations do not. Additionally, bringing down the normative firewall in the manner they propose would bar the taking of countermeasures in response to many hostile cyber operations because the operations would not qualify as internationally wrongful acts.^[154]

States facing cyber threats, but lacking the cyber wherewithal of the United States, are likewise unlikely to countenance a legal regime that opens the gates wide to hostile cyber operations. It would leave them legally defenseless in the face of most such operations, and factually dependent on the United States or other cyber powers for assistance in responding to them. It is worth recalling that States enjoy sovereign equality; they all get a vote in the development and subsequent authoritative interpretation of international law. That the international community will accept the possibility of a cyber “wild west” below the intervention threshold is highly unlikely.

As has been demonstrated, Corn’s and Taylor’s arguments fly in the face of long-standing State practice, opinio juris, and judicial decisions as to the application of the primary rule of sovereignty that safeguards territorial integrity and inviolability. Indeed, they have cleverly attempted to shift the burden of persuasion in this regard. However, the evidence of the rule is so dense that those asserting its nonapplicability to cyber operations manifesting on the territory of another State must, as a matter of law, bear the burden of establishing why it does not apply to cyber operations. This they have failed to do. Instead, policy arguments and analysis are offered in the attempt to rebut a well-established legal notion.

Ultimately, Corn and Taylor conclude,

[W]hether and precisely when non-consensual cyber operations below the threshold of a prohibited intervention violate international law is a question that must be resolved through the practice and opinio juris of states, developed over time and in response to the need of states effectively to defend themselves and provide security for their citizens.^[155]

They are correct, but off course. Practice and opinio juris—and perhaps treaty law—will not determine whether territorial sovereignty is inviolable; it clearly is. Rather, practice and opinio juris will inform the contours of the rule as applied in the cyber context. Over time, it may even contribute to the emergence of lex specialis rules that provide for exceptions to the lex generalis rule protecting territorial integrity and inviolability. But for the present, such possibilities amount to nothing more than lex ferenda.

1. .See Joint Chiefs of Staff, Joint Publ’n 3-13, Joint Doctrine for Information Operations viii, GL-5 (1998), http://www.c4i.org/jp3_13.pdf [https://perma.cc/F6LP-T4UJ] (approving the addition of “computer network attack” to the Department of Defense Dictionary of Military and Associated Terms). Information operations are “[t]he integrated employment, during military operations, of information-related capabilities in concert with other lines of operation to influence, disrupt, corrupt, or usurp the decision-making of adversaries and potential adversaries while protecting our own.” Joint Chiefs of Staff, Joint Publ’n 1-02, Department of Defense Dictionary of Military and Associated Terms 110 (2016), https://fas.org/irp/doddir/dod/jp1_02.pdf [https://perma.cc/7WWV-NHYK]. ↑
2. .See U.S. Dep’t of Def., Office of Gen. Counsel, An Assessment of International Legal Issues in Information Operations (2d ed. 1999), in Computer Network Attack and International Law 459, 463–65 (Michael N. Schmitt & Brian T. O’Donnell eds., 2002) [hereinafter Information Operations]. ↑
3. .There appears to be near-universal consensus that the extant international law governs cyber activities. See, e.g., Rep. of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, ¶ 24, U.N. Doc. A/70/174 (July 22, 2015) [hereinafter U.N. GGE 2015 Report] (reaffirming and expanding upon the 2013 Report infra); Rep. of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, ¶ 19, U.N. Doc. A/68/98 (June 24, 2013) [hereinafter U.N. GGE 2013 Report] (highlighting international law’s significance for information and communications technologies). ↑
4. .Information Operations, supra note 2, at 464. ↑
5. .Id. at 465. ↑
6. .Id. at 464. ↑
7. .Id. at 481. ↑
8. .Corfu Channel (U.K. v. Alb.), Judgment, 1949 I.C.J. Rep. 4, 36 (Apr. 9). ↑
9. .Information Operations, supra note 2, at 485. ↑
10. .Id. at 488. ↑
11. .An internationally wrongful act of a State consists of an action or omission that is attributable to the State under international law and constitutes a breach of an international obligation of the State. G.A. Res. 56/83, annex, Responsibility of States for Internationally Wrongful Acts, art. 2 (Jan. 28, 2002) [hereinafter Articles on State Responsibility]. ↑
12. .Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations 1 (Michael M. Schmitt & Liis Vihul eds., 2017) [hereinafter Tallinn Manual 2.0]; Tallinn Manual on the International Law Applicable to Cyber Warfare (Michael N. Schmitt ed., 2013) [hereinafter Tallinn Manual 1.0]. Primary rules are those which impose either obligations or prohibitions on States. They must be distinguished from secondary rules of international law, that is, “the general conditions under international law for the State to be considered responsible for wrongful actions or omissions, and the legal consequences which flow therefrom.” Responsibility of States for Internationally Wrongful Acts, [2001] 2 Y.B. Int’l L. Comm’n 31, U.N. Doc. A/CN.4/SER.A/2001/Add.1. Examples of secondary rules include those regarding attribution and the remedies that are available to States when international law obligations owed them are breached. ↑
13. .Colonel Corn was, however, speaking in his personal capacity. The authors spoke on the same panel. ↑
14. .Memorandum from Jennifer M. O’Connor, Gen. Counsel of the Dep’t of Def., International Law Framework for Employing Cyber Capabilities in Military Operations (Jan. 19, 2017); see infra note 15 and accompanying text. ↑
15. .As one of the authors is a DoD employee, the document cannot be quoted in this article. ↑
16. .Gary Corn, Tallinn Manual 2.0—Advancing the Conversation, Just Security (Feb. 15, 2017) https://www.justsecurity.org/37812/tallinn-manual-2-0-advancing-conversation/ [https:// perma.cc/T5XL-XK53]; Gary P. Corn & Robert Taylor, Sovereignty in the Age of Cyber, Am. J. Int’l L. Unbound (forthcoming). ↑
17. .Corn & Taylor, supra note 16. ↑
18. .Corn, supra note 16. ↑
19. .U.N. Charter art. 2, ¶ 4 (“All Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations.”). ↑
20. .Tallinn Manual 2.0, supra note 12, at 17 (Rule 4). ↑
21. .Corn, supra note 16; Corn & Taylor, supra note 16. ↑
22. .Corn & Taylor, supra note 16; Tallinn Manual 2.0, supra note 12, at 11–12. ↑
23. .Corn & Taylor, supra note 16 (emphasis omitted). ↑
24. .See NATO Air—Policing Mission, Lithuanian Armed Forces, https://kariuomene. kam.lt/en/structure_1469/air_force/nato_air_-_policing_mission.html [https://perma.cc/E82T-QQT8] (updated Mar. 1, 2017) (“NATO allies provided 34 rotations of air capabilities to patrol the Baltic airspace over the span of the mission . . . to fill in the Baltic States’ shortage of relevant aircraft for independent protection of national airspace.”). ↑
25. .See, e.g., Estonia Says Russian Aircraft Violated Airspace Again, Radio Free Europe/Radio Liberty (Sept. 6, 2016), http://www.rferl.org/a/russia-estonia-airspace-violated/27970888.html [https://perma.cc/9JCW-3A3Q] (recounting the Estonian military’s claim that a Russian aircraft violated Estonian airspace by flying within it “without permission for about 90 seconds”). ↑
26. .The Chicago Convention provides, “The contracting States recognize that every State has complete and exclusive sovereignty over the airspace above its territory.” Convention on International Civil Aviation, art. 1, Dec. 7, 1944, 61 Stat. 1180, 15 U.N.T.S. 295. Use of the term “recognize” confirms the customary international law character of such sovereignty. ↑
27. .Treaty on Principles Governing the Activities of States in the Exploration and Use of Outer Space, Including the Moon and Other Celestial Bodies, art. II, Jan. 27, 1967, 18 U.S.T. 2410, 610 U.N.T.S. 205. ↑
28. .See, e.g., Definition and Delimitation of Outer Space and the Character and Utilization of the Geostationary Orbit, 2001 Digest of United States Practice in International Law, ch. 12, § C(4) at 722 (“Article II . . . further states that outer space is not subject to national appropriation by claim of sovereignty or by any other means. Thus, a signatory . . . cannot appropriate a position in the [geostationary orbit] either by claim of sovereignty or by means of use, or even repeated use, of such an orbital position.”). ↑
29. .Corn & Taylor, supra note 16. ↑
30. .United Nations Convention on the Law of the Sea, arts. 17, 38, 52, 53, Dec. 10, 1982, 1833 U.N.T.S. 397 [hereinafter Law of the Sea Convention].  ↑
31. .This conclusion is without prejudice to authorization or mandate by the U.N. Security Council under Chapter VII of the U.N. Charter, operations conducted pursuant to the right of self-defense, or situations provided for in the law of the sea, such as force majeure or distress. See U.N. Charter arts. 42 (providing the basis for “peace enforcement” operations), 51 (affirming the right of self-defense); Law of the Sea Convention, supra note 30, art. 18, ¶ 2 (allowing stopping and anchoring in territorial seas as rendered necessary by exigent circumstances). ↑
32. .Corn & Taylor, supra note 16. ↑
33. .See, e.g., Tallinn Manual 2.0, supra note 12, at 18–19, 171 (noting that “[i]n the cyber context . . . it is a violation of territorial sovereignty for an organ of a State, or others whose conduct may be attributed to the State, to conduct cyber operations while physically present on another State’s territory,” and suggesting the majority view is that cyber espionage would constitute violation of sovereignty if the individual committing the espionage operation “is on another State’s territory while nonconsensually engaging in the operation”). ↑
34. .Corn & Taylor, supra note 16. ↑
35. .James Crawford, Brownlie’s Principles of Public International Law 448 (8th ed. 2012). ↑
36. .Id.; see also James Crawford, Sovereignty as a Legal Value, in International Law 117, 121 (James Crawford & Martti Koskenniemi eds., 2012) (“As a general matter, [sovereign] authority is exclusive: normally, governmental activity carried out on the territory of another state is only lawful if performed there with the latter’s consent . . . .”); H.W. Halleck, International Law 270 (1861) (“Every right has its correlative duty,” which in the present context would mean that a State’s right to exclusive authority within its territory carries with it the correlative duty to respect the same right of other States); Malcolm N. Shaw, International Law 353 (7th ed. 2014) (“The principle of respect for the territorial integrity of states is well founded as one of the linchpins of the international system, as is the norm prohibiting interference in the internal affairs of other states.”). ↑
37. .Lassa Oppenheim, 1 International Law: Peace 172–73 (1905). ↑
38. .R.F. Roxburgh, Lord Arnold McNair, Sir Hersch Lauterpacht, Sir Robert Jennings, and Sir Arthur Watts. ↑
39. .1 Oppenheim’s International Law: Peace 382, 385–86 (Robert Jennings & Arthur Watts eds., 9th ed. 1992) [hereinafter Oppenheim’s International Law]. ↑
40. .Tallinn Manual 2.0, supra note 12, at 17. ↑
41. .Id. at 13 (Rule 2). ↑
42. .Id. at 13–14. This is without prejudice to exceptions provided for in law, such as diplomatic protection. See, e.g., id. at 209 (“‘Premises of a mission’ refers to ‘the buildings or parts of buildings and the land ancillary thereto, irrespective of ownership, used for the purposes of the mission.’”) (quoting Vienna Convention on Diplomatic Relations, art. 1(i), Apr. 18, 1961, 23 U.S.T. 3227, 500 U.N.T.S. 95); id. at 212 (“Cyber infrastructure on the premises of a diplomatic mission or consular post is protected by the inviolability of that mission or post.”). ↑
43. .Id. at 20. ↑
44. .Id. at 20–21. ↑
45. .See Oppenheim’s International Law, supra note 39, at 385 (“However, not all acts performed by one state in the territory of another involve a violation of sovereignty.”). ↑
46. .Bruce A. Hurwitz, The Legality of Space Militarization 29–30 (1986). ↑
47. .Corn & Taylor, supra note 16. ↑
48. .Id. at 7. ↑
49. .Tallinn Manual 2.0, supra note 12, at 21. The experts found it difficult to define “inherently governmental functions” with granularity. Id. at 22. However, certain functions plainly qualify. For example, law enforcement is a function reserved to the State alone. Accordingly, if one State conducts law enforcement by cyber means, such as remote electronic search, on another State’s territory without the latter’s consent, a violation of sovereignty has taken place. ↑
50. .Id. at 13 (Rule 2); id. at 16 (Rule 3). ↑
51. .Tallinn Manual 1.0, supra note 12. ↑
52. .Michael Schmitt, The Tallinn Manual 2.0 on the International Law of Cyber Operations: What It Is and Isn’t, Just Security (Feb. 9, 2017), https://www.justsecurity.org/37559/tallinn-manual-2-0-international-law-cyber-operations/ [https://perma.cc/5YRS-F5TB]. ↑
53. .Tallinn Manual 2.0, supra note 12, at 18. ↑
54. .Customary international law is described in the Statute of the International Court of Justice as “a general practice accepted as law.” Statute of the International Court of Justice art. 38(1)(b), June 26, 1945, 59 Stat. 1031, 33 U.N.T.S. 993 [hereinafter ICJ Statute]. “Crystallization” of customary international law requires two elementsState practice (usus) and the conviction that said practice is engaged in, or refrained from, out of a sense of legal obligation (opinio juris). Continental Shelf (Libyan Arab Jamahiriya v. Malta), Judgment, 1985 I.C.J. Rep. 13, ¶ 27 (June 3) (“It is of course axiomatic that the material of customary international law is to be looked for primarily in the actual practice and opinio juris of States . . . .”). The classic case addressing these requirements is North Sea Continental Shelf (Ger. v. Den.; Ger. v. Neth.), Judgment, 1969 I.C.J. Rep. 3 (Feb. 20). For further discussion, see Int’l Law Ass’n, Comm. on Formation of Customary (Gen.) Int’l Law, Statement of Principles Applicable to the Formation of General Customary International Law ¶ 10 (2000); Yoram Dinstein, The Interaction Between Customary International Law and Treaties, in Recueil des Cours 322 (2006). ↑
55. .ICJ Statute, supra note 54, art. 38(1)(d). ↑
56. .Michael Wood (Special Rapporteur), Int’l Law Comm’n, First Report on Formation and Evidence of Customary International Law, U.N. Doc. A/CN.4/663, at 21 (May 17, 2013); Int’l Law Ass’n, supra note 54, at 4, 19. ↑
57. .ICJ Statute, supra note 54, art. 38(1)(d); see Tallinn Manual 2.0, supra note 12, at xii–xxii (listing scholars from various nations contributing to both the Tallinn Manual 2.0 and Tallinn Manual 1.0). ↑
58. .S.S. “Lotus” (Fr. v. Turk.), Judgment, 1927 P.C.I.J. (ser. A) No. 10, at 18 (Sept. 7). ↑
59. .U.K. v. Alb., 1949 I.C.J. at 6. ↑
60. .Id. at 12–13. ↑
61. .Id. at 13. ↑
62. .Id. at 10–11. ↑
63. .Id. at 6. ↑
64. .Id. at 23. ↑
65. .Id. at 27. As it is an international strait, under the modern law of the sea, passage through the Corfu Channel would be “transit passage.” Law of the Sea Convention, supra note 30, arts. 37–38. ↑
66. .U.K. v. Alb., 1949 I.C.J. at 29–30. ↑
67. .Id. at 35. ↑
68. .Nuclear Tests (Austl. v. Fr.), Judgment, 1974 I.C.J. Rep. 253, 254 (Dec. 20). ↑
69. .Id. ¶ 26. ↑
70. .Application, Nuclear Tests (Austl. v. Fr.), 1973 I.C.J. Pleadings 1, ¶ 49(ii)(a) (May 9). ↑
71. .Memorial of Australia, Nuclear Tests (Austl. v. Fr.), 1974 I.C.J. Pleadings 249, ¶ 454 (Nov. 23). ↑
72. .Id. ¶ 456. ↑
73. .Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.), Judgment, 1986 I.C.J. Rep. 14 (June 27). ↑
74. .Id. ¶ 250. ↑
75. .Id. ¶ 251. ↑
76. .Id. ¶ 213. ↑
77. .Id. ¶ 292. ↑
78. .Certain Activities Carried out by Nicaragua in the Border Area (Costa Rica v. Nicar.) and Construction of a Road in Costa Rica Along the San Juan River (Nicar. v. Costa Rica), Judgment, 2015 I.C.J. Rep. 1, 2–4 (Dec. 16), http://www.icj-cij.org/docket/files/150/18848.pdf [https://perma.cc/5RWF-RS9U]. ↑
79. .Id. ¶ 66. ↑
80. .Id. ¶ 68. ↑
81. .Id. ¶ 69. ↑
82. .Id. ¶ 229. ↑
83. .“These activities were in breach of Costa Rica’s territorial sovereignty. Nicaragua is responsible for these breaches and consequently incurs the obligation to make reparation for the damage caused by its unlawful activities . . . .” Id. ¶ 93. ↑
84. .Id. ¶¶ 96–99. ↑
85. .Id. ¶ 139. ↑
86. .See André Beirlaen, Economic Coercion and Justifying Circumstances, 18 Revue Belge de Droit Int’l 57, 67–69 (1984) (discussing the line that demarcates economic sanctions that are acceptable under international law from those that are not). ↑
87. .On the salience of examining incidents in the identification of international law norms, see W. Michael Reisman, International Incidents: Introduction to a New Genre in the Study of International Law, 10 Yale J. Int’l L. 1, 3 (1984) (“The normative expectations that political analysts infer from events are the substance of much of contemporary international law.”). ↑
88. .See Oliver Lissitzyn, Editorial Comment, Some Legal Implications of the U-2 and RB-47 Incidents, 56 Am. J. Int’l L. 135, 135 (1962) (describing the incident). ↑
89. .See id. at 136 (describing the incident). ↑
90. .Department Statement, May 7, Dep’t of St. Bull., Jan. 4, 1960, at 818; Text of Soviet Note, Dep’t of St. Bull., July 11, 1960, at 164. ↑
91. .RB-47H Shot Down, National Museum of the U.S. Air Force (June 2, 2015), http://www.nationalmuseum.af.mil/Visit/MuseumExhibits/FactSheets/Display/tabid/509/Article/197621/rb-47h-shot-down.aspx [https://perma.cc/R9GS-D3K9]. On the distinction, see also Lissitzyn, supra note 88, 136–37. ↑
92. .Surveillance Activities and Emergency Landing by U.S. Aircraft on Hainan Island, People’s Republic of China, 2001 Digest of United States Practice in International Law, ch. 12, § A(6)(3) at 707. ↑
93. .Id. at 708. ↑
94. .Ben Emmerson (Special Rapporteur), Promotion and Protection of Human Rights and Fundamental Freedoms While Countering Terrorism, ¶ 54, U.N. Doc. A/68/389 (Sept. 18, 2013). ↑
95. .Omer Farooq Khanl, Russia Backs Pakistan Fury on US Drones, Times India (Oct. 5, 2012), http://timesofindia.indiatimes.com/world/pakistan/Russia-backs-Pakistan-fury-on-US-drones/articleshow/16678916.cms [https://perma.cc/D9VF-V36U]. ↑
96. .The operation was conducted in accordance with S.C. Res. 1723 (Nov. 28, 2006). ↑
97. .Seized Sailors ‘Taken to Tehran’, BBC News (Mar. 24, 2007), http://news.bbc.co.uk/2/ hi/uk_news/6489493.stm [https://perma.cc/E9XF-X4KU]. ↑
98. .Iran Claims U.K. Troops Admit to Illegal Entry, NBC News (Mar. 24, 2007), http://www.nbcnews.com/id/17769296/ns/world_news-mideast_n_africa/t/iran-claims-uk-troops-admit-illegal-entry/ [https://perma.cc/2BC9-DB9B]. ↑
99. .Ministry of Defence, UK Boarding Operations by CTF 158 in the Northern Arabian Gulf (NAG), 2007, CJO/D/LM (20/07) (UK). ↑
100. .Iran Frees Captured US Marines, FARS News Agency (Jan. 13, 2016), http://en. farsnews.com/newstext.aspx?nn=13941023000875 [https://perma.cc/C74A-ZNPP]. ↑
101. .David E. Sanger et al., Iran’s Swift Release of U.S. Sailors Hailed as a Sign of Warmer Relations, N.Y. Times (Jan. 13, 2016), https://www.nytimes.com/2016/01/14/world/middleeast/ iran-navy-crew-release.html?_r=0 [https://perma.cc/8CCQ-REJY]. ↑
102. .Kristina Daugirdas & Julian D. Mortenson, United States Conducts Naval Operation Within Twelve Nautical Miles of Spratly Islands in the South China Sea, Prompting Protests from China, 110 Am. J. Int’l L. 120, 120 (2016). For background and information on the Freedom of Navigation Program, see the Department of Defense’s fact sheet, U.S. Dep’t of Def., Freedom of Navigation Program Fact Sheet (2015), http://policy.defense.gov/Portals/ 11/Documents/gsa/cwmd/DoD%20FON%20Program%20—%20Fact%20Sheet%20(March %202015).pdf [https://perma.cc/LT9Y-FFAE]. ↑
103. .Michael Byers, The Need to Defend Our New Northwest Passage, Tyee (Jan. 30, 2006), https://thetyee.ca/Views/2006/01/30/DefendNorthwestPassage/ [https://perma.cc/VFD6-98GW]. ↑
104. .Id. ↑
105. .Adolf Eichmann, U.S. Holocaust Memorial Museum: Holocaust Encyclopedia, https://www.ushmm.org/wlc/en/article.php?ModuleId=10007412 [https://perma.cc/8P6J-SF65]. ↑
106. .Id. ↑
107. .Id. ↑
108. .Letter from Mario Amadeo, Representative of Arg., to the U.N. Sec. Council, U.N. Doc. S/4336 (June 15, 1960). ↑
109. .S.C. Res. 138, pmbl., ¶ 2 (June 23, 1960). The explicit reference to a “violation of the sovereignty of a Member State” appears in the resolution’s preamble, whereas the operative part cites “acts . . . which affect the sovereignty of a Member State.” Id. pmbl., ¶ 1. This should not be interpreted as if the Security Council may not necessarily have regarded Israel’s action as unlawful. On the contrary, because the Security Council directed Israel to provide reparation “in accordance with . . . the rules of international law,” it must have concluded that a violation of international law had occurred; otherwise, no obligation to provide reparation would have materialized. Id. ¶ 2. ↑
110. .CrimC (Jer) 40/61 Att’y-Gen. of the Gov’t of Isr. v. Eichmann, PM 5722 ¶ 50 (1962) (Isr.) (quoting the Joint Communiqué of Israel and Argentina, reprinted in Att’y-Gen. of the Gov’t of Isr. v. Eichmann, 36 I.L.R. 59 (Isr., Dist. Ct. of Jerusalem 1961)). ↑
111. .Id. ¶ 44. ↑
112. .“A state’s law enforcement officers may exercise their functions in the territory of another state only with the consent of the other state, given by duly authorized officials of that state.” Restatement (Third) of Foreign Relations § 432(2) (Am. Law Inst. 1986). Professor Louis Henkin suggested that “[w]hen done without consent of the foreign government, abducting a person from a foreign country is a gross violation of international law and gross disrespect for a norm high in the opinion of mankind. It is a blatant violation of the territorial integrity of another state . . . .” Louis Henkin, A Decent Respect to the Opinions of Mankind, 25 John Marshall L. Rev. 215, 231 (1992). The fact that a State’s unauthorized exercise of extraterritorial-enforcement jurisdiction amounts to a violation of the other State’s sovereignty is also acknowledged in Tallinn Manual 2.0. Tallinn Manual 2.0, supra note 12, at 19, 67 (noting “[t]he Experts agreed that a violation of sovereignty occurs whenever one State physically crosses into the territory or national airspace of another State without either its consent or another justification in international law . . . ” and stating “the exercise of enforcement jurisdiction on another State’s territory constitutes a violation of that State’s sovereignty . . . except when international law provides a specific allocation of authority to exercise enforcement jurisdiction extraterritorially or when the State in which it is to be exercised consents”). Similarly, the U.N. High Commissioner for Human Rights has accepted that an extraterritorial exercise of jurisdiction may violate another State’s sovereignty. Rep. of the Office of U.N. High Comm’r for Hum. Rts. on the Right to Privacy in the Digital Age, ¶ 34, U.N. Doc. A/HRC/27/37 (June 30, 2014). ↑
113. .See Settlement of Claim Between Canada and the Union of Soviet Socialist Republics for Damage Caused by “Cosmos 954,” Canada–U.S.S.R., Apr. 2, 1981 [hereinafter Settlement of Claim]. ↑
114. .Convention on International Liability for Damage Caused by Space Objects art. II, Mar. 29, 1972, 24 U.S.T. 2389, 961 U.N.T.S. 187. ↑
115. .Settlement of Claim, supra note 113, ¶ 14. ↑
116. .Protocol in Respect of the Claim for Damages Caused by the Satellite “Cosmos 954,” Canada–U.S.S.R, Apr. 2, 1981. 1470 U.N.T.S. 269. ↑
117. .Settlement of Claim, supra note 113, ¶ 21. ↑
118. .Nikita S. Khrushchev, On Peaceful Coexistence, 38 Foreign Affairs 1, 3 (1959). ↑
119. .Russia/Georgia, 2009 Digest of United States Practice in International Law, ch. 18, §A(1)(b)(2) at 689; see also Ian Kelly, Statement on the 24th Round of the Geneva Discussions on the Conflict in Georgia (July 4, 2013), https://osce.usmission.gov/jul_4 _13_georgia/ [https://perma.cc/6R3Y-JGXE]. ↑
120. .Megan Slack, Responding to the Situation in Ukraine, White House (Mar. 20, 2014), https://obamawhitehouse.archives.gov/blog/2014/02/20/responding-situation-ukraine [https://perma.cc/V7US-C4HS]. ↑
121. .Joint Statement by 42 States at the Human Rights Council on the Situation in Ukraine, The United States Mission to the United Nations and Other International Organizations in Geneva (Mar. 26, 2014), https://geneva.usmission.gov/2014/03/26/joint-statement-by-42-states-at-the-human-rights-council-on-the-situation-in-ukraine/ [https://perma.cc/Q2UC-CBKA]. ↑
122. .G-7 Leaders Statement, White House (Mar. 2, 2014), https://obamawhitehouse. archives.gov/the-press-office/2014/03/02/g-7-leaders-statement [https://perma.cc/5KGS-FJXR]. ↑
123. .Remarks by President Obama in Address to the People of Europe, White House (Apr.  25, 2016), https://obamawhitehouse.archives.gov/the-press-office/2016/04/25/remarks-president-obama-address-people-europe [https://perma.cc/R3N4-B2E2]. ↑
124. .Press Conference by President Obama after NATO Summit, White House (July 9, 2016), https://obamawhitehouse.archives.gov/the-press-office/2016/07/09/press-conference-president-obama-after-nato-summit [https://perma.cc/ZZ38-5NTP]. ↑
125. .Remarks by the President at the National Defense University, White House (May 23, 2013), https://obamawhitehouse.archives.gov/the-press-office/2013/05/23/remarks-president-national-defense-university [https://perma.cc/A26W-6NTV]. ↑
126. .John O. Brennan, Remarks of John O. Brennan, “Strengthening our Security by Adhering to our Values and Laws”, White House (Sept. 16, 2011), https:// obamawhitehouse.archives.gov/the-press-office/2011/09/16/remarks-john-o-brennan-strengthening-our-security-adhering-our-values-an [https://perma.cc/X3TT-Z2JF]; Jeh Johnson, Jeh Johnson’s Speech on “National Security Law, Lawyers and Lawyering in the Obama Administration”, Council on Foreign Rel. (Feb. 22, 2012), https://www.cfr.org/national-security-and-defense/jeh-johnsons-speech-national-security-law-lawyers-lawyering-obama-administration/p27448 [https://perma.cc/6HHS-LZEE]. ↑
127. .Attorney General Eric Holder Speaks at Northwestern University School of Law, U.S. Dep’t of Justice (Mar. 5, 2012), https://www.justice.gov/opa/speech/attorney-general-eric-holder-speaks-northwestern-university-school-law [https://perma.cc/KFH8-4N44]. ↑
128. .28 U.S.C. §§ 511–13 (1966). Consider this statute in light of 28 C.F.R. § 0.25 (2017).  ↑
129. .Harold Koh, Legal Adviser of the U.S. State Dep’t, Remarks at the U.S. Cyber Command Inter-Agency Legal Conference (Sept. 18, 2012) (transcript available at Chris Borgen, Harold Koh on International Law in Cyberspace, Opinio Juris (Sept. 19, 2012), http://opiniojuris
     .org/2012/09/19/harold-koh-on-international-law-in-cyberspace/ [https://perma .cc/MJS5-XJVA]). ↑
130. .Id. On the speech in relation to Tallinn Manual 1.0, see Michael N. Schmitt, International Law in Cyberspace: The Koh Speech and Tallinn Manual Juxtaposed, 54 Harv. Int’l L.J. Online 13 (2012). ↑
131. .Brian J. Egan, Legal Adviser, U.S. Dep’t of State, Remarks at Berkeley Law School on International Law and Stability in Cyberspace (Nov. 10, 2016), https://www.law.berkeley.edu/wp-content/uploads/2016/12/egan-talk-transcript-111016.pdf [https://perma.cc/B6TH-232L]. ↑
132. .Applicability of International Law to Conflicts in Cyberspace, 2014 Digest of United States Practice in International Law, ch. 18, § A(3)(b), at 737. Interestingly, the Department of Defense’s own Law of War Manual emphasizes the obligation in an armed conflict to respect the sovereignty of other States during cyber operations because “cyber operations targeting networked information infrastructures in one State may create effects in another State that is not a party to the armed conflict.” U.S. Dep’t of Def., Office of Gen. Counsel, Law of War Manual 1019 (2016). Although framed in the context of neutrality, such an operation in an international armed conflict could breach the State’s obligations with respect to both territorial sovereignty and neutrality. During a noninternational armed conflict, only the former would be breached, as the law of neutrality applies only to international armed conflicts. On neutrality, see Convention Concerning the Rights and Duties of Neutral Powers and Persons in War on Land arts. 5, 10, 17, Oct. 18, 1907, 36 Stat. 2310 (discussing the nature of international neutrality) and Convention Concerning the Rights and Duties of Neutral Powers in Naval War arts. 1–12, Oct. 18, 1907, 36 Stat. 2415 (establishing protocols for neutrality at sea). In the cyber context, see Tallinn Manual 2.0, supra note 12, at 553 (explaining the relationship between neutrality and cyber warfare). ↑
133. .Bert Koenders, Foreign Minister, Neth., Remarks at The Hague Regarding Tallinn Manual 2.0 (Feb. 13, 2017) (on file with authors). ↑
134. .Id. See also the report by noted international law experts that was commissioned by the government of the Netherlands which found that “[i]nternational law is based on a strict prohibition of the use of force and a duty to respect the sovereignty and territorial inviolability of other states. These rights and duties are a two-way street . . . .” Advisory Council on Int’l Affairs and the Advisory Comm. on Issues of Pub. Int’l Law, No. 77 AIV/No. 22, CAVV, Cyber Warfare 22 (2011). ↑
135. .Koenders, supra note 133. ↑
136. .S.C. Res. 138, supra note 109, pmbl. ↑
137. .G.A. Res. 2625 (XXV), Declaration on Principles of International Law Concerning Friendly Relations and Co-operation Among States in Accordance with the Charter of the United Nations (Oct. 24, 1970). ↑
138. .Id. pmbl. ↑
139. .Id. (under preamble section titled “The principle of sovereign equality of States”). ↑
140. .Id. (under preamble section titled “The principle of equal rights and self-determination of peoples”). ↑
141. .G.A. Res. 55/25, annex, U.N. Convention Against Transnational Organized Crime, art. 4 (Jan. 8, 2001). ↑
142. .Inter-American Treaty of Reciprocal Assistance (Rio Treaty) art. 6, Sept. 2, 1947, 62 Stat. 1681, 21 U.N.T.S. 77. ↑
143. .Charter of the Organization of American States art. 17, Apr. 30, 1948, 2 U.S.T. 2394, 119 U.N.T.S. 3. ↑
144. .Id. art. 25. ↑
145. .U.N. GGE 2013 Report, supra note 3, ¶ 20. ↑
146. .U.N. GGE 2015 Report, supra note 3, ¶ 28(b). ↑
147. .The Tashkent Declaration of the Fifteenth Anniversary of the Shanghai Cooperation Organization, Embassy of the Republic of Uzbekistan in the Republic of Latvia (June 28, 2016), http://uzbekistan.lv/en/the-tashkent-declaration-of-the-fifteenth-anniversary-of-the-shanghai-cooperation-organization/ [https://perma.cc/EC6V-QK6L]. ↑
148. .Corn & Taylor, supra note 16. ↑
149. .See Tallinn Manual 2.0, supra note 12, at 19–21, 23. ↑
150. .Acts that, albeit unfriendly, are lawful, such as economic sanctions. Id. at 112. ↑
151. .Articles on State Responsibility, supra note 11, art. 22; Tallinn Manual 2.0, supra note 12, at 111 (Rule 20). ↑
152. .Articles on State Responsibility, supra note 11, art. 25; Tallinn Manual 2.0, supra note 12, at 135 (Rule 26). ↑
153. .U.N. Charter art. 51; Tallinn Manual 2.0, supra note 12, at 339 (Rule 71). ↑
154. .Of course, by the Corn and Taylor approach, qualifying a cyber response as a countermeasure may not be necessary because under the scheme many of the responses themselves would not breach an obligation owed to the other State. Yet, because responses need not be in-kind to qualify as lawful countermeasures, their approach would also remove the option of engaging in noncyber countermeasures. Tallinn Manual 2.0, supra note 12, at 128. The nonavailability of countermeasures might be especially problematic from a policy perspective as the United States continues to search for effective means by which to deter other States’ hostile cyber operations directed against it. ↑
155. .Corn & Taylor, supra note 16. ↑