Editor’s Note: This post is the first of three which will run over the coming days as part of a book discussion on the Handbook on Developing a National Position on International Law and Cyber Activities: A Practical Guide for States.
Background
The internet and other information and communication technologies (ICTs) have brought about both challenges and opportunities. ICTs have facilitated new and more effective ways of communication, collaboration, and coordination between individuals and societies in different parts of the world, bringing countless social, political and economic benefits. However, malicious cyber operations – from ransomware to electoral interference and cyberattacks on critical infrastructure – have increased in number and sophistication, with devastating security, economic, social, and humanitarian consequences that often transcend national borders. Some unique challenges of cyber operations, including their speed, secrecy and widespread impact, have prompted States to publish so-called ‘national positions’ on how they interpret and apply international law in the cyber context.
Thus far, 33 States and two regional organisations (the African Union (AU) and the European Union) have issued such positions, with many more expressing their willingness to do so. In no other field of international law have we seen as much interest in publicly releasing papers that address, often in great detail, the application of a wide range of international rules and principles. But many States – especially from the Global South – have remained silent on the matter.
The Handbook Project
Against this backdrop, the Handbook on Developing a National Position on International Law and Cyber Activities: A Practical Guide for States was written to help States navigate a number of substantive and procedural questions that might arise throughout the development of a national position. It draws on insights from 46 States that participated in regional roundtables held in Washington, Singapore, and Addis Ababa in 2024, as well as original research. The Handbook is the product of a collaborative project led by the University of Exeter, the Ministry of Foreign Affairs of Estonia, the Ministry of Foreign Affairs of Japan, and the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). The project has also benefitted from the support of partner institutions including the AU, the Organization of American States, the Foreign Office of the Federal Republic of Germany, and the Centre for International Law, National University of Singapore.
The Handbook considers a national position to be a document that has been a) issued publicly b) by a State organ, c) made available in a written format in a public repository, d) and specifically aimed at expressing legal views on the application of international law in the cyber context. Its overarching conclusion is that national positions are overall a positive development, though the choice of whether and how to publish one rests solely with each State. The national positions issued so far reflect a broad consensus among States that international law is applicable and essential to maintaining peace, security, and stability in the ICT environment. But uncertainty and disagreements still exist – and always will – about which international rules and principles apply to ICTs, how they apply, and whether developing new rules is necessary. Nevertheless, national positions have made it much easier to map out areas of convergence and divergence, as well as possible gaps. This mapping is crucial to foster dialogue and build confidence among States, driving progress in the field, even when common understandings are hard to reach.
Legal significance
The Handbook notes that national positions are not just an important policy tool but may have specific legal implications in the cyber context and beyond. Specifically, they may qualify as evidence of opinio juris and, more controversially, as State practice. As such, they can contribute to the development of customary international law. Likewise, national positions may help with the interpretation of treaties. They can potentially count as subsequent practice in the application of one or more treaties within the meaning of Article 31(3)(b) of the Vienna Convention on the Law of Treaties (VCLT), if they establish the practice of all parties to the relevant treaty(ies). More likely, national positions can constitute supplementary means of treaty interpretation in line with Article 32 of the VCLT.
There is debate about whether the silence of States that are yet to publish a national position can constitute acquiescence to the customary rules or treaty interpretations advanced by other States in their positions. Under international law, the silence of States can only amount to acquiescence to a customary rule or treaty interpretation if certain stringent conditions are met. These include the existence of sufficiently specific circumstances calling for a reaction, proper knowledge, and the passage of a reasonable amount of time (see here and here). It is unsettled whether the publication of a national position meets those conditions.
Motivations
States may have different reasons to develop a national position – or choose not to do so. The Handbook finds that national positions have served three overarching functions: 1) to communicate to different stakeholders the views of a State on the application of international law to cyber activities; 2) to transform or to adapt the rules of international law as they apply in this context; and 3) to deter, to prevent, and/or to mitigate the negative consequences of malicious cyber operations carried out by States and non-State actors.
However, several factors might make it difficult for States to achieve those aims, in particular, lack of capacity. The vast majority of the national positions published to date have been issued by developed countries. The development of a national position is a resource-intensive process, and significant investments are needed to close the capacity gap between developed and developing countries. Some States may also lack the necessary political will to embark on the process. Others might fear that they will constrain their freedom of action or prompt yet more disagreements on how international law applies to cyber activities.
Process
Various steps might be involved in the development of a national position and the Handbook systematizes these for States. To begin with, States may want to identify which internal and external stakeholders will participate in the process, bearing in mind that a balanced representation across legal, policy and technical fields is ideal. It may also be useful to designate a particular agency as the penholder. A series of further organizational steps can include assigning roles to different stakeholders and considering questions such as the scope and aims of the position, the location of relevant meetings and other tasks, the timeframe, and the various methods for carrying out each task.
States can follow different drafting strategies, such as starting from a comprehensive text and narrowing it down, or, conversely, building on an outline. The adoption of a national position may also need to follow a defined institutional process, including formal adoption by a specific authority. National positions can be reviewed when a State decides to adjust or revise its original stance or address new issues.
The task of developing and publishing a national position can be daunting and the process might never result in a published position. However, this should not discourage States, as the process itself has value, irrespective of any particular outcome. It can, for example, foster greater dialogue and coordination between domestic agencies, help States formulate internal views that need not be published, and better prepare them for discussions in multilateral processes. To support State officials in navigating this process, the Handbook includes a concise two-page checklist that outlines key steps, considerations, and good practices for developing a national position.
Substance
The Handbook also provides an overview of the various substantive issues covered in national positions to date, as well as the policy considerations underlying how States have selected and approached those issues. While there is some variation in the choice of topics as well as the depth of analysis, the national positions published to date feature a broadly consistent list of issues or areas of international law. These include foundational rules and principles – such as the principle of sovereignty and its corollaries, including non-intervention, the prohibition of the use of force, and due diligence, as well as peaceful settlement of disputes and self-determination. National positions also address specialized regimes of international law, including, in particular, international humanitarian law, international human rights law, and international criminal law. State responsibility is also a popular topic, including especially attribution, countermeasures, and necessity.
National positions have fostered agreement on many of those issues. For instance, consensus is emerging around the components of specific rules or principles, such as non-intervention and State responsibility. However, national positions have revealed areas of disagreement. These include whether certain principles also give rise to obligations, the thresholds or conditions triggering a violation of certain obligations, and whether and to what extent certain types of cyber activity – such as cyber espionage – may constitute violations.
Presentation
It is not only the substance of national positions that matters: their presentation is just as important for impact. The Handbook discusses the various options that States have for the format, style, language, and dissemination of their national positions. These features have varied significantly among the national positions published so far and reflect important policy choices, including the legal status and aims of such positions.
Some national positions were issued as government speeches (see, e.g., the 2012, 2016 and 2020 national positions of the United States (US), the national position of Israel, and the 2018 and 2022 national positions of the United Kingdom (UK)). A few have been published as UN statements (e.g., the 2020 national positions of Brazil and Czechia), and academic articles (e.g., the national positions of Denmark, Finland, Norway and Sweden, all published in a special issue of the Nordic Journal of International Law). But the vast majority of national positions have been published as standalone written documents (e.g., the national positions of Australia, Brazil, Estonia, Germany, Japan, Kazakhstan, Kenya, the Netherlands, Norway, Romania, Russia, Singapore, Switzerland, the UK, and the US published in 2021 in a United Nations (UN) Official Compendium).
The style of national positions has also oscillated between short documents of two to five pages (see, e.g., the 2017 national position of Australia and the national positions of Kenya, Kazakhstan, and Russia) and longer documents of up to 22 pages (e.g., the national positions of Austria and Colombia). The shorter national positions tend to be more general, sometimes addressing policy questions. Longer positions cover more ground and delve deeper into specific legal questions, making them more suitable if the aim is to clarify and/or develop international law.
Most national positions have been published in English. This has ensured the use of consistent legal terminology and visibility among relevant audiences, including government lawyers, diplomats, and academics. However, to increase the accessibility of national positions to other audiences, especially in the Global South, States may want to consider publishing their national positions in languages other than English, including the other official languages of the UN (Arabic, Chinese, French, Russian, and Spanish).
Conclusion: What next?
If national positions have become the primary vehicle through which States express their views on international law in the cyber context, more States should feel empowered to develop and publish their positions if they so wish. But for that to happen, more capacity-building efforts are needed, particularly in regions with little or no representation among published positions, such as Eastern Europe and the Middle East.
There has also been some debate about whether other types of instruments are needed to further clarify how international law applies to the cyber context. These include a new treaty to govern ICTs (e.g., here and here), a UN declaration (e.g., here), an Advisory Opinion by the International Court of Justice, or a study by the International Law Commission. While these proposals may or may not materialize, it is important to stress that all these initiatives can coexist and complement one another.
The Handbook also notes that the model of national positions can be leveraged to foster dialogue and common understandings on other global challenges that have given rise to legal uncertainty and disagreements among States. This is particularly the case with issues for which there is no specific treaty and/or permanent forum for multilateral discussions or adjudication, such as artificial intelligence and other emerging technologies (see e.g., here and here).
Whatever the future holds, one thing is clear: the national positions published so far are a testament to the progress that States have already made, and can continue to make, in a challenging geopolitical environment. They are a sign that, even if legal differences and tensions remain, constructive dialogue is possible. We hope the Handbook can inspire States to continue on this path, thus fostering transparency, discussion, and shared understandings on how international law can help address the world’s greatest challenges – online and offline.