Although cyberspace has no single agreed upon definition, it consists of interdependent networks of information technology structures—including the Internet, telecommunications networks, computer systems, embedded processors and controllers—as well as the software and data that reside within them: Canada Defence Terminology Standardization Board (DTSB) (2016).
This framework is based on the applicability of international law to State activities; voluntary, non-binding norms; and the development and implementation of practical confidence building measures to help reduce the risk of conflict stemming from cyber activities.
United Nations General Assembly (UNGA), Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, UNGAOR, 68th Sess, UN Doc A/68/98*(2013) (2013 GGE Report) (later adopted by the UNGA Resolution A/RES/68/243 ); UNGA, Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, UNGAOR, 70th Sess, UN Doc A/70/174 (2015) (2015 GGE Report) (later adopted by the UNGA Resolution A/RES/70/237 ); UNGA, Report of the Open-ended working group on developments in the field of information and telecommunications in the context of international security, UN Doc A/75/816 (2021) (2021 OEWG Report); UNGA, Report of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security, 76th Sess, UN Doc A/76/135 (2021) (2021 GGE Report) (both later adopted by UNGA Resolution A/RES/76/19).
Statements by Canada during the informal consultative meeting of the Group of Governmental Experts on Advancing Responsible State behaviour in Cyberspace in the context of international security (2019), online: www.un.org/disarmament/wp-content/uploads/2020/01/statements-canada-informal-consultative-meeting-gge-5-6-december.pdf.
2021 GGE Report, supra note 3; Official compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States submitted by participating governmental experts, at 73; The NATO Cooperative Cyber Defence Centre of Excellence, International cyber law: interactive toolkit (2022), online: https://cyberlaw.ccdcoe.org/wiki/Category:National_position.
2021 OEWG Report, supra note 3 at 36-37, 39-40.
Charter of the United Nations (UN Charter), 26 June 1945 Can TS 1945 No.7.,online:
2015 GGE Report, supra note 3, which first established the eleven (11) non-binding, voluntary norms of responsible State behaviour; 2021 GGE Report, supra note 3; 2021 OEWG Report, supra note 3.
Chair’s Summary, OEWG, 3rd substantive session, Annex, UN Doc A/AC.290/2021/CRP.3* (2021) 10-15.
2021 OEWG Report, supra note 3 at 25.
Island of Palmas (or Miangas) Case: United States v Netherlands, Award, (1928) 2 RIAA 829, ICGJ 392 (PCA 1928), 4th April 1928, Permanent Court of Arbitration [PCA], online: https://legal.un.org/riaa/cases/vol_II/829-871.pdf.
R. v. Hape, 2007 SCC 26 (CanLII), [2007] 2 SCR 292, online: < https://canlii.ca/t/1rq5n.
International law provides for exceptions to the rule on territorial sovereignty such as those actions (i) authorised by the United Nations Security Council; (ii) taken in self-defence in relation to an armed attack; (iii) consented to by the affected State; or (iv) that constitute countermeasures. These exceptions apply in cyberspace.
Schmitt, Michael N., Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations, 2d ed (Cambridge: Cambridge University Press, 2017) at 20 para. 10 [hereinafter Tallinn Manual 2.0].
Of note, espionage, while not per se wrongful under international law, could be carried out in a way that might violate international law. See generally Tallinn Manual 2.0, supra note 15, Rule 4 and its discussion of cyber espionage at 19 paras 7-9.
For example, in Canada economic espionage is a violation of section 19 of the Security of Information Act (R.S.C. 1985, c.O-5), and every person who commits an offence under subsection 19(1) is guilty of an indictable offence and is liable to imprisonment for a term of not more than 10 years.
Inherently sovereign functions (also known as domaine réservé) include those matters in which a State may decide freely, such as political, economic, social, and cultural systems, as well as the formation of foreign policy.
Tallinn Manual 2.0 supra note 15, Rule 66 and accompanying commentary at 318 para 19, provides that “mere coercion does not suffice to establish a breach of the prohibition of intervention…[it] must be designed to influence outcomes in, or conduct with respect to, a matter reserved to a target State.”
See the discussion of the voluntary, non-binding UN GGE norms in the 2021 UN GGE Report, supra note 3 at 29-30, 42-46. Canada does not consider that the UN GGE consensus in 2015, and subsequently, on voluntary, non-binding norms touching on this matter precludes the recognition of a binding legal rule of due diligence under customary international law. Canada continues to study this matter.
A State may also engage international responsibility if it coerces another state or directs and controls it in the commission of an internationally wrongful act: International Law Commission, Draft Articles on Responsibility of States for Internationally Wrongful Acts (Articles on State Responsibility), with commentaries, (2001) Arts. 17, 18, online: https://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf.
Articles on State Responsibility, supra note 21,Art. 8.
Articles on State Responsibility, supra note 21, Art. 22.
In this regard the law of state responsibility foresees cases where notification may not be required – Articles on State Responsibility, supra note 21,Art. 52(b).
UN Charter, supra note 7, Art. 2(3), Art. 33(1); Tallinn Manual 2.0, supra note 15, Rule 65 at 303.
UN Charter, supra note 7, Art. 2(4).
UN Charter, supra note 7, Art. 51.
Tallinn Manual 2.0, supra note 15, Rule 80 at 375.
Tallinn Manual 2.0, supra note 15,Rule 92 at 415; see also generally Article 49(1) of the Protocol Additional to the Geneva Conventions of 12 August 1949, and Relating to the Protections of Victims of International Armed Conflicts (Protocol I), 8 June 1977, 1125 UNTS 3, online: https://www.ohchr.org/en/instruments-mechanisms/instruments/protocol-additional-geneva-conventions-12-august-1949.
Protocol I, supra note 31, Art. 36; see also generally Tallinn Manual 2.0 supra note 15, Rule 110 and accompanying commentary at 464.