EU Statement – UN Open-Ended Working Group on ICT: International Law

• The Candidate Countries North Macedonia*, Montenegro^*, Serbia^*, Albania^*, Ukraine, the Republic of Moldova, Bosnia and Herzegovina^* and Georgia, and the EFTA countries Iceland and Norway, members of the European Economic Area, as well as San Marino, align themselves with this statement.
• First, I would like to express my gratitude to you, Mr Chair and your team, for steering the work of the OEWG and providing guiding questions for this session on international law.
• We note with appreciation the increasing number of statements and national positions on the application international law delivered by Member States during OEWG sessions. From these statements we see an appetite to continue and deepen discussions on how international law applies to cyberspace. Several statements have been published recently, which we have studied with great interest; among them a very comprehensive position paper of the African Union.
• We acknowledge and appreciate that these statements are born out of a commitment to a rules-based international order and a conviction to uphold it also in the cyber environment. Moreover, the adoption of regional common positions on the application of international law demonstrate that all countries involved have engaged in the effort in  a cooperative spirit and not only sought common ground, but actively built it.
• I would like to reiterate that the core to the UN framework for responsible state behaviour in cyberspace is the application of international law. International law, including the UN Charter, the law of State responsibility, International Human Rights Law and International Humanitarian Law, fully apply in cyberspace.
• On Monday we heard numerous Member States’ concern about the threats stemming from the malicious use of ICT capabilities. We underline that States have an obligation to act in accordance with international law and must refrain from committing internationally wrongful acts.
• The UNGGE reports have affirmed that sovereignty and the international norms and principles that flow from it apply to state conduct of ICT-related activities. States have territorial sovereignty over the ICT infrastructure and persons engaged in cyber activities on their territory. However, it must be underlined that sovereignty includes both rights and obligations. For example, States have the responsibility not to breach the sovereignty of other states and to refrain from intervene directly or indirectly in the internal affairs of another State, including by means of ICTs.
• We also reaffirm the obligation of States to refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any State or in any other manner inconsistent with the purposes of the United Nations; as well as to abide by the principle of non-intervention, as outlined in the APR 2023.
• To move along with finding common ground, the European Union encourages further substantial discussions on the international law topics referred to in the APR 2023 as well as, inter alia, of International Humanitarian Law, International Human Rights Law, due diligence and the law on state responsibility.
• In particular, we support continued study of how the principles of humanity, necessity, proportionality and distinction, noted in the 2015 UN GGE report, apply to the use of ICTs by States in the context of armed conflict. To be clear, we emphasize that the recognition of the application of international humanitarian law in cyberspace in no way encourages the militarization of, or legitimizes the use of force, in cyberspace, and by contrast seeks to place limits on cyber operations in the context of an armed conflict.
• Mr Chair, the European Union has been an active promoter of international law discussions within the OEWG and will continue to contribute to these discussions. We are in particular looking forward to the dedicated discussions and expert briefings during the upcoming intersessional meeting in May and do hope that all interested parties will be afforded similar opportunities in the future. It is our firm belief that these dedicated discussions would allow to elaborate further on specific issues and thereby allow for a more substantiated exchange of views. We would propose to have a minimum of two days for further elaboration of specific issues of international law to strengthen common understandings on the application of international law. We will also propose a list of possible experts to be involved at the May intersessional meeting, as requested by the Chair.
• The development of global capacities in the areas of international law through dedicated capacity building, including scenario-based discussions, would certainly contribute to developing a common understanding on how the international law applies in cyberspace. To date, twelve EU Member States[1] have published their national positions on the application of international law to State behaviour of cyberspace and several more are working on their positions. Via workshops and trainings, such as organised by UNIDIR, EU Member States are happy to share lessons learned and best practices with other countries that are thinking of going through the same process. Building and maintaining such legal capacity is not merely an issue of legal training but needs to be acknowledged and supported by policy makers.. Publishing a national legal position on the application of international law regarding the use of ICTs by States in many cases also requires coordination among various national entities, streamlining with wider strategic objectives on a domestic level as well as contributing to the general awareness in the domestic system.
• Finally, I would like to add that the PoA is intended to provide a flexible mechanism which could serve as a suitable permanent forum for future focused discussions on the application of international law in cyberspace following the conclusion of the current OEWG in 2025. The PoA format, as an action-oriented mechanism in which capacity-building and implementation of the framework inform discussions among Member States, would facilitate States moving forward with further substantial exchanges of views on how international law applies  in cyberspace. It would thereby also allow for further discussions that may help identifying any gaps in our common understandings in view of further clarification on the rights and obligations of States.
• We have a common aim to strengthen the rule of law also with regard to cyber activities. We look forward to proceeding with international law elaborations here today, during the upcoming intersessional meetings as well as in future discussions. Thank you.

* North Macedonia, Montenegro, Serbia, Albania and Bosnia and Herzegovina continue to be part of the Stabilisation and Association Process.

[1] Czech Republic, Denmark, Estonia, Finland, France, Germany, Ireland, Italy, Netherlands, Poland, Romania, Sweden