1. The international law of the sea provides normative guidance on operations that emanate from or are carried out at sea. The International Group of Experts agreed that it is applicable to cyber operations conducted from or through cyber infrastructure located in seas (for the purposes of this Manual, the term ‘seas’ is interpreted to include oceans). Cyber operations may be mounted from ships and submarines (hereinafter collectively referred to as ‘vessels’) at sea, aircraft above the seas, offshore installations, or through submarine communication cables, both in peacetime and during armed conflict.
2. To a great extent, the rules of the customary international law of the sea are reflected in the Law of the Sea Convention. Even States that are not Parties to the Law of the Sea Convention adhere to the terms of the treaty in most respects.Footnote 551 This Chapter draws heavily on those provisions of the Convention that the Experts agreed restate customary international law.
3. With limited exceptions, vessels on the high seas (see definition in Rule 45) are subject to the principle of ‘exclusive flag State jurisdiction’.Footnote 552 Exclusive flag State jurisdiction is a cardinal doctrine of the law of the sea. It provides that the flag State has full jurisdiction (Rule 8) over vessels flying its flag.Footnote 553 The Experts concurred that such jurisdiction includes jurisdiction over cyber operations conducted from the vessels.
4. Flag States may, however, consent to the exercise of enforcement jurisdiction by other States aboard vessels flying its flag. Such consent may be expressed through an international agreement or on an ad hoc basis (on consent, see also Rule 19). Vessels may also be subject to coastal State jurisdiction depending on their location, activity, and whether they are shielded from coastal State jurisdiction due to their sovereign immune status (Rule 5). Additionally, individuals engaged in cyber activities aboard vessels are subject to prescriptive jurisdiction on the bases set forth in Rule 10.
5. The international law of the sea is a peacetime regime. Although it generally applies mutatis mutandis during periods of armed conflict (Rules 82–83), there are a number of permissive rules and prohibitions, and some nuances, that are imposed by the law of naval warfare as between belligerent States, and between belligerent and neutral States. Consequently, parties to an armed conflict do not forfeit their rights as flag States, port States, or coastal States under the international law of the sea, or become released from their duties and obligations, except insofar as certain provisions of the law of the sea are modified or supplanted by particular rules of the law of naval warfare. One example is that States engaged in an armed conflict at sea may exercise ‘mere passage’ (Rule 49) through neutral State territorial seas, as distinct from the peacetime regime of ‘innocent passage’ (Rule 48). The regime of mere passage contains armed conflict and neutrality specific nuances that restrict or regulate conduct that would otherwise be permissible pursuant to the regime of innocent passage.
1. As used in this Rule, the ‘high seas’ refers to ‘all parts of the sea that are not included in the exclusive economic zone, in the territorial sea, or in the internal waters of a State, or in the archipelagic waters of an archipelagic State’.Footnote 554 A special legal regime attaches to the exclusive economic zone (EEZ) and is dealt with in Rule 47. With respect to cyber operations in territorial seas and archipelagic waters, see Rules 48 and 53, respectively.
2. Pursuant to Article 88 of the Law of the Sea Convention, which the International Group of Experts considered reflective of customary international law, the high seas are reserved for ‘peaceful purposes’. The term ‘peaceful purposes’ in this Rule is defined by reference to Article 301 of the Convention, which restates the prohibition of the threat or use of force (Rule 68).Footnote 555
3. The International Group of Experts agreed that there is no rationale for excluding cyber activities from the scope of the notion of ‘high seas freedoms’Footnote 556 and other lawful uses of the seas. Of particular note in the cyber context are the high seas freedoms of navigation, overflight, and the laying of submarine cables.Footnote 557 Based on, for example, the first two freedoms, both aircraft and vessels are entitled to conduct cyber operations over and in the high seas so long as they do not violate applicable international law. The freedom to lay submarine communication cables is dealt with in Rule 54. In the high seas, these freedoms must be exercised with due regard for the exercise of high seas freedoms by other States.Footnote 558
4. As noted in Article 58(1) of the Law of the Sea Convention, a number of these freedoms, including the three previously mentioned, are also available in the EEZ. In light of the requirement for due regard with respect to coastal State interests, which caveats the exercise of these freedoms in the EEZ, the EEZ is treated separately in this Chapter (Rule 47).
5. The Experts concurred that military cyber operations per se do not violate this Rule. They saw no reason to deviate from the general principle that military activities not involving a prohibited use of force are within the scope of high seas freedoms and other internationally lawful uses of the sea, as set forth in Article 87(1) of the Law of the Sea Convention.Footnote 559 However, the Experts also noted that, on a more limited geographic scale, certain specific military operations – including cyber operations – could constitute a breach of a treaty commitment in relation to a sea area (including parts of the high seas). One example is the Antarctic Treaty regime, which prohibits military operations in that region for Parties thereto.Footnote 560 Such treaties are binding solely on the Parties to them.
6. The International Group of Experts agreed that establishment of undersea data centres in the high seas is lawful. In the EEZ or territorial sea, such centres may be established with the consent of the coastal State only and their operation is subject to regulation by, and the jurisdiction of (Rule 9), that State.Footnote 561
7. The caveat ‘except as otherwise provided for under international law’ in this Rule is intended to emphasise that the law of naval warfare permits certain cyber operations on the high seas within the context of an international armed conflict (Rule 82) that would otherwise be prohibited during peacetime. To illustrate, military cyber operations may be conducted in support of a blockade (Rule 128). Similarly, a cyber attack (Rule 92) upon a merchant vessel reasonably believed to be breaching a blockade is lawful if the vessel, ‘after prior warning, clearly resist[s] capture’.Footnote 562
8. Only States are bound by this Rule in their cyber operations. Activities of non-State actors at sea may be unlawful as a crime under international or domestic law, but they do not implicate the restriction reflected in this Rule unless they are attributable to a State (Rules 15 and 17). The International Group of Experts acknowledged, however, a view according to which non-State actors can violate various prohibitions bearing on activities at sea.
1. Due to the principle of exclusive flag State jurisdiction (chapeau to this Chapter), warships or other duly authorised vessels may generally not interfere, absent flag State consent, with vessels that are not of their nationality on the high seas. However, in certain specified situations they may do so. The International Group of Experts agreed that the ‘right of visit’ set forth in Article 110 of the Law of the Sea Convention reflects customary international law. It provides warships or other duly authorised vessels the legal authority to board foreign non-sovereign immune vessels that they encounter on the high seas when there is a ‘reasonable ground for suspecting’ that any of the five situations set forth in this Rule is present – the vessel is engaged in piracy, slave trading, or unauthorised broadcasting; the vessel appears to be without nationality; or the vessel is of the nationality of the visiting vessel, even when flying a foreign flag or refusing to show its flag. The same customary law right is codified in Article 58 for an EEZ.
2. The term ‘duly authorised vessel’ denotes a vessel authorised by the flag State to engage in enforcement action and clearly recognisable as such.
3. The International Group of Experts noted that social media could contribute to a finding of reasonable grounds for suspecting a vessel of conduct giving rise to a right of visit. For instance, if persons on board the vessel publish a Twitter post concerning their intention to commit acts of piracy, this could heighten suspicion as to the vessel’s conduct.
4. The scope of the actions the boarding State may subsequently take depends on the circumstances, including which of the five situations is involved. The Experts agreed that the three most relevant to cyber activities are piracy, unauthorised broadcasting, and disguising nationality.
5. With respect to ‘piracy’, a warship or other duly authorised vessel may seize a vessel on the high seas or in the EEZ that is engaged in that unlawful activity and arrest persons suspected of being inudved.Footnote 563 In order to do so, it may board the vessel in the exercise of its right of visit.Footnote 564 Cyber means could be used to facilitate an act of piracy.Footnote 565 For instance, they might be used to render a vessel immobile or unable to communicate with warships that could come to its assistance. Should there be reasonable grounds for suspecting that these or other piracy-related cyber activities are taking place, the right of visit would apply.
6. ‘Unauthorised broadcasting’ is defined as ‘the transmission of sound, radio or television broadcasts from a ship or installation on the high seas intended for reception by the general public contrary to international regulations, but excluding the transmission of distress calls’.Footnote 566 A warship or other duly authorised vessel is entitled to visit and put an end to unauthorized broadcasting so long as it enjoys jurisdiction for that specific purpose.Footnote 567 Such vessels include those of ‘any State where the transmissions can be received’ or ‘any State where authorised radio communication is suffering interference’.Footnote 568 The phenomenon of streaming radio and television content from aboard a vessel on the high seas or in the EEZ via the Internet arguably supports application of this authority in the cyber context. The Experts noted, however, that the prohibition is limited to broadcasting designed for public consumption.
7. The International Group of Experts considered the issue of whether using other online means to disseminate information from aboard vessels on the high seas or in the EEZ, such as on social media platforms like Twitter, Vkontakte.ru, or Facebook, qualifies as broadcasting for the purposes of this Rule. The Experts rejected any such extension of the prohibition. They pointed to the prohibition’s object and purpose, which is primarily focused on broadcasting that is not in compliance with international regulation, such as the regulation of broadcasting frequencies under international telecommunication law (see also Rule 63), and that produces negative effects on maritime and air communications. Posting of online material from the high seas poses no such risks. The Experts also observed that whether online material is posted from a vessel on the high seas or in the EEZ or from a city a continent away, the end result is identical. Therefore, they would limit the prohibition to those forms of broadcasting expressly set forth in the definition above.Footnote 569
8. All warships and other duly authorised vessels enjoy the right of visit with respect to vessels that appear to be without nationality, even in situations in which they are feigning a particular nationality.Footnote 570 Sometimes a vessel may display or transmit no indications of nationality. A suspicious electronic nationality indicator could also provide the requisite suspicion to permit a right of visit on this basis.
9. If there are reasonable grounds for suspecting that a vessel, though flying a foreign flag or refusing to show its flag, is of the same nationality as the warship or other duly authorised vessel, the latter may exercise its right of visit to verify the vessel’s nationality.Footnote 571 For instance, cyber means could be employed to hide the vessel’s true identity and nationality, such as by providing a false automatic identification system (AIS) identity.
10. The International Group of Experts was split with respect to whether the right of visit can be carried out virtually. Some Experts were of the view that such a ‘virtual visit’ is a reasonable exercise of the traditional right of visit. As an example, eligible vessels may use cyber means to verify the nationality of the vessel concerned by monitoring its communications or inspect its cyber infrastructure remotely when suspicion remains that the vessel is engaged in the activities set forth in this Rule. These Experts opined that a virtual visit is less intrusive than a physical visit and, therefore, appropriately encompassed in the notion of ‘right of visit’. Moreover, they suggested that a virtual inspection is consistent with the object and purpose of the right of visit and that Article 110 does not restrict the means used to conduct a visit. The Experts noted that if the right of visit can be exercised both physically and virtually, the ability to conduct a virtual visit does not prejudice the right to engage in a physical one.
11. The other Experts noted that the examination envisioned in Article 110(2) following the checking of the vessel’s documents is one that occurs ‘on board the ship’. In their view, to extend the inspection to encompass cyber means would run counter to the plain text of the Article. They therefore rejected the possibility of a right to conduct a virtual visit. Moreover, these Experts took the position that virtual inspection would likely be more intrusive than conducting an inspection of documents aboard the vessel since it would presumably involve access to more information than necessary to verify nationality. Although the vessel’s communications may be of a nature to confirm or rebut a claim of nationality, they may also be unrelated to that issue. If at all, these Experts would recognise the lawfulness of exercising the right of visit virtually if the visit is limited to accessing information that is subject to physical inspection under the right of visit.
1. The exclusive economic zone is an area beyond the territorial sea that may not extend more than 200 nautical miles seaward of the respective State’s baselines.Footnote 572 Within the EEZ, the coastal State has sovereign rights and jurisdiction for the purposes of exploration, exploitation, management, and conservation of the natural resources of the water column, seabed, and subsoil of the zone, as well as for the production of energy from the water, currents, and winds.Footnote 573 In their EEZ, States may also exercise jurisdiction over the establishment and use of artificial islands, installations, and structures having economic purposes; marine scientific research;Footnote 574 and certain incidents of vessel source pollution.Footnote 575 For example, cyber activities that interfere with energy production facilities lying within the EEZ, such as wind farms or tidal current turbines, would be within the jurisdictional competence of the coastal State.
2. All States enjoy the high seas freedoms of navigation and overflight, and of laying submarine cables (Rule 54) and pipelines, within an EEZ, as well as other internationally lawful uses of the sea related to these freedoms.Footnote 576 Thus, for instance, aircraft and vessels may rely on cyber capabilities for navigational and communication purposes while in another State’s EEZ and States are free to lay, or authorise companies over which they exercise jurisdiction to lay, submarine communication cables on the seabed of another State’s EEZ, so long as due regard is paid to the coastal State’s EEZ rights and duties.
3. A coastal State enjoys certain specified sovereign rights in its EEZ (that are primarily related to resources). The majority of the International Group of Experts agreed that vessels and aircraft of all nationalities enjoy those high seas freedoms in the EEZ that do not unduly impinge upon any of the enumerated sovereign rights of the coastal State therein, or that otherwise violate its rights. These Experts pointed out that the Convention fails to mention any security interest in the EEZ and, indeed, requires due regard only to the coastal State’s ‘rights and duties’, rather than to its interests more generally. Accordingly, military activities, such as overflight by military aircraft, naval task force manoeuvring, military exercises, surveillance, survey activities, reconnaissance and intelligence collection, and ordnance testing and firing, are permissible in another State’s EEZ, subject to due regard for coastal States rights. In particular, warships and military aircraft that have cyber operations capabilities are free to navigate and operate in and through an EEZ. Consent of the coastal State is not required.
4. A few of the Experts took the position that some military activities, including activities associated with intelligence functions and cyber operations, may not be conducted within the EEZ of a coastal State without that State’s consent. They noted that Article 58(3) of the Law of the Sea Convention emphasises that due regard must be paid to rights and duties of the coastal State, which they understood as including security. The majority responded that military activities typically have no bearing on the enjoyment of the limited sovereign rights and jurisdiction enjoyed by the coastal State in the EEZ. However, all of the Experts agreed that marine scientific research intended for the ‘benefit of all mankind’, including that conducted by the military, requires consent due to express language to that effect in the Law of the Sea Convention.Footnote 577
5. The phrase ‘except as otherwise provided for under international law’ in this Rule is intended to emphasise that, for instance, the concept of ‘peaceful purposes’ (Rule 45) does not prohibit the taking of countermeasures, including cyber countermeasures, from within an EEZ. Nor does it prohibit States from conducting belligerent operations against each other, in accordance with the law of naval warfare, in an EEZ.Footnote 578 Belligerent operations must comply, however, with the rules of naval warfare, as well as with the requirement of due regard to the coastal State’s rights and duties when that State is neutral in the conflict.Footnote 579
1. Coastal States are entitled to claim a territorial sea that extends up to 12 nautical miles from baselines determined in accordance with international law as reflected in the Law of the Sea Convention.Footnote 580 States enjoy sovereignty over the territorial sea, the seabed below it, and the airspace above it.Footnote 581 As a result, they enjoy, inter alia, the rights set forth in Rule 2.
2. In parallel with coastal State sovereignty over the territorial sea, vessels of all States, including warships, enjoy the right of innocent passage through that area. The innocent passage regime requires continuous and expeditious transit through the territorial sea. It also encompasses transit through those waters when proceeding to or from that coastal State’s internal or archipelagic waters.Footnote 582 Submarines must transit on the surface and show their flag in order to claim the right of innocent passage.Footnote 583 Aircraft do not enjoy the right of innocent passage (Rule 55).
3. The International Group of Experts agreed that the right of innocent passage is not dependent upon prior consent by, or notification to, the coastal State. However, the Experts acknowledged that certain States take the position that transit through a territorial sea by warships requires the consent of, or notification to, the coastal State.Footnote 584
4. The regime of innocent passage does not apply in waters seaward of the territorial sea or in internal waters. Sovereign immune vessels generally require diplomatic clearance from the coastal State for entry into internal waters from the territorial sea or archipelagic waters.
5. A coastal State may temporarily suspend innocent passage in specified areas if such suspension is essential for the protection of its security; suspension must be non-discriminatory among foreign vessels.Footnote 585 For instance, a State may suspend passage temporarily in order to conduct military exercises involving cyber operations if the presence of other vessels may present a cyber security risk.
6. Passage remains innocent so long as it is not prejudicial to the peace, good order, or security of the coastal State.Footnote 586 The International Group of Experts agreed that the various bases for precluding passage as ‘innocent’ set forth in Article 19(2) of the Law of the Sea Convention reflect customary international law. For example, the following cyber activities based on certain aspects of the Article would render passage non-innocent:
(1) the unlawful threat or use of force by cyber means (Rule 68) against the coastal State;
(2) exercise or practice involving cyber-enabled weapons that is not limited solely to the ship and its systems;Footnote 587
(3) cyber activities designed to collect information prejudicial to the security of the coastal State;
(5) the launching, landing, or taking on board of aircraft or other military devices, including those that engage in, or are capable of conducting, cyber operations;
(6) research or survey activities, including those conducted through cyber or cyber facilitated means;
(7) cyber operations intended to interfere with communication systems or other facilities or installations of the coastal State; and
7. This list is not exhaustive. For example, the International Group of Experts agreed that providing wireless access points to an insurgent group whose communications are being blocked by the coastal State would also be prohibited. The activity is clearly prejudicial to the security of the coastal State.
8. The Experts discussed situations involving passive (non-intrusive) assessments of wireless networks by vessels in innocent passage. A majority of them was of the view that such activities are consistent with the innocent passage regime because they are passive in nature. The minority was of the opposite view on the basis that such assessments have little to do with passage and are accordingly contrary to the interests of the coastal State.
9. The Experts also discussed the issue of conducting cyber operations directed at third States, or non-State actors located in third States, while transiting the territorial sea. The majority concluded that cyber activities undertaken while in innocent passage must not prejudice the security or good order of the coastal State, including its relations with other States and its duties with respect to those States. To illustrate, hacking into a third State’s defence network would be, for them, incompatible with innocent passage and could compromise the good order of the coastal State by affecting its relations with other States.
10. The minority took the position that each case must be assessed on its merits, emphasising in particular that the object and purpose of the innocent passage regime is to safeguard key interests of the coastal State, not third States or non-State actors. They opined that cyber operations against third States or non-State actors do not directly run afoul of the innocent passage regime in that regard. As to affecting the coastal State’s relations with other States, these Experts suggested that an array of factors must be considered to determine whether the cyber operations in fact were detrimental to the coastal State’s good order and security. In particular, the nature of the cyber operations, the extent to which they are overt, and the current state of relations between the coastal State and the third State or non-State actors are relevant factors.
11. The International Group of Experts agreed that vessels engaged in innocent passage may undertake cyber activities that are necessary to ensure their safety and security (and that of any vessels that they are accompanying), so long as the activities do not prejudice the peace, good order, or security of the coastal State. For instance, a vessel may monitor its cyber infrastructure in order to ensure that it is not being subjected to hostile cyber operations and receive patches to fix vulnerabilities. Moreover, in the event the vessel is the target of hostile cyber operations, it may take actions to terminate them by cyber means that are otherwise consistent with international legal regimes, including, when appropriate, self-defence (Rule 71). As an example, if a coastal State conducts cyber operations that violate its obligation not to hamper the innocent passage of a warship, thereby committing an internationally wrongful act (Rule 14), the flag State may respond, inter alia, with countermeasures (Rule 20).
12. Vessels lacking sovereign immunity (Rule 5) that are engaged in innocent passage are required to comply with certain laws and regulations of the coastal State. Coastal States may sometimes exercise civil and criminal jurisdiction over such vessels.Footnote 588 For example, the coastal State may adopt laws and regulations in respect of the safety of navigation that bear on cyber activities.Footnote 589 Additionally, the coastal State may promulgate laws and regulations regarding the protection of submarine communication cables (Rule 54) passing through the territorial sea that apply to vessels in innocent passage.Footnote 590
13. This Rule applies mutatis mutandis to innocent passage through archipelagic waters that are not within archipelagic sea lanesFootnote 591 or, where archipelagic sea lanes have not been designated, ‘routes normally used for international navigation’.Footnote 592 In exercising the right of archipelagic sea lanes passage (Rule 53), however, transit may be conducted in ‘normal mode’.Footnote 593
14. While the coastal State may assert certain criminal and civil jurisdiction over non-sovereign immune vessels engaged in non-innocent passage, such jurisdiction is unavailable to the coastal State with respect to sovereign immune vessels. If a sovereign immune vessel is conducting cyber activities that are inconsistent with the right of innocent passage, the coastal State’s remedy is to ‘require’ the vessel immediately to depart.Footnote 594 The International Group of Experts agreed that doing so can ultimately include forceful measures. Thus, the use of forcible cyber operations designed to compel the recalcitrant sovereign immune vessel to depart the territorial sea is a permissible measure available to the coastal State. The Experts acknowledged a view by which States may not resort to force, including cyber force, in such circumstances.
15. This Rule is without prejudice to any other applicable international law prohibitions on cyber operations, such as those prohibiting the violation of sovereignty (Rule 4) or intervention (Rule 66).
1. During periods of international armed conflict (Rule 82), the laws of naval warfare and neutrality (Chapter 20) overlay the peacetime law of the sea regime. The law of neutrality prohibits belligerents from using neutral ports and waters as a base of operations against their adversaries.Footnote 595 However, neutral coastal States may permit, but are not obligated to allow, ‘mere passage’ through their territorial sea by belligerent warships.Footnote 596 They may also impose conditions and restrictions on such passage, but if they do so, they must apply them equally to the warships of all the belligerents.Footnote 597
2. During mere passage, warships may not use the neutral waters ‘as a base of naval operations against their adversaries’Footnote 598 or otherwise engage in belligerent activities (i.e., activities related to the armed conflict). This includes conducting cyber operations against adversaries while transiting the territorial sea of a neutral State, although warships engaged in mere passage may conduct cyber operations to ensure the security of the vessel. Moreover, belligerent States may not mount cyber operations from outside a neutral’s territorial waters against enemy warships engaged in mere passage.
3. It will often be difficult for the neutral State to ‘observe’ belligerent cyber operations emanating from, or directed against, a vessel in its territorial sea. Should such activities nevertheless come to the notice of that State, the law of neutrality requires that it take action to end them. This may be accomplished by, but need not be limited to, cyber means.
4. The 1907 Hague Convention XIII prohibits a belligerent from erecting ‘any apparatus for the purpose of communicating with the belligerent forces on land or sea’ in neutral territory or waters.Footnote 599 The International Group of Experts agreed that the Rule would prohibit the emplacement of cyber infrastructure not already aboard a warship in these areas.
1. This Rule is based on Article 27 of the Law of the Sea Convention, which the International Group of Experts agreed reflects customary international law. As a general matter, authorities of the coastal State may not arrest individuals or conduct investigations on-board a vessel flagged by another State whilst that vessel is in the coastal State’s territorial waters. The Rule sets forth four well-accepted peacetime exceptions to this prohibition.Footnote 600
2. The International Group of Experts acknowledged a debate as to whether the list of grounds contained in Article 27 is exhaustive.Footnote 601 Since general consensus only exists as to the four enumerated grounds, the Experts limited the text of the Rule to those.
3. The notion of ‘consequences extending’, which has been adopted in this Rule, is undefined in the Law of the Sea Convention. The International Group of Experts agreed, however, that the coastal State may exercise enforcement jurisdiction on-board a vessel in its territorial sea if cyber operations or activities emanating from it violate the criminal law of the coastal State and manifest on that State’s territory, including its territorial waters. For instance, a DDoS operation initiated from aboard a vessel against cyber infrastructure located in the coastal State that violates the coastal State’s domestic law would qualify.
4. The Experts were divided as to whether the consequences that manifest must be significant in scale. A minority of the Experts was of the view that consequences that are de minimis or trivial do not open the door to coastal State criminal enforcement jurisdiction. By contrast, the majority was of the view that any violation of the coastal State’s law sufficed for attachment of the coastal State’s jurisdiction.
5. The International Group of Experts agreed that any cyber operation conducted from a foreign vessel in the territorial sea that has widespread effects and is therefore disruptive in the coastal State would also entitle that State to exercise enforcement jurisdiction aboard the vessel concerned. Breaches of the ‘good order of the territorial sea’ could include using cyber means to interfere with the navigational systems of other vessels in the territorial sea and interfering with communications between them or with shore stations that are necessary for safe navigation (see also Rule 63 on harmful interference).
6. Cyber activity related to illegal narcotic drug trafficking provides a further basis for the exercise of criminal enforcement jurisdiction aboard foreign vessels in the territorial sea. Consider the situation of a State monitoring cyber communications in certain vessels located in its territorial sea based on leads provided to law enforcement authorities. Should the authorities identify any communications indicating the vessel is being used for the illegal transportation of drugs, they may use cyber means to facilitate halting the vessel.
7. If a crime involving cyber activity occurs on-board an offending non-sovereign immune vessel before it departs the coastal State’s internal waters, the State may engage in enforcement jurisdiction aboard the vessel, as provided for in its own domestic law, while the vessel is located in the territorial sea.Footnote 602 With certain exceptions, coastal State authorities may not assert enforcement jurisdiction over vessels in the territorial sea in relation to offences involving cyber activities committed before the vessel entered the territorial sea. This remains the case so long as the vessel is engaged in innocent passage through the territorial sea without at any time entering the internal waters of the coastal State.Footnote 603
8. As distinct from criminal enforcement jurisdiction, coastal States may not exercise civil enforcement jurisdiction over cyber activities or those involved in cyber activities by stopping or diverting foreign vessels passing through the State’s territorial sea.Footnote 604 Although innocent passage cannot be impeded or interrupted in order to exercise civil jurisdiction over a person on-board a foreign vessel in the territorial sea, this Rule does not prevent the coastal State or any other legal person from filing civil suit against the vessel, a member of the crew, or a passenger in a subsequent proceeding. Moreover, the limitation on exercising civil enforcement jurisdiction does apply to situations in which the vessel itself assumed or incurred the obligations or liabilities in the course, or for the purpose, of transit through the territorial sea.Footnote 605
9. As noted above, this Rule is without prejudice to the application of reciprocal treaty rights and obligations that may be accepted by coastal and flag States. It is also without prejudice to the fact that during an international armed conflict, a neutral coastal State must take those actions that are necessary to ensure warships in ‘mere passage’ are complying with their obligation to refrain from belligerent cyber activities (Rule 49). Additionally, as provided for in Rule 76, the existence of a relevant UN Security Council Chapter VII mandate or authorisation can permit cyber operations in the territorial sea, even if those operations would otherwise be characterised as a breach of innocent passage.
1. States may claim a contiguous zone that extends from the limit of the territorial sea up to twenty-four nautical miles from their baselines.Footnote 606 In the area of the zone seaward of the territorial sea, the coastal State enjoys two extensions of its authority. The first is the sovereign right to enforce its fiscal, immigration, sanitary, and customs laws (the ‘FISC’ powers) against vessels that are suspected of having breached them while in the coastal State’s internal waters or territorial sea.Footnote 607
2. Should a vessel that has breached a FISC law, whether by cyber or other means, be in the contiguous zone, the coastal State may interdict the vessel prior to its departure therefrom (or in hot pursuit if done in accordance with international lawFootnote 608) and return it to port for investigation and prosecution. The coastal State may use cyber means as part of the interdiction operation. For example, it may take control of the movement of the delinquent vessel by cyber means and steer it back towards law enforcement vessels.
3. The other authority accorded the coastal State in relation to FISC issues in the contiguous zone is that of prevention.Footnote 609 This authority allows the coastal State to use cyber means to warn and prevent a vessel in the contiguous zone from carrying out a FISC-related breach that it is reasonably suspected of being about to commit in the State’s territory or territorial sea.
1. This Rule is based on Part III, Section 2, of the Law of the Sea Convention, which the International Group of Experts agreed reflected customary international law. Straits used for international navigation (‘international straits’) are those routes through a State’s territorial sea, or through the overlapping territorial seas of two or more States, that connect one area of the high seas or an EEZ to another area of the high seas or an EEZ, and that are used for international navigation. The seabed and waters in an international strait are subject to the sovereignty of the bordering State or States, and those States generally enjoy the rights and bear the obligations that apply in the territorial sea, subject to the right of transit passage enjoyed by the vessels and aircraft of other States.Footnote 610
2. The right of transit passage exists throughout the entire strait (shoreline-to-shorelineFootnote 611) and its approaches. Passage through the strait by vessels and aircraft must be continuous and expeditious and has to be conducted without delay.Footnote 612 As distinct from innocent passage, transit passage may not be suspended by the coastal State(s). Additionally, vessels and aircraft may transit in their ‘normal mode’, that is, submarines may transit submerged and aircraft may overfly the strait.Footnote 613
3. Vessels and aircraft in the strait may not claim the right if they engage in cyber activities that are inconsistent with the regime of transit passage. For example, airborne intelligence collection of cyber communications from a bordering State is inconsistent with the transit passage regime, as is transmitting anti-government propaganda by cyber means into the State.Footnote 614
4. Vessels and aircraft engaged in transit passage may undertake cyber activities necessary to ensure their safety and security, and that of any vessels or aircraft they are accompanying. Belligerent military operations, including cyber operations, whilst engaged in transit passage through a neutral strait during an armed conflict are not permitted.Footnote 615
5. Vessels or aircraft in transit passage are not subject to the laws and regulations of the States bordering the strait, except for those relating to safety of navigation, regulation of pollution, fishing activities, and FISC.Footnote 616 Such laws and regulations might address, for instance, cyber activities that are conducted in order to transmit navigational safety instructions or regulate traffic passing through the straits. All vessels and aircraft in transit passage must abide by them.
6. Although vessels and aircraft enjoying sovereign immunity might conduct cyber activities that violate coastal State laws and regulations during transit passage, the coastal State may not assert enforcement jurisdiction over them (Rule 9). However, as noted in Rule 48, the coastal State has the authority to ‘require’ a sovereign immune vessel (Rule 5) to cease its offending activity and to depart the strait.Footnote 617 Additionally, the flag State of the sovereign immune aircraft or vessel bears ‘international responsibility for any loss or damage’ that flows from non-compliance with coastal State laws and regulations.Footnote 618 It also will bear responsibility if the activity constitutes an internationally wrongful act (Rule 14).
7. Other ‘straits’ regimes in which there are varying sets of obligations also exist. One example is a strait with respect to which a specific treaty regime applies, like the Turkish Straits provided for in the Montreux Convention.Footnote 619 Such particularised regimes might affect warship passage and requirements in relation to cyber activities and must be analysed on a case-by-case basis. Another example is straits used for international navigation between the high seas or an EEZ and the territorial sea of another State. In these straits, a regime of non-suspendable innocent passage appliesFootnote 620 and reference should thus be made to Rule 48.
1. An archipelagic State is one that is comprised wholly of one or more groups of islands (archipelagos), such as the Philippines or Indonesia.Footnote 621 Archipelagic States may, within certain limitations, draw straight archipelagic baselines joining the outermost points of the outermost islands of the archipelago(s). Waters enclosed within the archipelagic baselines are archipelagic waters.Footnote 622 The territorial sea and EEZ are measured seaward from the archipelagic baselines. A State enjoys sovereignty (Rule 1) over its archipelagic waters, the airspace above the waters, and the seabed and subsoil lying below them.Footnote 623
2. Archipelagic States may designate archipelagic sea lanes and air routes suitable for the continuous and expeditious international navigation of foreign vessels and aircraft through or over their archipelagic waters.Footnote 624 If an archipelagic State does not designate such archipelagic sea lanes, the right of archipelagic sea lanes passage may nonetheless be exercised by foreign vessels and aircraft through the routes normally used for international navigation.Footnote 625
3. In archipelagic waters outside of such archipelagic sea lanes (or, where archipelagic sea lanes have not been designated, those routes normally used for international navigation), the right of innocent passage (Rule 48) applies.Footnote 626 In this regard, note that there is no right of innocent passage for aircraft and that submarines are required to navigate on the surface and show their flag in order to claim the right of innocent passage.
4. Cyber activities by foreign vessels and aircraft in designated archipelagic sea lanes or, in the absence thereof, routes normally used for international navigation, must be consistent with the archipelagic sea lanes passage regime in order for the vessel or aircraft to claim the right of archipelagic sea lanes passage. For the purposes of this Rule, archipelagic sea lanes passage is substantially similar to transit passage (Rule 52).
5. Vessels and aircraft engaged in archipelagic sea lanes passage may undertake cyber activities necessary to ensure their safety and security and those of any vessels or aircraft that they are accompanying. On this issue, see Rule 48, including the commentary on the right of the coastal State to require delinquent sovereign immune vessels to cease their offending conduct and to depart from the State’s territorial waters.Footnote 627
1. The International Group of Experts agreed that existing international law applying to submarine cables, including submarine communication cables, and the operation thereof, generally reflects customary international law.Footnote 628 For the purposes of this Rule, the term ‘submarine communication cable’ refers to any cable owned, operated, or laid by a State, as well as privately owned cables, the laying of which has been authorised by a State for international telecommunications and data traffic.
2. Submarine communication cables currently carry a majority of the world’s international voice, data, and video traffic; they are a key component of the international telecommunication and data traffic cyber infrastructure. Although employed for both commercial and governmental purposes, most cables and cable networks are owned and operated by consortia of private carriers. Such cables are vulnerable to a number of threats. They may be physically damaged, resulting in degradation, interruption, or termination of data transmission. Additionally, submarine communication cables are susceptible to being physically tapped, for instance by purpose-built submarines, such that any traffic transmitted through them can be collected, altered, or jammed.
3. The enjoyment of coastal State territorial sovereignty extends to submarine communication cables laid on the seabed of the territorial sea (and internal waters). In this sense, they generally are treated in the same fashion as cyber infrastructure located on land territory (Rule 2). Therefore, in their territorial sea, States have the right to regulate the laying, maintenance, repair, and replacement of submarine communication cables and to adopt laws and regulations in respect of their protection (in this regard, see also Rule 61).
4. In the territorial sea, coastal States may ‘adopt laws and regulations’ for ‘the protection of [submarine] cables’. Such laws may not impose restrictions that impede innocent passage (Rule 48). Likewise, coastal States may regulate activities involving submarine communication cables in international straits unless doing so impedes or hampers transit passage (Rule 52) through them.Footnote 629
5. Subject to the rights of innocent passage and archipelagic sea lanes passage, an archipelagic State has the right to regulate the laying, maintenance, repair, and replacement of submarine communication cables in its archipelagic waters and territorial sea. An archipelagic State must respect existing cables ‘laid by other States and passing through [their] waters without making a landfall’.Footnote 630 It shall, moreover, ‘permit the maintenance and replacement of such cables upon receiving due notice of their location and the intention to repair or replace them’.Footnote 631
6. States may lay submarine communication cables in the EEZ of another State, but must pay due regard to the rights and duties of the coastal State.Footnote 632 Coastal States may not regulate or impede the laying of submarine communication cables in their EEZ or on their continental shelf and shall exercise due regard with respect to the rights and duties of other States to lay submarine communication cables.Footnote 633
7. The juridical continental shelf of a coastal State consists of the seabed and subsoil of the submarine areas that extend beyond its territorial sea to the outer edge of the continental margin, or to a distance of 200 nautical miles from the baseline used to measure the width of the territorial sea where the continental margin does not extend to that distance.Footnote 634 States may lay submarine cables on another State’s continental shelf subject to the requirement of due regard.Footnote 635 Although delineation of the course of pipelines on the continental shelf is subject to coastal State consent, this requirement does not apply to submarine cables laid on the continental shelf.Footnote 636
8. A coastal State ‘may not impede the laying or maintenance of … cables’ on the continental shelf unless the actions taken qualify as ‘reasonable measures for the exploration of the continental shelf [or] the exploitation of its natural resources’.Footnote 637 Reasonableness in this context has not been defined, although the International Group of Experts agreed that a measure would be unreasonable if it rendered the laying of a submarine communication cables impossible or if it disproportionately increased the cost of laying them.Footnote 638 Similarly, a measure of a discriminatory character would generally be unreasonable. Finally, measures unrelated to the coastal State’s sovereign right to explore and exploit natural resources and engage in related activities in the EEZ or on the continental shelf are unreasonable.
9. The International Group of Experts could not achieve consensus on the balance of jurisdiction between the coastal State and the State laying the submarine communication cable on the coastal State’s continental shelf or in its EEZ. In practice, deference is sometimes extended to the coastal State, even though the laying and maintenance of submarine communication cables qualifies as a high seas freedom.
10. States enjoy the customary right to lay submarine communication cables in the high seas beyond the continental shelf.Footnote 639 This right is an integral facet of the customary freedom of the high seas, which is specifically provided for in the Law of the Sea Convention.Footnote 640
11. Land-locked States have the right of access to and from the sea for the purpose of exercising high seas freedoms.Footnote 641 The laying of submarine communication cables is one of the freedoms and, thus, land-locked States are entitled to lay submarine communication cables, in particular with a view to connecting their territories to the global cyber infrastructure. Transit of cables over the territory of neighbouring coastal States is subject to agreement between the landlocked State and the neighbouring States.Footnote 642
12. General agreement exists that the right to lay submarine communication cables includes all preparatory measures that are necessary to identify the appropriate route, as well as the right to maintain and repair a submarine communication cable. States that have laid or operate submarine communication cables also have the right to monitor and regularly inspect them.
13. Over time existing cables will have to be replaced. Although replacement is expressly addressed in the Law of the Sea Convention only with respect to archipelagic waters,Footnote 643 the majority of the International Group of Experts agreed that States have the right to replace all existing cables (at least outside the limits of the territorial sea) that are outdated or have become inoperative. This finding is based on the fact that they are critical to the economy and security of all States. Limiting the right to repair, and not replacement, would require significant financial expenditures without necessarily extending the cables’ lifespan. A minority of the Experts would limit replacement to archipelagic waters based on a view that had the drafters of the Law of the Sea Convention so intended, they would have extended the right of replacement to other areas. All of the Experts agreed that there is a right of repair vis-à-vis all cables.
14. It is unsettled whether coastal States are entitled to establish cable protection zones that restrict certain activities, such as anchoring, bottom trawling, and sand mining, that pose threats to the integrity of submarine communication cables. Australia and New Zealand were among the first States to create cable corridors/protection zones that, within the territorial sea and EEZ, shield cables one mile on each side from vessel traffic and from other hazardous activities.Footnote 644 While international law provides a sufficient basis for cable protection zones within the territorial sea,Footnote 645 there is no equivalent clear norm with respect to either the EEZ or the continental shelf, and certainly not for the high seas.
15. Without prejudice to the rules applicable during armed conflict (Part IV), the International Group of Experts agreed that the infliction of damage to cables by a State is prohibited as a matter of customary international law since doing so would run contrary to the object and purpose of the law governing submarine cables. The Experts based this conclusion on the fact that it would be incongruent to provide States a right to lay such cables without a corresponding obligation on the part of other States to respect them. Thus, for instance, the law of the sea does not provide a legal basis for a State to cut another State’s submarine fibre optic cable in order to reduce trans-continental Internet traffic in times of tension.
16. Duly authorised vessels of States may take measures to identify vessels suspected of breaking a cable and to establish the relevant facts. They may require the master of a merchant vessel suspected of doing so to provide documentation regarding the vessel’s nationality, which may be verified through investigation with the flag State and witness statements.Footnote 646
17. As noted above, submarine communication cables can be physically tapped in order to collect data transmitted through them. The International Group of Experts agreed that doing so in the territorial or archipelagic waters of another State constitutes a violation of that State’s sovereignty (Rule 4). In particular, employing a submarine or unmanned underwater vehicle to tap in territorial or archipelagic waters is inconsistent with the navigational regime of innocent passage as submarines are required to transit on the surface (Rule 48). The Experts noted, however, that a tapping operation in the territorial sea or archipelagic waters does not violate the sovereignty of other States, such as those that laid and operate the cable. They likewise agreed that tapping operations beyond waters subject to the sovereignty of the coastal or archipelagic State do not constitute a violation of sovereignty. These conclusions are without prejudice to the application of other international legal norms, such as a bilateral treaty governing the circumstances.
18. The Experts discussed the issue of causing unintentional damage while tapping a submarine communication cable. They were split as to whether the mere fact that the operation resulted in damage renders it a violation of the prohibition of causing damage to submarine cables. The majority of the Experts took the position that the existence of a special legal regime for submarine cables supports a conclusion that States engaging in tapping operations do so at their own risk. A few of the Experts were of the view that reasonable foreseeability is an element of the prohibition such that States will not be responsible for unintentional and unforeseeable consequences of their operations.
19. States Parties to the Law of the Sea Convention must adopt laws that make the wilful or culpably negligent infliction of damage to a submarine communication cable beneath the high seas a punishable offence.Footnote 647 The requirement applies by extension to the EEZ.Footnote 648 In this regard, coastal States and States laying cables both have equal responsibility to prescribe rules against infliction of damage to submarine communication cables.