National positions on international law in cyberspace

As of 30 September 2026. Information only, not legal advice – see the disclaimer.

States have agreed in the UN Groups of Governmental Experts (GGE) and Open-ended Working Groups (OEWG) that international law, and in particular the UN Charter, applies to the use of ICTs by States (see ict_norms). How specific rules apply has been set out in an increasing number of official national positions. The 2019–2021 GGE was mandated by General Assembly resolution 73/266 to annex an official compendium of voluntary national contributions; it was issued as A/76/136 (13 July 2021) and contains the contributions of 15 States. According to UNIDIR, 35 States had published national positions by the end of the OEWG 2021–2025 (23 at its start in December 2021 and 12 during its mandate), together with two regional organisations, the African Union and the European Union; several further States announced that they were preparing positions. The Cyber Law Toolkit of the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) collects and summarises published positions.

Contributions in the UN official compendium A/76/136 (2021): Australia, Brazil, Estonia, Germany, Japan, Kazakhstan, Kenya, Netherlands, Norway, Romania, Russian Federation, Singapore, Switzerland, United Kingdom, United States.

Positions listed in the Cyber Law Toolkit (year of statement; several States have issued more than one):

Further official positions:

• Kazakhstan (2021) – contribution in A/76/136.
• European Union and its Member States – Declaration on a Common Understanding of the Application of International Law to Cyberspace, approved by the Council of the EU on 18 November 2024 (Council document 15833/24).
• Colombia (2025) – national position presented at the OEWG on 18 February 2025 (Ministry of Foreign Affairs of Colombia).
• Thailand (2025) – national position released on 5 July 2025 (Ministry of Foreign Affairs of Thailand).
• Republic of Korea (2025) – position announced on 8 July 2025 (Ministry of Foreign Affairs of the Republic of Korea).

The list is not exhaustive.

Published positions converge on the applicability of the UN Charter, the principle of non-intervention and State responsibility, but differ on several points:

• Sovereignty as a rule – The United Kingdom (2018, 2021) does not consider that the general concept of sovereignty provides a basis for a specific rule or prohibition for cyber conduct beyond that of non-intervention. France (2019), the Netherlands (2019), Germany (2021) and the African Union (2024), among others, treat respect for sovereignty as a rule that can be violated by cyber operations; France and the African Union do so without requiring a threshold of harmful effects. Israel (2020) noted diverging views on whether sovereignty is a principle or a binding rule.
• Thresholds for use of force and intervention – Most positions apply a “scale and effects” test for the use of force derived from the Nicaragua judgment (icj_nicaragua) and require coercion for prohibited intervention; they differ on how these apply to operations without physical effects and to influence or disinformation campaigns, for example in relation to elections.
• Due diligence – France (2019), the African Union (2024) and the EU Declaration (2024) present due diligence as a binding obligation (of conduct). Israel (2020) stated that due diligence does not, at this point in time, translate into a binding rule in the cyber context, and the United Kingdom (2021) considers that there is not yet sufficient State practice to establish a specific cyber due diligence rule.
• Countermeasures – Estonia (2019) takes the view that States not directly injured may apply countermeasures in support of an injured State; France (2019) excludes collective countermeasures; New Zealand (2020) is open to the proposition that victim States may, in limited circumstances, request assistance from other States in applying proportionate countermeasures.
• International humanitarian law – Most positions affirm the applicability of IHL to cyber operations in armed conflict. At the end of the 2016–2017 GGE, Cuba objected (23 June 2017) to draft language on self-defence, IHL and countermeasures, stating that applying IHL to ICTs would legitimise a scenario of war. According to UNIDIR, a few delegations cautioned against including language on IHL in the final report of the OEWG 2021–2025, which records that States expressed diverse views on issues such as sovereignty, State responsibility, due diligence and IHL; some States called for new legally binding obligations.

• 2025-02-18: Colombia presented its national position at the OEWG (UNIDIR side event).
• 2025-07-05: Thailand released its national position.
• 2025-07-08: The Republic of Korea announced its national position.
• 2026-06: UNIDIR published its analysis of the international law discussions in the OEWG 2021–2025.

• ict_norms
• au_common_position
• sco_2009
• germany
• icj_nicaragua
• charter
• friendly_relations
• tallinn_manual
• cyber_sanctions

• UN, Official compendium of voluntary national contributions ... (A/76/136), 13 July 2021, accessed 2026-09-30
• Cyber Law Toolkit, Applicability of international law, accessed 2026-09-30
• Cyber Law Toolkit, Sovereignty, accessed 2026-09-30
• UNIDIR, Unpacking the OEWG on ICT Security (2021–2025): International law (2026), accessed 2026-09-30
• Declaration by the EU and its Member States on a Common Understanding of the Application of International Law to Cyberspace (Council doc. 15833/24), accessed 2026-09-30
• UNIDIR, Colombia's national position ... (event, 18 February 2025), accessed 2026-09-30
• Ministry of Foreign Affairs of Thailand, National Position (5 July 2025), accessed 2026-09-30
• Ministry of Foreign Affairs of the Republic of Korea, press release (8 July 2025), accessed 2026-09-30
• Cyber Law Toolkit, National position of the United Kingdom (2021), accessed 2026-09-30
• Cyber Law Toolkit, National position of Israel (2020), accessed 2026-09-30
• Just Security, France's Major Statement on International Law and Cyber: An Assessment (2019), accessed 2026-09-30
• M. N. Schmitt and S. Watts, Collective Cyber Countermeasures?, Harvard National Security Journal (2021), accessed 2026-09-30
• Declaration by Miguel Rodríguez, representative of Cuba, at the final session of the GGE, 23 June 2017, accessed 2026-09-30

• 2026-09-30: Entry created.