International law did not emerge with cyberspace in mind. Yet, the rules that govern relations between States apply to their conduct in the digital sphere. The challenge is determining how those rules apply to new forms of conduct and building greater common understanding around their application. While a growing number of States have set out their interpretations publicly, many have not. On the occasion of Disarmament Week, we want to bring that gap into focus.
In 2013, the UN Group of Governmental Experts affirmed that international law applies to State use of information and communications technologies (ICTs) – which was welcomed by the UN General Assembly. What States have continued to discuss in successive multilateral processes is how it applies. For example, when a cyber operation could amount to a prohibited use of force, when a State may respond and what obligations it owes.
The consequences of leaving these questions unsettled are not abstract, as legal uncertainty does not stay in the legal domain.
Cyber operations can disrupt critical infrastructure and essential services, including healthcare, transport, financial systems and government functions.
In a crisis, uncertainty about how States understand the applicable rules can compound the risks of misattribution, misperception and escalation.
Addressing the representation gap
National positions on the application of international law in cyberspace are meant to enhance transparency and contribute to common understandings. A national position is an official public statement explaining how a State understands the application of international law to its conduct in cyberspace: where it draws its lines, what it considers lawful, and how it understands its own obligations. To date, 37 States have published one, and the African Union and European Union have adopted regional views.
Participation is, however, uneven. Many of the individual positions come from the Western European and Others Group and only a handful come from other regions. For example, only one national position comes from the African Group, and four from Latin America and Caribbean Group. This is not a matter of States having nothing to contribute, but one of the conditions that shape participation: available legal and technical capacity, political will, competing national priorities and awareness of the issue.
The 2024 Common African Position reflects this uneven landscape and expressly encourages African Union Member States to issue national statements on the application of international law to cyberspace. It positions the regional view as a catalyst for, rather than a substitute for, individual national positions.
Against this backdrop, developing capacity on how international law applies in cyberspace has gained prominence in multilateral processes. States have encouraged capacity building initiatives that can contribute to the equal and effective participation of a broader and diverse range of States in these discussions.
How UNIDIR supports States
UNIDIR’s Security and Technology Programme supports States seeking to develop their own national positions.
Our approach is grounded in a simple principle. Every State has an equal right to participate in shaping international law as it applies in cyberspace, and every State’s views carry equal weight in that process.
Our role is not to prescribe what a State’s legal position should be. It is to provide practical support, facilitate exchange and help States navigate the process of developing their own views.
In 2024, UNIDIR published A Compendium of Good Practices: Developing a National Position on the Interpretation of International Law and State Use of ICT. It draws on a closed-door workshop with representatives of 19 States (two thirds had published views at that time). The Compendium distils practical lessons on three questions:
- Why do States develop a position?
- What could it cover?
- How could the process work?
The Compendium sets out ten recommended steps, from defining scope and identifying stakeholders to capacity building, drafting, adoption and dissemination.
UNIDIR is currently preparing Compendium 2.0, which will capture new and updated national positions and analyse the two regional positions for the first time. It will also examine how the process of developing a position has evolved, with a wider range of national authorities now involved and additional areas of international law being increasingly explored.
Alongside research, the Institute develops and delivers tailored capacity building initiatives. At the request of Member States, it:
- Runs workshops on developing a national position and trainings on norms, international law and cyberspace;
- Facilitates substantive exchanges among States at different stages of the process;
- Connects officials with peers who have already navigated this process;
- Supports events where the States we assist launch their national positions.
To date, UNIDIR’s Security and Technology Programme has supported around 14 individual States in their processes, ranging from dedicated workshops to tailored assistance during the drafting of legal interpretations.
The breadth of participation in these discussions matters. Common understandings are more likely to reflect the realities and concerns of States when a wider range of national perspectives is brought into the conversation.
Why this is not just a legal exercise
It would be easy, but maybe misleading, to see national and regional positions as a niche concern for international lawyers. In practice, they serve wider purposes:
- They build transparency and predictability in international relations: Publishing a legal position communicates expectations to other States. It clarifies what a State considers acceptable under international law and what it does not. This predictability lowers the risk of misunderstanding and escalation in cyberspace.
- They enhance preparedness: Clarifying where a State draws its lines, a national position provides a framework for assessing and potentially responding to incidents. When a crisis hits, governments may not have the luxury of starting from basic principles. An agreed national legal position may enable faster, more coherent and more credible responses.
- They improve coordination at home: Developing a position encourages a State to bring its relevant national authorities (from the foreign ministry, to the defence unit, cybersecurity agency, law enforcement and other stakeholders) together around a shared understanding. The document that results becomes a common reference point, reducing the risk that different parts of government advance conflicting interpretations, and ensuring that the State’s position is consistent at home and abroad.
- They give States a voice: A national position is the clearest way for a State to contribute to the development of common understandings on how international law applies to cyberspace. For developing States in particular, a position is a practical instrument for ensuring their perspectives are part of the global conversation.
The moment to shape international law is now
Common understandings of how international law applies in cyberspace are being currently shaped. The Global Mechanism on ICT in the context of international security, which began its work in 2026, continues to examine how international law applies to State use of ICTs. Its focused discussions cover topics such as sovereignty, the prohibition of intervention, State responsibility and the peaceful settlement of disputes, among others. The positions States publish today will also shape these conversations and the common understandings of tomorrow.
Broad and geographically diverse participation will be important to develop common understandings that reflect the perspectives and experiences of States across regions.
That is why UNIDIR’s work matters. It does not just support States in producing documents with interesting legal interpretations, but helps ensure that the legal framework governing cyberspace is shaped by all of those who will live under it.
