International human rights law

== Definition ==
International human rights law
International human rights law applies in cyberspace; individuals enjoy the same human rights online as they enjoy offline.See, for example, United Nations Human Rights Council, The promotion, protection and enjoyment of human rights on the Internet, Resolution A/HRC/RES/32/13 (1 July 2016), para 1; NATO, Warsaw Summit Communiqué (9 July 2016), para 70; G8 Summit of Deauville, Declaration: Renewed Commitment for Freedom and Democracy (27 May 2011), para II/11; UNGA ‘Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security’ (22 July 2015) A/70/174, paras 13(e) and 28(b); UNGA, ‘Report of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security’ (14 July 2021) A/76/135, paras 36 and ff. This has been reaffirmed by most States in their national positions, such as Australia, Canada, Czech Republic, Estonia, Finland, Italy, Japan, the Netherlands, New Zealand, Norway, Romania, Sweden, Switzerland, the United Kingdom and the United States. States are therefore bound by their human rights obligations to respect, protect and fulfil human rights in cyberspace. States also bear international responsibility for the violation of human rights obligations that are attributable to them.See, Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro) (Judgment) [2007 ICJ Rep 43] [170].
The source of these obligations is primarily treaty law. The two key global treaties are the International Covenant on Civil and Political Rights (ICCPR) and the International Covenant on Economic, Social and Cultural Rights (ICESCR);International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March 1976) 999 UNTS 171 (ICCPR); International Covenant on Economic, Social and Cultural Rights (adopted 16 December 1966, entered into force 3 January 1976) 993 UNTS 3 (ICESCR). many of these treaties’ provisions, along with the provisions of the Universal Declaration of Human Rights, are regarded as reflective of customary international human rights law, even though there is no universally accepted codification. Apart from the ICCPR and ICESCR, there are important regional human rights treaty systems, especially for Europe (based on the European Convention on Human Rights – ECHR),Formal title: Convention for the Protection of Human Rights and Fundamental Freedoms (opened to the signature in Rome on 4 November 1950, entered into force 3 September 1953), ETS 5 (ECHR); there are several protocols which significantly expand and amend the obligations of the original Convention. the European Union (Charter of Fundamental Rights of the European Union – EUCFR),Charter of Fundamental Rights of the European Union, proclaimed on 7 December 2000 (EUCFR). America (American Convention on Human Rights – ACHR),American Convention on Human Rights (open for signature from 22 November 1969, entered into force 18 July 1978), 1144 UNTS 123 (ACHR). and Africa (African Charter on Human and Peoples’ Rights – ACHPR),African Charter on Human and Peoples’ Rights (‘Banjul Charter’) (adopted 27 June 1981, entered into force 21 October 1986), CAB/LEG/67/3 rev. 5, 21 I.L.M. 58 (1982) (ACHPR). which provide for adjudicatory mechanisms by which individuals can assert their human rights against States and which have generated a considerable amount of case-law as a result.
In order to determine whether a State has breached its human rights obligations, the following steps of analysis should be conducted:
Since cyber operations often take place in the cyber infrastructure of multiple States, the issue of jurisdiction must be addressed. Each human rights treaty has its own bespoke jurisdictional requirements and scope. In this regard, every State party to the ICCPR has undertaken “to respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights recognized in the [ICCPR]”.Article 2(1) ICCPR.
The UN Human Rights Committee (UN HRC) has understood this provision to mean that the human rights obligations recognized within the ICCPR apply not only to persons physically located within a State’s territory, but also to situations where the State exercises “power or effective control” either over the territory on which an individual is located (the spatial model of jurisdiction) or over the individual (the personal model of jurisdiction).UN HRC, ‘General Comment No. 31 (80): The Nature of the General Legal Obligation Imposed on States Parties to the Covenant’ (adopted on 29 March 2004, 2187th meeting), para 10. Likewise, the International Court of Justice (ICJ) has stated that the ICCPR “is applicable in respect of acts done by a State in the exercise of its jurisdiction outside its own territory”.Cf, Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territories (Advisory Opinion) [2004] ICJ Rep 136 [111]. See further, UN HRC, General comment No. 36, Article 6, Right to life (3 September 2019) CCPR/C/GC/36, para 63. See also the approach adopted by the European Court of Human Rights in Al-Skeini and others v. the United Kingdom, App no 55721/07 (ECtHR, 7 July 2011) [131] and ff; Loizidou v. Turkey, App no 15318/89 (ECtHR, 23 March 1995) [62], and recently in Carter v. Russia, App no. 20914/07 (ECtHR, 21 September 2021) [161]. For the position within the Inter-American System see Saldano v. Argentina, Report No 38/99 (Inter-American Commission of Human Rights, 11 March 1999) [17] and in particular the wide interpretation adopted by the Inter-Amercian Court of Human Rights in its Advisory Opinion 23/17 on the Environment and Human Rights, Series a 23 (IACtHR, 15 November 2017) para 104(h).
A few States (such as the US and Israel) have adopted the contrary view and maintain that human rights obligations do not apply extraterritorially. To date, however, these States remain in the minority.See, Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territories (Advisory Opinion) [2004] ICJ 136, para 110; UN HRC, Summary Record of the 1405th Meeting, CCPR/C/SR.1405 (31 March 1995) 6 [20]. As such, although the exact criteria for the applicability of human rights obligations to extraterritorial activities of States are not settled and are subject to ongoing academic and political debate,See, for example, Marko Milanovic, ‘Human Rights Treaties and Foreign Surveillance: Privacy in the Digital Age’ (2015) 56 Harvard International Law Journal 81. the prevailing opinion at present is that human rights obligations do apply to some acts of a State outside its territory.Switzerland has expressly stated in its national position that ‘Human rights obligations are equally binding upon states operating in cyberspace as in physical space. This also applies when the cyber operation in question is being carried out extraterritorially, to the extent that the States exercise their sovereign authority in doing so’. See Federal Department of Foreign Affairs, ‘Switzerland's position paper on the application of international law in cyberspace’ (May 2021) 8.
If an international human rights regime is applicable, the second question is whether a cyber operation attributable to a State constitutes an interference with a particular human right. The human rights that are often implicated by cyber operations include the right to privacyArticle 17 ICCPR; Article 8 ECHR; Article 7 EUCFR; Article 11 ACHR. The exact titles and scopes of the provisions vary. For example, this can be triggered be the practice of surveillance. See Helen McDermott, ‘Application of the International Human Rights Law Framework in Cyber Space’ in Dapo Akande and others (eds), Human Rights and 21st Century Challenges. Poverty, Conflict, and the Environment (Oxford University Press 2020) 194. See also Szabo and Vissy v Hungary, App no 37138/ 14 (ECtHR, 12 January 2016); Liberty and Others v United Kingdom, App No 58243/00 (ECtHR, 2008). and the right to freedom of opinion and expression.Article 19 ICCPR; Article 10 ECHR; Article 11 EUCFR; Article 13 ACHR. The exact titles and scopes of the provisions vary, and include its counterpart, the right to access to information, as highlighted in the national positions of Estonia, Finland, Italy, Sweden, Switzerland and the United States. A violation of this right may be, for example by ‘a DDoS attack that inhibits access to the Internet or the voicing of views, and is attributable to a state’. See Helen McDermott, ‘Application of the International Human Rights Law Framework in Cyber Space’ in Dapo Akande and others (eds), Human Rights and 21st Century Challenges. Poverty, Conflict, and the Environment (Oxford University Press 2020) 194. Other rights such as the freedom of association,As highlighted by many States in their national positions, including Australia, Canada, the Czech Republic, Estonia, the Netherlands and Sweden. the prohibition of discrimination, the right to life, to health or other social and economic rights may be also affected by cyber operations or cyber-related measures.See Helen McDermott, ‘Application of the International Human Rights Law Framework in Cyber Space’ in Dapo Akande and others (eds), Human Rights and 21st Century Challenges. Poverty, Conflict, and the Environment (Oxford University Press 2020) 195–197. If the right in question is absolute – such as the right to be free from torture or slavery – then no interference with it is allowed.See Soering v. the United Kingdom, App no 14038/88 (ECtHR, 07 July 1989) [88]; Ireland v. the United Kingdom, App no 5310/71 (ECtHR, 18 January 1978) [163]; Hurri Laws v. Nigeria, Communication No 225/98 (AComHPR, 6 November 2000) [41]; UN HRC, General Comment 20, Article 7 (Prohibition of Torture, or Other Cruel, Inhuman or Degrading Treatment or Punishment) (10 March 1992) para 3; CAT, General Comment 2 on the implementation of article 2 by States parties (24 January 2008) CAT/C/GC/2, paras 1 and 5.
For an interference with a qualified right – such as the right to privacy or to freedom of expression – to be legal under human rights law, it must fulfil certain conditions, namely:
be in accordance with an accessible and foreseeable domestic law (“legality”),
pursue a legitimate aim of public interest (such as national security, public order, public health, or morals) or for the protection of rights of others,
be necessary to achieve that aim, and
be proportionate in balancing the means and the end.UN Human Rights Committee, ICCPR General Comment No. 34 (12 September 2011), paras 21-36; See also ICCPR General Comment No. 27 (1 November 1999), paras 14-16; UN HRC, General Comment No. 31 [80 The Nature of the General Legal Obligation Imposed on States Parties to the Covenant] (26 May 2004) CCPR/C/21/Rev.1/Add. 13, para 6.
Apart from the responsibility for human rights violations attributed to it, a State can also be held responsible for its failure to take all reasonable measures to protect the human rights of individuals in its territory and subject to its jurisdiction (for instance, if it unlawfully allows non-State actors to violate human rights).See, Velásquez Rodríguez v. Honduras, (Merits) IACrtHR (Ser. C) No. 4 (29 July 1988) [177]. See also UN HRC, General Comment No. 31 [80 The Nature of the General Legal Obligation Imposed on States Parties to the Covenant] (26 May 2004) CCPR/C/21/Rev.1/Add. 13, para 8; UN HRC, General comment No. 36, Article 6, Right to life (3 September 2019) CCPR/C/GC/36, para 7. See also the national positions of Finland and Switzerland.
Publicly available common and national positions that address this issue include:
 (2024),
 (2024),
 (2020),
 (2024),
 (2022), 
 (2023),
 (2020),
 (2024), 
 (2021), 
 (2020), 
 (2023),
 (2021),
 (2021), 
 (2021), 
 (2021), 
 (2019), 
 (2020), 
 (2021),
 (2022),
 (2021),
 (2022), 
 (2021), 
 (2021), 
 (2012), 
 (2016),
 (2021).
==Common positions==
===African Union (2024)===
===European Union (2024)===
==National positions==
===Australia (2020)===
===Austria (2024)===
===Canada (2022)===
===Costa Rica (2023)===
===Czech Republic (2020)===
===Czech Republic (2024)===
===Estonia (2021)===
===Finland (2020)===
===Ireland (2023)===
===Italy (2021)===
===Japan (2021)===
===Kazakhstan (2021)===
===Kenya (2021)===
===Netherlands (2019)===
===New Zealand (2020)===
===Norway (2021)===
===Poland (2022)===
===Romania (2021)===
===Sweden (2022)===
===Switzerland (2021)===
===United Kingdom (2021)===
===United States (2016)===
===United States (2021)===
== Appendixes ==
=== See also ===
* Scenario 08: Certificate authority hack
* Scenario 11: Sale of surveillance tools in defiance of international sanctions
* Scenario 19: Hate speech
* Scenario 20: Cyber operations against medical facilities
* Scenario 23: Vaccine research and testing
* Scenario 24: Internet blockage
=== Notes and references ===
=== Bibliography and further reading ===
Category:International human rights law
Category:Legal concepts