The overall international legal framework has not changed in the last few decades. What has changed is the maturity of the discussion and understanding on how the existing rules apply to the use of information and communication technologies. The year 2024 marked a turning point, and now the majority of NATO Member States either have an individual national position or joined a common understanding on the application of international law in ‘cyberspace’. Since cyber operations are often covert, classified, deniable, or technically ambiguous, and most applicable international rules are technology neutral, verbal and written practice, particularly these elaborate national and common positions, carry exceptional importance.
This article by Dr Agnes Kasper and Karine Veersalu focuses primarily on areas where Allies agree, areas of convergence among NATO Member States, leaving the discussion of divergences for another occasion. Analysing the published national positions of Member States and the EU’s common understanding, this article maps out the convergence areas or a ‘common baseline’ within NATO, which can be of immense value for furthering legal interoperability and doctrinal development in the field of cyber operations (particularly in the light of the ongoing review of the Allied Joint Doctrine for Cyber Operations, AJP 3.20), and can potentially serve as a foundation for a formally agreed NATO common position in the future. It is timely for NATO to take onboard the collective understanding of Allies about how international law applies to cyber activities.