INTERNATIONAL LAW AND CYBERSECURITY FOR ADDRESSING CHALLENGES IN THE DIGITAL AGE

INTERNATIONAL LAW AND CYBERSECURITY FOR ADDRESSING

CHALLENGES IN THE DIGITAL AGE

1. Legal Framework for Cyber-security

I. International conventions and treaties

The process of creating international norms in the field of cybersecurity, together with probable

subsequent treaties, has been multilateral and rather contentious, which is explainable by the

more and more fast-growing IT domain, constantly changing over time, and the different

interests of states in the sphere of cyberspace. Thus, there is no universal cybersecurity treaty at

the global level; however, certain specialized instruments regulating certain aspects of cyber

threats and digital security have appeared. Currently, there is no specific treaty exclusively

dedicated to cyberspace, although the Budapest Convention on Cybercrime, adopted in 2001, is

the most important and the most ratified convention in this realm and gives a framework for

international cooperation in the fight against cybercrime (Weber, 2020). Nevertheless, its

efficiency has been significantly hindered due to the fact that some of the most important world

actors such as Russia and China have refused to be engaged in the process pointing to the

violation of state sovereignty by the convention (Tikk & Kerttunen, 2020). This has left the

international legal system with numerous gaps covered by regional agreements for example, the

African Union Convention on Cyber Security and Protection of Personal Data, although they

address some of the gaps, they also pose a challenge in that they create different requirements for

the states (Orji, 2019). However, recent development like the UN Open-Ended Working Group

on developments in the field of information and telecommunications in the context of

international security shows that more effort is gradually being made in the search for a more

robust international legal instrument for regulating the process of cyber-security (Henriksen,

2019). The controversies around these instruments explain the difference between the growing

desire to promote harmonization of the cybersecurity legal framework on the international level

and states’ resistance to transfer sovereignty in this strategically sensitive area.

II. Customary international law

The interaction of customary international law with cybersecurity has thus its prospects and also

obstacles in terms of approaching the development of threats in the field of information security.

International customary law as a subsidiary source of cyber law is liberally developed by

customary practices accepted by states and national laws as if it were a rule governing their

external relations (Schmitt & Vihul, 2017). Tallinn Manual 2.0 on the ‘‘International Law

Applied on Cyber Operations’’ is the major exercise to explain how and which of the customary

international laws are applicable to the cyber operations and some of its topics include

sovereignty jurisdiction, state responsibility, and the use of force in the cyber domain (Jensen,

2017). However, the examples of interpretations illustrated in the manual are not binding, or

rather, there is no general consensus regarding them, which proves the ongoing discussions on

the content and the scope of CIL in the context of cyber (Watts & Richard, 2018). Legal

principles such as due diligence have gradually emerged to define the commitments included in

the states’ obligations to prevent the use of the territory to undertake cyber operations which

inflict considerable damage on other states despite the debates around the characteristic of this

duty (Buchan, 2020). Another factor that hampers the formation and also identification of

customary norms is hence the changing nature of threats in cyber domain as well as the

challenges linked to attribution of actions done in the cyberspace. At the same time, problems

arise in assigning responsibilities due to anonymity and the possibility of tracing cyber activities

to specific states as the main cyber attackers (Zedner & Roberts, 2019). Such uncertainty of

attribution not only hinders the countermeasures against the cyber incidents but also complicates

the formulation of the homogeneous state practice that is needed for the formation of the

normative rules of the customary international law (Broeders & Van Den Berg, 2020).

Nevertheless, given the slow progression of state practice to address cyber activities, one can

forecast that customary I in the coming years will become the primary determinant of the

existing legal norms in the sphere of cybersecurity. The targeted vulnerabilities include the

resilience of states as they relate to the state function, the state’s control over its territory and

people, state sovereignty and state legitimacy (Bailey & O’Connell, 2021). Such changing

practices also demonstrate the dynamism of CIL to meet the complexity of the cyber risks, thus

indicating that there is a reliable and yet flexible set of rules governing cyberspace (Taddeo &

Floridi, 2020).

III. Soft law instruments

It will be seen that soft law instruments have taken a central place amongst the legal tools that

form the international law of cyber security, based on their intrinsic advantages of flexibility and

of being capable of growth as the technologies underlying those systems continue to evolve.

These are voluntary benchmarks, rules, and ethics for the regulation of conduct in the virtual

environment as a way of standard setting in the international relations realm, where treaty

making entails protracted negotiations (Finnemore & Hollis, 2016). The UN Group of

Governmental Experts (GGE) reports on developments in the field of information and

telecommunications in the context of international security have been especially significant when

it comes to describing voluntary, nonbinding principles for states’ responsible behavior in

cyberspace (Henriksen, 2019). Likewise, the Paris Call for Trust and Security in Cyberspace

which is a multi-stakeholder initiative launched in 2018 seeks to come up with principles of

cyber security to govern this sphere (Hurel & Lobato, 2020). Informing of these, however, is the

fact that soft law instruments are not supported by the hard law enforcement mechanisms, but as

Kilovaty opines, these instruments are crucial in changing states practice and expectation and

hence may help in the formulation of the CIL over time. Their application is appealing since soft

laws can quickly address new technologies or the dynamic character of the threats elaborated in

this paper (Bailey & O’Connell, 2021). Nevertheless, soft law initiatives thus create problems of

legal complexity and also possible incoherence between the different fields of norms. Skeptics

have pointed out that this path might even weaken the process of establishing genuinely hard law

as a more satisfactory form of the new typical soft law instruments in the field of cybersecurity

(Mačák, 2021). Nevertheless, soft law instruments remain useful as a way for the building up of

the consensus and solicitation of the responsible behavior within the Internet that remains

uncharted by the states, in the areas where they still are rather shy of committing to the binding

law. For instance, the private sector and civil society mainly form and sometimes enforce such

norms, which contributes to making cybersecurity governance more inclusive (Taddeo & Floridi,

2020). In the realm of state and non-state actors’ interactions amidst the sophisticated

environment of cyber threats, soft law appears to be a realist and a process-oriented solution that

helps knit together cooperation, foster understanding about expectations, and create the

foundation for more conventionally legal developments in the future.

IV. National legislation and policies

Domestic laws and regulations are critical with regard to the protection of cyberspace since they

may be the main vehicle for translating intergovernmental standards and combatting particular

cyber threats in national contexts. Since the emergence of the cyber risks to national security,

economic welfare and individual freedoms of the population, the construction of the National

Information Security Strategies has become an important vector for many states. Such strategies

are normally a broad spectrum of themes which include but are not limited to critical

infrastructure protection, data protection, cybersecurity, among others. Still, the difference in the

scope of national cybersecurity initiatives often results in hindrances’ while trying to thus

synchronize different countries’ efforts. For instance, in the current world, differences in privacy

regimes, for example, the EU’s GDPR and the CCPA make the compliance a maze for the global

organizations functioning in different countries (Wolford, 2022). Also, some national

cybersecurity laws like the China’s Cybersecurity Law have attracted controversies on digital

protectionism and convergences with international human rights laws (Creemers, 2020). Several

national cybersecurity laws have extraterritorial effects, such as the U. S. CLOUD Act, which

may encroach on other states ‘sovereignty (Daskal, 2018). Since cyber threats are global, there

must be combined efforts; however, each country’s legislation differs, which complicates the

fight against threats (McKay, 2018). At the same time, national legislation and policies remain

significant in combating cybersecurity threats; they can act as reference points for creating

international norms and contribute to the formation of CIL with regard to this issue. For instance,

Israel and Estonia countries have advanced cybersecurity systems that defend their national

interest as well as dictate the international norms and trends of cyber-security (Tikk, Kaska, &

Vihul, 2010). National policies can facilitate the innovations in cybersecurity technologies and

control measures, and increase international circulation of the best practices without fail

(Westby, 2016). Additionally, national laws on cybersecurity can act as pilot projects for the

introduction of new practices and technological solutions that can be then applicable at the

international level with adjustments. National legislation can also be helpful for bilateral and

multilateral agreements, thus strengthening the protection of cyberspace on the international

level (Lewis, 2020).

2. State Responsibility in Cyber-space

I. Attribution of cyber-attacks

The attribution of cyber-attacks thereby proves to be one of the most difficult tasks related to

state responsibility in cyberspace, which increasingly thus undermines attempts at putting a halt

to malicious cyber actions. Because of their technical density as well as the ability to mask the

source of an attack, assigning exclusive responsibility in cyber operations is a herculean task,

(Rid & Buchanan, 2015). This difficulty is further amplified by the reality that cyber attackers

can stage numerous relations to shift the blame on prejudice subjects (Lindsay, 2015). This is

compounded by the fact the attribution processes which are occasionally executed by states are

generally non-transparent due to national security considerations thus making it difficult for the

international society to arrive at consensus regarding the standards to be followed in attribution

(Efrony & Shany, 2018). Nevertheless, in recent years, some progress is observed in the

improvement of attribution capacities, and certain states and private actors are more ready to

disclose the major cyber-attacks to certain state or non-state actors (Healey, 2019). Attributions

that received a lot of attention, performed by the United States and its partners, with references to

actors from North Korea, Russia, and China, have demonstrated the possibilities of the present

attribution techniques and their weaknesses (Department of Justice, 2020). However, the

principles on attribution in scenarios of international law have not yet been given definite

evidentiary standards some questions are raised like the extent of reasonable doubt required to

raise state responsibility or vindication of countermeasures (Tsagourias, 2012). The extension of

the international cooperation for care of the attribution related information and the establishment

of the impartial third entities for the attribution has been raised as the possible solution for the

reinforcement of the credibility and the acceptance in the international society. For example, the

European Union’s Cyber Diplomacy Toolbox contains actions in the field of collective

attribution, thus improving the EU’s capability to address cyber threats collectively (EU

Commission 2020). However, attribution decisions are still a matter of politics at their core and

remain a problematic area – in this context, the primary challenges relate to defining a

polymorphic objective and determining who is to be held responsible for activities that led to

critical consequences, primarily in cases involving state actors. This is clearly seen especially

when geo-political issues affect the perception of cyber events, in the various ways that countries

of the world have responded to what they consider as acts of cyber-wars by other nations

(Brangetto & Veenendaal, 2018).

II. Due diligence obligations

The notion of due diligence responsibilities in cyberspace has become one of the main aspects of

states’ responsibility, according to which the latter are obliged to take the necessary measures to

prevent the use of their territory for cyber operations that will lead to the suffering of other states.

This principle is established under general international law and is especially pertinent in the

cyber domain because of the connectedness of systems and the domino effects from cyber

activities (Buchan, 2016). The due diligence applying to cyberspace was confirmed by the UN

Group of Governmental Experts in their agenda 2015 report that states should refrain from

knowingly allowing their territory to be used for performing an internationally wrongful act by

using information communication technologies (ICTs) (Schmitt, 2017). The statement under

consideration therefore reflects the approaches of the international community to the protection

of its interests from threats that originate in cyberspace and also the expectations related to the

actions of states in the framework of the identified goal. That said, the overall and specific details

of cyber due diligence stayed somewhat unclear including the amount of prior knowledge

sufficient to prompt these obligations, and the particular measures which states need to undertake

to meet said obligations (Couzigou, 2018). It is claimed, retaliated broad due diligence

obligations burdens may result in more significant weakness to hostile cyber actors than was

present before, and this may deepen global digital divides (Shackelford et al. , 2016). Incidents

may result from the overall compromises in cybersecurity because the smaller or less

technologically competent state can find it difficult to apply the requisite cybersecurity measures.

Moreover, strains between the due diligence requirements on one side and affairs of privacy and

Americans’ liberties on the other constitute concerns in establishing sound surveillance and

preemptive mechanisms. For example, measures that can mitigate cyber operations and their

effects may interfere with human rights and freedoms and, thus, cause ethical and legal issues. It

can be concluded thereby that the concept of due diligence may provide a promising approach

toward enhancing responsible state behavior in cyberspace and hence counteracting the problems

raised by non-state actors based in states’ territories. The result is that, by following the due

diligence obligations, the states achieve secure and stable development of cyberspace

cooperating and trusting each other.

III. State-sponsored cyber operations

Cyber warfare on the part of states is a somewhat new phenomenon that has appeared on the

modern international relations scene and has posed numerous tough legal challenges as far as the

definitions of state responsibility and the use of international law in the cyberspace is concerned.

These operations, which can include such activities as espionage, information operations, and

sabotage of critical infrastructures frequently are situated in the between space of peace and war

(Nye 2017: p. 27). The distribution difficulties in cyber operations mean that it is extremely

difficult to determine the state responsibility which enables states to claim a plausible victimless

act while achieving strategic aims (Lin, 2016). These challenges are further made worse by the

fact that attackers employ various techniques that make it difficult to Track them, the techniques

include masking technologies coupled with the multiple layers that are complete with

intermediaries. The involvement of proxies and non-state actors only adds to the problem

figuring out how to attribute legal liability (Maurer, 2018). Essentially there are varying levels of

state influence where proxies can range from being fully state controlled to loose affiliations with

the state but performing their activities in the state’s interests. This does therefore obfuscate the

organizational responsibilities and also slows efforts to achieve proper responses to the

cybersecurity threats that are present today. Some of the international law principles include the

principles of non-use of force and non-intervention, but their application in the cyber

environment is still rather questionable (Schmitt, 2017). The latter is described in great detail in

the Tallinn Manual 2. 0, which defines how these principles work in the context of cyber

operations. However, it has significant deficiencies in credibility – it is not a binding document

and not universally recognized (Tikk & Kerttunen, 2020). The manual must be identified as a

valuable attempt to enhance understanding of the conforming international law in the sphere of

cyberspace activities, but the distinguished advice is not legally obligatory and has not been

embraced by all the states, which can cause various interpretations and applications among them.

Secondly, the difference between permitted acts of espionage and prohibited cyber interventions

is often not very clear, which causes legal uncertainty in the evaluation of states computer

network operations (Buchan, 2018). Though spying is acceptable in general sense under the

International Law, it can turn into the unlawful encroachment if the interferences are

considerable. Thus, the further development and deployment of the so-called ‘offensive’

cyberspace capabilities by states, international community is faced with such a question as the

possible ways for evolution of norms and rules of international humanitarian law concerning

actions in the cyberspace and prevention of the escalation of ‘cyber war’.

IV. Countermeasures and self-defense

The concepts of countermeasures and also self-defense in relation to cyber operations thereby

represent two of the toughest hurdles related to the legal regulation of cyber space. Thus

countermeasures, which are otherwise wrong are lawful actions taken by a state against the

wrongful state provided they are taken in reaction to an internationally wrongful act, may

provide a legal tool for states to react to cyber-attacks below the level of armed attack (Roscini,

2014). Still, the use of countermeasures in the context of cyber security encounters three major

issues: attribution; threat of escalation; and probability of unwanted side-effects in the integrated

cyber space (Schmitt 2017). The principle that holds countermeasures to be proportionate to the

suffered injury, which is the principle of proportionality, is not easy to apply in cyberspace

considering that more often than not, harm in cyberspace is abstract in nature (Healey and

Jenkins, 2019). According to the Charter of the United Nations, Article 51, right to self-defense

could be used when the subject of cyber operations amounts to an armed attack. Nevertheless,

deciding whether a cyber-operation represents an armed attack remains one of the most debated

areas in the legal literature and policy planning (Tsagourias, 2012, p. 395). The ‘Tallinn Manual

2.0’ indicates that any computer operations likely to lead to major physical loss and loss of life

can be regarded as an armed attack, but the situation regarding the computer operations which

cause severe economic or societal disruption without physical effect is not very clear (Jensen,

2017). Moreover, problems and concerns are also posed by the doctrine of anticipatory self-

defense against imminent cyber threats and other related issues with regards to the definition of

imminence when it comes to cyber operations which can easily evolve rapidly in the complex

cyber space (Waxman, 2013). While the states strive to solve these legal and strategic issues, the

need for exact international standards governing the employment of countermeasures and self-

defense in cyberspace is becoming more and more urgent for non-escalation of cyber wars.

3. Protection of Critical Infrastructure

I. Identifying critical infrastructure

The analysis of assets to determine critical ones in regard to cybersecurity issues is challenging

but it is thereby one of the most important tasks for the protection of the state’s security,

economics and also population. Critical infrastructure is usually defined as industries that are

critical to a country’s operations such as power, communications, money, and health (Dunn

Cavelty & Suter, 2009). Nonetheless, due to digitalization of these sectors there are no clear

distinction between industries and value chains which in turn have resulted in novel risks or

dependencies that make identification process complex (Klimburg & Zylberberg, 2015). The

integration of infrastructures thus within the geographical environment, most of which extend

beyond borders of individual nations complicates identification and hence protection efforts. For

instance, global financial system or cross-border energy systems call for cooperation among the

states in order to protect against cyber threats (Choucri & Goldsmith, 2012). This means that the

object under consideration has evolved over the years which has added further layers to its

categorization; for example, the use of the Internet of Things (IoT) and 5G networks as critical

infrastructures complicates the identification criteria compared to the traditional main electricity

grid (Tanczer et al. , 2018). It also implies the need for a reconsideration of the frameworks and

definitions associated with it to include new digital paradigms. Furthermore, different

approaches of the participating countries to defining as well as classification of critical

infrastructure thereby create large gaps that expose these infrastructures. Due to the variation of

the economic or security situations in various countries, priorities on the different sectors may

differ and therefore it is normal to have a variation of the level of preparedness to the cyber

threats. This can complicate cooperation in the fight against threats to cybersecurity that are

global since the strategies may not match. The work on thus elaborating identical sets of

standards and also approaches for; identification of CIs at the domestic as well as global levels

has been hence a critical activity to increase the cybersecurity readiness of a country. This way,

as obstacles are aligned into a common structure, it will be easier to allocate resources and

supplications for threats and risks more efficiently. In this manner, the stakeholders will be able

to accentuate cooperation and increase comprehensive protection against the emerging threats in

the context of the digital environment, which is a prerequisite for safeguarding valuable systems

that are crucial for social activities.

II. International cooperation mechanisms

It is thus imperative to encourage and also develop the cooperative structures due to the

globalization of critical infrastructure and hence the actors in the modern world. Such efforts like

the Meridian Process provide the creation of forums where the governments can share

knowledge of the mode of implementation and development on policies for protection of Cyber

Expertise (Choucri et al. , 2014). Furthermore, the Global Forum on Cyber Expertise which is

very useful for the capacity-building and sharing of information among countries ranging from

the more established to those aspiring to be (Pawlak 2016). However, due to geopolitics, the

activities are countered by political and commercial rivalry which weakens the operations of

these mechanisms for instance in sharing of intelligence data of threats and the vulnerabilities

(Nye, 2014). This hesitance can thus slow the identification of new and also developing cyber

threats as well as cause complications in cooperation. Moreover, through development of

Computer Emergency Response Teams (CERTs) and their networks worldwide, actual time

information sharing and management of incidents have greatly improved. However, there is still

difficulty experienced in pushing for uniformity in laid-down procedures as well as the issue of

trust among nations (Matania et al. , 2016). Another level of concern arises from the fact that

many of the assets regarded as CI are owned and administered by private companies that are

active in the global market (Carr, 2016). Private organizations can primarily have commercial

objectives; this makes them reluctant to report cyber threats or incidents affecting them which

causes a challenge in cooperation. While the need to cooperate is understandable, and the

emphasis on the protection of national and commercial secrets is also quite reasonable, finding

the proper middle ground for both remains one of the primary issues in the creation of effective

international cooperation. In response to these challenges; there is therefore need to develop trust

between the stakeholders. This can be thereof done by; constantly communicating, training

entities and also having mutual understanding about information exchange. It thus becomes

apparent that the development of the mechanisms of international cooperation is crucial for the

growth of resistance to threats in the sphere of cyber security as well as the protection of critical

infrastructure on the global level.

III. Public-private partnerships

Private partnerships have become crucial in safeguarding infrastructure given the fact that private

players are parent to most of these systems. These partnerships are planned to develop

cooperation between the governmental and the non-governmental organizations in order to

improve the cyber security readiness (Dunn Cavelty & Suter, 2009). Other efforts such as the US

Department of Homeland Security’s Critical Infrastructure Partnership Advisory Council

(CIPAC) develops structure for working with government and industry to define threats,

information exchange, and recommended procedures (Hathaway, 2014). Nevertheless, potential

problems relate to the nature of the incentives driving public and also private actors thus

involved in delivering the PPPs. Entities involved in procurement and supply chain management

may have dissimilar goals: for instance, government organizations may have primary concerns of

national security and adherence to rules and legislations, while other entities’ primary objectives

could be business profits and organism efficiency. Fundamentally, this divergence introduces

conflict in cooperation and integration and convolutes processes of decision making (Carr,

2016). Moreover, issues of legal responsibility as well as the need to safeguard information as a

key organizational asset give rise to the reluctance to share key information which also affects

partnership relations. As mentioned earlier, there is often a voluntary basis of PPP arrangements,

which implies that the participation and the related implementation of effective cyber security

measures can be quite irregular and varied in terms of the PPP and the sectors and organizations

involved. But some companies may decide to participate more actively than others, and thus,

there is usually incomplete security and varying levels of resilience (Klimburg & Zylberberg,

2015). Furthermore, the critical infrastructure systems are globalized adding another layer of

complexity to PPP as it is always difficult to coordinate different PPP attempts across countries

and jurisdictions (Choucri et al. , 2014). These concerns aside, PPPs remains a useful strategy for

protecting the nation’s key infrastructures. Current activities involve establishing more trust

between partners in commissions, developing better ways of exchanging information and

encouraging more appropriate incentives of the public/private sectors. Effective cooperation

within PPPs can therefore contribute greatly to the increase of the general cyber security as well

as the further elaboration of effective defense measures against new types of threats.

IV. Resilience and recovery strategies

These strategies accept the fact that it is impossible to achieve enclave like security where an

organization can be impenetrable and ready to resume and continue its and other important

services which were impacted as soon as the attack is over (Linkov et al. , 2013). Cyber

resilience deals with the enhancement of organizational, technical and people aspects of business

continuity to develop an overall protective system against cyber threats (Björck et al. , 2015).

Components of resiliency strategies are the architectural redundancy of the firm’s critical

systems, active testing, exercising and the creation of response plans taking into consideration

different types of attacks (Matania et al. , 2016). This means that even when one component of

the network is conquered, others are still active, so that system reliability is maintained at an

optimal level. The constant testing thereby allows for weaknesses to be found and also for an

organization to get better prepared for actual incidents. Recovery tactics focus on reduced time

without availability and data loss; generally, it includes backup structures and data duplication,

as well as previously planned actions to recover systems (Tanczer et al. , 2018). Organizations

have to design backup regimes that can provide for the fast restoration of services and, at the

same time, protect data. A major challenge associated with the application of effective resilience

and recovery strategies is that the implementation may require redundancy and backup systems

which can prove very expensive. Another component making resilience planning challenging is

emerging forms of attacks due to the constant evolution of the cyber threats (Dunn Cavelty &

Suter, 2009). Furthermore, the complex dependencies that exist between various sectors that are

considered critical have been known to require integrated preparedness that cuts across

organizations and sectors (Klimburg & Zylberberg, 2015). Stakeholders’ cooperation is

important especially when identifying and addressing the weaknesses which are inherent in the

related systems. With the prevalence of cyber threats constantly expanding the complexity of

attacks and compromising a consistently greater number of targets, the questions related to the

adequate resilience and recovery approaches remain among the most imperative to address in

order to protect infrastructures and offer the uninterrupted delivery of essential services in the

cyber incidents’ wake.

4. Data Protection and Privacy

I. Cross-border data flows

Data cross-border is a component part of the digital global economy and is; an important issue in

the international legal system of data protection and privacy. As a result of a rapidly growing

volume and complexity of transnational data transfers connected with such trends as the

development of cloud computing, e-commerce, and global business activity in general, the

establishment of coherent international rules and regulations has not followed the same pace

(Kuner, 2013). The General Data Protection Regulation (GDPR) of the European Union has

become one of the most recognized models for the protection of the data which set strict

conditions for the transfer of the personal data outside the EU and brought into operation the

notion of ‘adequacy’ in the frameworks of the data protection in third countries (Bygrave, 2014).

Nonetheless the implementation of such regulations beyond the country’s borders has thus

caused precautionary relationship issues with other nations, most notably America. This tension

was especially brought out by the axing of the EU-US Privacy Shield deal by the Court of Justice

of the European Union in the Schrems II case and the realization that transatlantic data transfer is

not a walk in the park (Hoofnagle et al. , 2019). Also, because of the recent enactment of data

localization laws in the Russia and China due to the threat to national security and protection of

citizens’ data, the issue of cross-border data transfer has become largely challenging (Chander &

Lê, 2015). These two ways of managing data are not unrelated to these global shifts of power

and the clashing visions in perspective to personal data protection and a state’s sovereignty in the

digital world. There are attempts to set up international standards for Cross Border Data transfer

like the APEC CBPR system but there is a problem as to how the differences in these legally

binding approaches would be harmonized and how the concerns of both the developed and

developing countries would be met (Greenleaf, 2017). In light of the increasing volume and also

importance of international data flows, the enforcement of this principle in global law as well as

policy continues to pose a significant challenge in responding to the balance between the

freedom of data transfers across borders and hence the protection of persons’ fundamental rights

to privacy. This is one of the most crucial factors to enable people to have confidence in the

digital economy while at the same time maintaining compliance with different country laws and

regulations.

II. Surveillance and intelligence gathering

Till present, the functions of surveillance and intelligence in cyberspace have raised significant

controversies regarding privacy and freedom of people along with the more significant terror or

security threats around the world. A major leak by Edward Snowden in 2013 exposed the global

surveillance systems operated by the US National Security Agency and other allies alarming the

world (Greenwald, 2014). Analyzing the criticism of the dealt bulk data, analysts have noted that

the mass data collection, the analysis of metadata and the targeted surveillance activities

disclosed violates some of the most basic human rights as provided under the Article 17 of the

International Covenant on Civil and Political Rights (ICCPR) (Milanvic, 2015). Recently, the

UN Human Rights Council stressed the understanding provided by the so called ‘right to privacy

online’ meaning that all offline rights should be enforced online, citing the growing need for

‘privacy protection in the digital era’ (UN Human Rights Council, 2016, p 9). However applying

these principles when; amassing intelligence thus relating to cyberspace poses great difficulties.

Governments across the world use terrorism and organized crime as a reason for the increased

scope of surveillance saying this is necessary for national security purposes (Lubin, 2018). Other

future technologies like artificial intelligence and big data analytics have also added to the

problem since they improve surveillance but at the same time violate people’s rights and can be

abused (Richards, 2013). Global attempts have been made in order to introduce standards and

rules regulating utilization of surveillance together with recognition of security imperatives and

privacy protection. Some measures still in operation include the International Principles on the

Application of Human Rights to Communications Surveillance, which is aimed at giving a legal

framework by which lawful and ethical spying was to be maintained (Electronic Frontier

Foundation, 2014). Nevertheless, managing the conflicts and riding the wave between state

security concerns and individual privacy protection is one of the major challenges of the

contemporary global governance that can be traced in the discussion of the given topic. With

new surveillance technologies emerging and continuous cyber security threats, the international

community has questions such as what kind of surveillance is permissible, what extent the

current laws protect individuals’ rights, and are there any mechanisms in place where people can

get adequate information about the surveillance. Thus, it is important to continue the discussion,

cooperation of states as well as the compliance with the standards of international human rights

in an attempt to thereby protect privacy while achieving enhanced and also efficient national

security measures in the context of cyberspace.

III. Right to be forgotten

The right to be forgotten also called the right to erasure has actually become central in data

protection and privacy law especially on the issue of eternal nature of information in digital age.

This right allows people propitious to demand that his or her personal data are removed from an

online search or listing; it entered into force after the European Court of Justice rulings on 2014

on the Google Spain case (Ausloos, 2012). After this, the GDPR enshrined this right which

obliged the data controllers to erase the personal data and cease further communication with the

data subject where the request meets certain criteria (Article 17 GDPR). However, this right

brings certain problems for practice when it is being implemented in the present globalized

world. The geographic scope of this right especially where it is exercised outside the home State

has been particularly problematic as evidenced by the current Google and CNIL spat (Kuner,

2015). Slaves call this right may undermine the primary rights freedom of speech and access to

information leaving the public with a distorted historical narrative (Rosen, 2012). Moreover, the

realization of this right is not fully possible where data replication and caching are common

features in the modern world (Bode & Jones, 2017). The enforcement is also an issue because the

internet transcends national borders and each country has its ways of handling the matters of

privacy and data protection (Bennett, 2012). This way, as long as the digital technologies

develop further, the lawmakers and courts of different countries will still face the challenge of

the conflict of rights – on the one hand, the right for privacy protection of the individual, and on

the other – the right for information freedom for the public. This constant conflict thus requires

balancing by different parties to protect privacy while at the same time preserving principles

such as the right to information and hence freedom of speech in the modern world.

IV. Encryption and anonymity