12 - Regulating Economic Cyber-Espionage among States under International Law

Summary

INTRODUCTION

A growing dependence on information and communication technologies as well as on Internet-based resources has made state actions and everyday activities of corporations unimaginable without the use of cyberspace Cyberspace can be defined as ‘the environment formed by physical and non-physical components, characterised by the use of computers and the electro-magnetic spectrum, to store, modify and exchange data using computer networks’ Computer technology, cloud services and other cyberspace data storage options have enabled these actors to store mass data about their activities and access them through technological infrastructures Additionally, the expansion in technology has changed the way companies develop their products and services, increasingly relying on information about customers ‘preferences, routines, likes and wishes, and thus gathering large collections of such data While global interconnectivity and storage of information on computer networks has its benefits, it also makes it easier for unauthorised persons to manipulate such data With the creation of proper algorithms they may deduce and access confidential information, such as corporations’ trade secrets and patents, or customers ‘personal data and other sensitive information Following the 2008 global economic crisis, governments have taken a more proactive role in ensuring their businesses strive in a global market Thus, in the last decade, news stories keep surfacing of peacetime economic cyber-espionage between certain states, mostly between China and the United States This commonly occurs when one state hacks into the databases of corporations located in another state to use that data for the advantage of its own corporations and aid them in the competitive international markets.

The aim of this chapter is to crystalise the current understanding of peacetime economic cyber-espionage among states under international law, with a special reference to theft of personal and otherwise privileged data Commencing in section 2, the chapter initially addresses the issues of legality or illegality of economic cyber-espionage under international law and analyses whether states could lawfully react to malicious economic cyber-espionage by relying on different existing international law principles and norms Section 3 addresses the differences between traditional espionage and cyber-exploitation, which suggest a need for a separate regulation of economic cyber-exploitation at the international level Privacy considerations related to the data stolen in economic cyber-espionage activities are presented in section 4.