Hostname: page-component-586b7cd67f-r5fsc Total loading time: 0 Render date: 2024-11-20T17:35:22.611Z Has data issue: false hasContentIssue false
  • English
  • Français

THE DATA EMBASSY UNDER PUBLIC INTERNATIONAL LAW

Published online by Cambridge University Press:  28 January 2019

Bartłomiej Sierzputowski
Bartłomiej Sierzputowski*
Affiliation:
PhD student, Faculty of Law and Administration, [email protected].
Get access Rights & Permissions [Opens in a new window]

Abstract

This article discusses the data embassy, a new international legal concept created in response to a pressing problem. In 2007, Estonia fell victim to ‘distributed denial-of-service attacks’ and consequently, made Estonia's entire public sector data communications network inoperable. Their response was to strengthen their protection against and penalization for cybercrime, and to develop the concept of a ‘data embassy’. On 20 June 2017 the Republic of Estonia and the Grand Duchy of Luxembourg signed an ‘Agreement on the hosting of data and information systems’, to host Estonian data in Luxembourg. Such data embassies perform a unique function and benefit from many privileges and immunities, but their legal status has been unclear. This article addresses the question concerning the legal status of the premises of the data embassy.

Keywords

consular premisescyber attackData EmbassyEstoniaGrand Duchy of Luxembourgpremisespremises of the missionpublic international law
Type
Shorter Articles
Information
International & Comparative Law Quarterly , Volume 68 , Issue 1 , January 2019 , pp. 225 - 242
Copyright
Copyright © British Institute of International and Comparative Law 2019 

Access options

Get access to the full version of this content by using one of the access options below. (Log in options will check for institutional or personal access. Content may require purchase if you do not have access.)

References

1 See Moslemzadeh, TP, Cyberterrorism: The Legal and Enforcement Issues (World Scientific Publishing Europe Ltd 2017) xvGoogle Scholar.

2 Alenius, K, ‘An Exceptional War That Ended in Victory for Estonia, or an Ordinary e-Disturbance? Estonian Narratives of the Cyber Attacks in 2007’ in Warren, M (ed), Case Studies in Information Warfare and Security: For Researchers, Teachers and Students (Academic Conferences and Publishing International Limited 2013) 55Google Scholar; See Eggers, WD, Delivering on Digital: The Innovators and Technologies That Are Transforming Government (RosettaBooks 2016) 182Google Scholar; See also Kulesza, J, ‘State Responsibility for Cyberattacks on International Peace and Security’ (2009) XXIX PolishYBIntlL 139Google Scholar.

3 Stiennon, R, Surviving Cyberwar (Government Institutes 2010) 88Google Scholar.

4 Nazario, J, ‘Politically Motivated Denial of Service Attacks’ in Czosseck, Ch and Geers, K (eds.) The Virtual Battlefield: Perspectives on Cyber Warfare (IOS Press, 2009) 166Google Scholar.

5 Denial-of-service attacks (DoS attacks) were also present. See Tikk, E and Oorn, R, ‘Legal and Policy Evaluation: International Coordination of Prosecution and Prevention of Cyber Terrorism’ in Centre of Excellence Defence Against Terrorism, Ankara, Turkey (ed), Responses to Cyber Terrorism, NATO Science for Peace and Security Series. E: Human and Societal Dynamics (vol 34, IOS Press 2008) 90Google Scholar; see also Russell, AL, Cyber Blockades (Georgetown University Press 2014) 69Google Scholar.

6 Tikk, E, Kaska, K and Vihul, L, International Cyber Incidents: Legal Considerations (Cooperative Cyber Defence Centre of Excellence 2010) 19Google Scholar; see also Stiennon (n 3) 88.

7 Tikk, Kaska and Vihul (n 6) 107.

8 ‘Declaration of the Minister of Foreign Affairs of the Republic of Estonia, 1 May 2007’ at <https://www.valitsus.ee/en/news/declaration-minister-foreign-affairs-republic-estonia>.

9 ‘Dni które wstrząsnęły Estonią’ (Days Which Shook Estonia) at <https://www.eesti.pl/dni-ktore-wstrzasnely-estonia-11963.html>.

10 Carr, J, Inside Cyber Warfare: Mapping the Cyber Underworld (2nd edn, O'Reilly 2012) 161Google Scholar.

11 See also Stiennon, R, ‘A Short History of Cyber Crime’ in Green, JA (ed), Cyber Warfare: A Multidisciplinary Analysis (Routledge 2015) 9Google Scholar and 18.

12 Held in New York on 25 September 2007.

13 ‘Address by H.E. Mr. Toomas Hendrik Ilves President of the Republic of Estonia to the 62nd session of the United Nations General Assembly’ available at <http://www.un.org/webcast/ga/62/2007/pdfs/estonia-eng.pdf>.

14 ibid.

15 Andorra, Austria, Azerbaijan, Czech Republic, Finland, Georgia, Germany, Italy, Liechtenstein, Luxembourg, Malta, Monaco, Montenegro, Poland, Portugal, Moldova, Serbia, Slovakia, Spain, Switzerland, Turkey, Great Britain, Australia, Canada, Chile, Costa Rica, Dominican Republic, Israel, Japan, Mauritius, Panama, Senegal, Sri Lanka, Tonga.

16 2001 Convention on Cybercrime of the Council of Europe, ETS No 185.

17 In 2008 the Government of Estonia amended the provisions of the Penal Code. For example, ‘the punishment prescribed by law for computer crimes (…) was pecuniary punishment or a maximum one year of imprisonment’. See sections 206–208 of the Estonian Penal Code (Passed 06.06.2001, RT I 2001, 61, 364); ‘Implementation of the Virtual Data Embassy Solution. Summary Report of the Research Project on Public Cloud Usage for Government, Conducted by Estonian Ministry of Economic Affairs and Communications and Microsoft Corporation’ at at <https://www.mkm.ee/sites/default/files/implementation_of_the_virtual_data_embassy_solution_summary_report.pdf>.

18 Tikk, Kaska and Vihul (n 6) 18. See also Stiennon (n 3) 29.

19 Tikk, Kaska and Vihul (n 6) 5.

20 ibid 30.

21 Loi du 1er décembre 2017 portant approbation du « Agreement between the Grand Duchy of Luxembourg and the Republic of Estonia on the hosting of data and information systems », signé à Luxembourg, le 20 juin 2017, Doc. parl. 7185; sess. ord. 2016–2017 et 2017–2018 at <http://legilux.public.lu/eli/etat/leg/loi/2017/12/01/a1029/jo>.

22 Art 1(a) of the Agreement states that ‘the data centre’ shall mean a facility used to host the data and information systems, the equipment and licences and associated components, such as telecommunications and storage systems.

23 For example Estonia was the first country to allow online voting in the general election in 2007. Seven years later Estonia offered an ‘e-residency’ to any person in the world. See Ross, A, The Industries of the Future (Simon & Schuster 2016) 210Google Scholar.

24 ‘Implementation of the Virtual Data Embassy Solution’ (n 17).

25 Accord complémentaire entre l’État du Grand-Duché de Luxembourg et l'Organisation européenne des brevets concernant l'inviolabilité des archives de l'Organisation européenne des brevets, fait à Luxembourg, le 5 mars 2018 (Journal Officiel du Grand-Duché de Luxembourg, Mémorial A n° 640 de 2018); see at <http://legilux.public.lu/eli/etat/leg/div/2018/07/20/a640/jo> and <https://gouvernement.lu/fr/gouvernement/francois-bausch/actualites.gouvernement%2Bfr%2Bactualites%2Btoutes_actualites%2Bcommuniques%2B2018%2B03-mars%2B30-conseil-gouvernement.html>.

26 Pursuant to Art 3 of the Complementary Agreement.

27 See at <https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche/RoleDesAffaires?action=doDocpaDetails&id=7294>.

28 J Nazario (n 4) 165; see also Singer, PW and Friedman, A, Cybersecurity and Cyberwar: What Everyone Needs to Know® (Oxford University Press 2014) 111CrossRefGoogle Scholar.

29 Alenius (n 2) 58.

30 ‘Declaration of the Minister of Foreign Affairs’ (n 8).

31 Immediately after the riots in Tallinn the normal functioning of the Estonian embassy in Moscow was blocked for seven days by hostile demonstrators from the Russian pro-government youth organization ‘Nashi’, which resulted in physical attacks on the Estonian and Swedish Ambassadors, threats to demolish the embassy building, the tearing down of the Estonian flag situated on embassy territory, and the labelling of Estonia as a ‘fascist’ country. European Parliament resolution of 24 May 2007 on Estonia, P6_TA(2007)0215, available at <http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//TEXT+TA+P6-TA-2007-0215+0+DOC+XML+V0//EN>.

32 European Parliament resolution of 10 May 2007 on the EU–Russia Summit to be held in Samara on 18 May 2007, Official Journal of the European Union from 27.3.2008, C 76 E/97, P6_TA(2007)0178.

33 See also Gardner, H, ‘War and the Media Paradox’ in Karatzogianni, A (ed), Cyber-Conflict and Global Politics (Routledge 2009) 29Google Scholar.

34 ‘Declaration of the Minister of Foreign Affairs’ (n 8).

35 Tikk, Kaska and Vihul (n 6) 18; see also Stiennon (n 3) 23; and Alenius (n 2) 59.

36 Tikk, Kaska and Vihul (n 6) 107.

37 ibid 20.

38 ‘Dni które wstrząsnęły Estonią’ (n 9).

39 Tikk, Kaska and Vihul (n 6) 107.

40 ibid 107.

41 ‘Hardening’ infrastructure is the adding of additional security. See also R Stiennon, above n 3, at 88.

42 See Tikk and Oorn, above n 3, at 98.

43 Tikk, Kaska and Vihul (n 6) 20.

44 European Parliament resolution of 10 May 2007 (n 32).

45 European Parliament resolution of 24 May 2007 (n 31). It is noteworthy that in March 2009 (after a series of Russian denials), Sergei Markov (a State Duma Deputy from the pro-Kremlin Unified Russia Party) stated that it was with his [financial] assistance that all of the cyber attacks had been conducted in April and May 2007 in Estonia. However this claim has not been corroborated. See also: Tikk and Oorn (n 5) 98.

46 European Parliament resolution of 24 May 2007 (n 31).

47 Tikk, Kaska and Vihul (n 6) 18. See also Stiennon (n 3) 24.

48 Tikk and Oorn (n 5) 98.

49 The Complementary Agreement of 5 March 2018 entered into force on 25 July 2018, by notification, pursuant to Article 3 of the mentioned arrangement.

50 It should be pointed out that the first Data Embassy will be based in a high-security data centre in Betzdorf, a commune in eastern Luxembourg. ‘Estonia to Open the World's First Data Embassy in Luxembourg’ at <https://e-estonia.com/estonia-to-open-the-worlds-first-data-embassy-in-luxembourg/>.

51 1961 Vienna Convention on Diplomatic Relations, United Nations, Treaty Series, vol 500, at 95.

52 Aust, A, Handbook of International Law (Cambridge University Press 2010) 113CrossRefGoogle Scholar; See also Dembinski, L, The Modern Law of Diplomacy: External Missions of States and International Organizations (Martinus Nijhoff 1988) 85Google Scholar; see also Denza, E, Diplomatic Law: Commentary on the Vienna Convention on Diplomatic Relations (3rd edn, Oxford University Press 2008) 21CrossRefGoogle Scholar.

53 Muszyński, M, Konwencja wiedeńska o stosunkach dyplomatycznych. Komentarz (Vienna Convention on Diplomatic Relations: Commentary) (STO 2004) 32Google Scholar.

54 Art 1(i) in fine of the VCDR.

55 Muszyński (n 53) 33.

56 The Diplomatic and Consular Premises Act 1987 (from 15th May 1987, Ch 46) at <https://www.legislation.gov.uk/ukpga/1987/46>.

57 Aust (n 52) 114.

58 See Bao, Y, ‘The Protection of Public Safety and Human Life vs the Inviolability of Mission Premises: A Dilemma Faced by the Receiving State’ in Behrens, P (ed), Diplomatic Law in a New Millennium (Oxford University Press 2017) 149Google Scholar; see also Denza (n 52) 135.

59 Art 24 of the VCDR; see also Hardy, M, Modern Diplomatic Law (Manchester University Press 1968) 49Google Scholar.

60 Art 30(1) of the VCDR.

61 Even when the receiving State wonders if the function of the premises of the mission is flouted by the sending State; see Wouters, J, Duquet, S and Meuwissen, K, ‘The Vienna Conventions on Diplomatic and Consular Relations’ in Cooper, AF, Heine, J and Thakur, R (eds), The Oxford Handbook of Modern Diplomacy (Oxford University Press 2014) 518Google Scholar; see also Sen, B, A Diplomat's Handbook of International Law and Practice (Martinus Nijhoff 1965) 94CrossRefGoogle Scholar.

62 United States of America v Iran [1980] ICJ Rep 3, para 86.

63 Art 22(3) of the VCDR.

64 Sutor, J, ‘Sytuacja prawna nieruchomości dyplomatycznych i konsularnych’ (The Legal Status of Diplomatic and Consular Properties) (2014) Palestra, vol 7–8, at 82Google Scholar.

65 Feltham, RG, Diplomatic Handbook (Martinus Nijhoff 2012) 35Google Scholar.

66 Aust (n 52) 117.

67 Chatterjee, C, International Law and Diplomacy (Routledge 2007) 199Google Scholar.

68 Denza (n 52) 166.

69 Chatterjee (n 67) 200.

70 Art 20 of the VCDR. See Dembinski (n 52) 87; also Sen (n 61) 149.

71 Moreover, the sending State is exempt from all national, regional or municipal dues and taxes in respect of the premises of the mission, whether owned or leased, other than those which represent payment for specific services rendered. Art 23(1) of the VCDR; see Feltham (n 65) 37.

72 Art 21(1) of the VCDR. It shall also, under art 21(2) of the VCDR, where necessary, assist missions in obtaining suitable accommodation for their members. See also Denza (n 52) 128.

73 Muszyński (n 53) 65.

74 Aust (n 52) 114.

75 Albeit according to any special agreements in force between the sending and the receiving State. See Denza (n 52) 460.

76 Aust (n 52) 118.

77 1963 The Vienna Convention on Consular Relations, United Nations, Treaty Series, vo1 596, at 261.

78 Wouters, Duquet and Meuwissen (n 61) 518. However, both the consular premises and the consular residence may use the national flag and coat-of-arms. Furthermore, both should be exempt from all national, regional or municipal dues and taxes whatsoever, other than those which represent payment for specific services rendered. See Cassese, A, International Law (Oxford University Press 2005) 116Google Scholar.

79 Lee, LT and Quigley, J, Consular Law and Practice (Oxford University Press 2008) 360Google Scholar; see also Muszyński, M, Konwencja wiedeńska o stosunkach konsularnych. Komentarz (Vienna Convention on Consular Relations. Commentary) (STO 2003) 26Google Scholar.

80 Art 31(4) of the VCCR provides that if expropriation is necessary, all possible steps shall be taken to avoid impeding the performance of consular functions, and prompt, adequate and effective compensation shall be paid to the sending State.

81 Nonetheless, there is one exception to this rule. The consent of the head of the consular post may be assumed in case of fire or other disaster requiring prompt protective action. See Wouters, Duquet and Meuwissen (n 61) 518.

82 Arts 3(3) and 59 of the VCCR; see also Dembinski (n 52) 193.

83 Art 28 of the VCCR.

84 Art 30(1) of the VCCR; see also Muszyński (n 79) 76.

85 Art 30(2) of the VCCR.

86 Art 55(2) of the VCCR.

87 Res A/RES/71/145 adopted by the UNGA 13 December 2016; Res A/RES/67/94 adopted by the UNGA 14 December 2012; Res A/RES/69/121 adopted by the UNGA 10 December 2014.

88 Which states that ‘[t]he Grand Duchy of Luxembourg shall make available the premises to the Republic of Estonia for the lease cost as set out in the conditions agreed upon by the competent authorities of the Parties’.

89 Art 2(1) of the Agreement.

90 Art 7 of the Agreement. cf VCDR art 43(1).

91 The Estonia is to notify Luxembourg, through diplomatic channels, of its authorized representative for the implementation of this Agreement. The Estonian representative does not have the legal status of a member of the mission. This means that the representative does not benefit from the privileges and immunities from the VCDR (VCDR arts 29–36). But Estonia could authorize an existing member of the mission as its representative under the Agreement. See art 10(2).

92 Art 2(3) of the Agreement.

93 Art 3(2) of the Agreement.

94 Art 3(1) of the Agreement.

95 See art 22(1) of the VCDR.

96 Art 31(4) of the VCCR.

97 Art 6(1) and (2) of the Agreement; also protected are storage devices (eg publications, magnetic tapes, optical disks, diskettes, still pictures and films and visual or sound recordings)—see art 6(5) of the Agreement.

98 Art 22(1) of the VCDR and art 33 of the VCCR.

99 The equipment and licences shall mean the assets owned by the Republic of Estonia and used for the storage of data and information systems which will be agreed upon by the competent authorities of the Parties (art 1(d) of the Agreement).

100 Art 5 of the Agreement.

101 cf art 27(1) of the VCDR which provides that ‘the receiving State shall permit and protect free communication on the part of the mission for all official purposes’. Art 35(1) of the VCCR also states that ‘the packages constituting the consular bag shall bear visible external marks of their character and may contain only official correspondence and documents or articles intended exclusively for official use’.

102 Art 4 of the Agreement.

103 SN Fard, Reciprocity in International Law: Its Impact and Function (Routledge 2016) 15. See also Paulus, A, ‘Whether Universal Values can Prevail over Bilateralism and Reciprocity’ in Cassese, A (ed), Realizing Utopia: The Future of International Law (Oxford University Press 2012) 92Google Scholar; Kolb, R, Theory of International Law (Hart Publishing 2016) 406Google Scholar; see also Paris, F and Ghei, N, ‘The Role of Reciprocity in International Law’ (2003) 36(1) CornellIntlLJ 93Google Scholar.

104 Art 6(4) of the Agreement. This kind of official communications is protected by the provisions of the VCDR — see art 27(2) of the VCDR.

105 Art 27(1) of the VCDR provides that ‘in communicating with the Government and the other missions and consulates of the sending State, wherever situated, the mission may employ all appropriate means, including diplomatic couriers and messages in code or cipher’.

106 Art 1(f) of the Agreement states that ‘force majeure’ shall mean any unforeseeable situation or event beyond the control of the Parties that was not attributable to error or negligence on their part, and which prevents them from fulfilling any or all of their obligations under this Agreement and any regulation pertaining to it.

107 Art 6(6) of the Agreement.

108 VCDR, arts 45(a)–(b). Analogous obligations are set out in VCCR arts 27(1)(a)–(c).

109 ibid.

110 Either Party may terminate this Agreement by means of a written notice to the other Party. Termination shall take effect 24 months following the date of the notifications (art 10(3) of the Agreement).

111 Further, under art 8(1) of the Agreement, ‘this Agreement shall be governed by and interpreted under international and European Union law supplemented, where applicable, by the laws and regulations of the Grand Duchy of Luxembourg’.

112 Art 8 of the Agreement provides that within two months of the receipt of the request for arbitration, each Party shall appoint one member of the tribunal. The two members so appointed shall then select a third arbitrator, who is not a national of either Party, who will be the President of the tribunal.112 The decisions of the tribunal shall be final and binding. The tribunal shall adopt its own rules of procedure and its findings shall be binding.

113 See art 23(1) of the VCDR.

114 See art 3(2) of the Agreement.

115 The Convention on the Grant of European Patents signed in Munich on 5 October 1973 — the new text of the Convention adopted by the Administrative Council of the European Patent Organisation by decision of 28 June 2001 (see OJ EPO 2001, Special edn No 4, at 55) has become an integral part of the Revision Act of 29 November 2000 under art 3(2), second sentence, of that Act.

116 Art 5(1) of the CGEP.

117 Art (2) of the CGEP.

118 See < https://www.epo.org/about-us/foundation/member-states.html >.

119 See art 8 of the CGEP.

120 Art 2 of the PPI.

121 Art 3(2) of the PPI.

122 Art 1(2) of the PPI.

123 Art 10(1) of the PPI.

124 Art 25 of the PPI.

125 The final version of the Complementary Agreement is published at <https://www.epo.org/modules/epoweb/acdocument/epoweb2/296/en/CA-119-17_en.pdf>. The official text of the Complementary Agreement is published on Journal Officiel du Grand-Duché de Luxembourg, Mémorial A n° 640 de 2018 at <http://legilux.public.lu/eli/etat/leg/div/2018/07/20/a640/jo>.

126 See at <https://www.chd.lu/wps/PA_RoleDesAffaires/FTSByteServingServletImpl?path=80FC542DE7DA9598DCE1E93CF0CB3956080348E9328A54560EB986897E45704613B2332EC139F8D56FC4856E7D27C84E$21F5A7A1ACC1E5FE001F96D331C6E40D>.

127 See at <https://www.epo.org/modules/epoweb/acdocument/epoweb2/296/en/CA-119-17_en.pdf>.

128 Art 2 of the Complementary Agreement.

129 However, art 13 of the PPI states that ‘[s]ubject to the provisions of Article 6, the President of the European Patent Office shall enjoy the privileges and immunities accorded to diplomatic agents under the Vienna Convention on Diplomatic Relations of 18 April 1961’.

130 See also ‘Address by H.E. Mr. Toomas Hendrik Ilves’ (n 13).

131 ibid.

132 Document A/70/174 adopted by the General Assembly of the United Nations on 22 July 2015.

133 Res A/RES/60/45 adopted by the General Assembly on 8 December 2005.

134 See <https://ccdcoe.org/un.html>.

135 ibid.

136 Charter of the United Nations (1945) at <http://www.un.org/en/charter-united-nations/index.html>.

137 And for the suppression of acts of aggression or other breaches of the peace, and to bring about by peaceful means, and in conformity with the principles of justice and international law, adjustment or settlement of international disputes or situations which might lead to a breach of the peace — see art 1(1) of the Charter.

138 See (n 132).

139 See Res A/RES/64/211 adopted by the General Assembly on 21 December 2009.

140 ‘Estonia to Open the World's First Data Embassy in Luxembourg’ at <https://e-estonia.com/estonia-to-open-the-worlds-first-data-embassy-in-luxembourg/>.