Unilateral Cyber Sanctions: Between Questioned Legality and Normative Value

By: Iryna Bogdanova and María Vásquez Callo-Müller

PDF: Unilateral Cyber Sanctions

The current legal vacuum regarding binding international norms regulating malicious conduct in cyberspace has paved the way for the emergence of a unilateral tool: cyber sanctions. They have already been introduced by the United States, the European Union, and the United Kingdom. Notwithstanding their obvious importance, their interrelations with international law—especially international economic law—have remained largely unexplored in academic research. This gap is perplexing given the fact that the existing unilateral cyber sanctions have been formulated in such a way as to be prone to misuse. In particular, they bear a significant potential to disrupt economic relations and undermine global value chains.

The objective of this Article is to explore the legality of unilateral cyber sanctions under international law, including WTO law and international investment agreements. Our analysis reveals that cyber sanctions might, in some instances, violate international law or commitments made under international economic law instruments. Furthermore, cyber sanctions may not be justified as countermeasures, and they most likely would not meet the threshold set by the WTO jurisprudence to be justifiable under the national security exception. Similarly, they could be challenged before investment tribunals for being inconsistent with the international investment standards of treatment. Yet, cyber sanctions might be an effective instrument with the normative potential to regulate behavior in cyberspace. Notwithstanding this, their undefined status under international law has paradoxical implications. On one hand, it can allow ruthless use of unilateral cyber sanctions and the reinforcement of the politics of unilateral power, thus causing significant economic harm. On the other hand, it can undermine the signaling function and deterrence potential embedded in unilateral cyber sanctions.