Smaranda-Georgiana AZAMFIREI*
“Alexandru Ioan Cuza” University of Iasi, Faculty of Law
Abstract: The extension of a State’s jurisdiction beyond its territory generates consequences with respect to the content of the obligations under international human rights law. This article aims to examine the criteria that can be transposed to cyberspace for the purpose of establishing extraterritorial jurisdiction, and, from the perspective of the obligations of States, it will analyze both the primary obligations of the State- including due diligence obligations- and the subsidiary obligations of the foreign State in ensuring the protection of persons and their property.
Key-words: extraterritorial application of human rights, extraterritorial jurisdiction, due diligence obligations, State’s responsibility.
Introduction
The rapid expansion of cyberspace has posed unprecedented challenges to traditional concepts of State jurisdiction under international law. Unlike physical territory, cyberspace is inherently borderless and accessible to both State and non-State actors[1]. Traditional mechanisms of state control- such as customs offices and physical checkpoints- are increasingly obsolete against extraterritorial data streams delivered directly to individual users[2].
1. The conditions of extraterritoriality of human rights
In examining whether a State may be bound to respect the fundamental rights of natural or legal persons beyond its national borders, it must be taken into account the concepts of extraterritoriality and extraterritorial jurisdiction[3].
The former pertains primarily to substantive law and refers to a State’s capacity to apply legal norms in order to ensure the protection of persons and their property outside its territory[4]. The latter, by contrast, concerns the jurisdictional competence of a State’s national judicial authorities to exercise authority over persons and activities situated beyond its territorial boundaries[5].
The State’s possibility to project jurisdiction outside the territory is considered to be subordinated to other States[6]. As the Permanent Court of International Justice stated in Lotus Case[7], States are prohibited from exercising governmental authority, including jurisdiction, on the territory of a foreign State. At the same time, within their own territory, States may exercise jurisdiction over persons and property presenting an extraterritoriality element, insofar as no general prohibition under international law prevents the exercise of jurisdiction on their own territory[8].
In analyzing the development of extraterritoriality it is important the European Court of Human Rights jurisprudence. Initially the sole criterion for the application of human rights was determined geographically by the territory of the State party to the Convention, as jurisdiction constitutes an aspect of state sovereignty, taking into account the State’s capacity to exercise administrative, legislative and judicial functions[9]. In Banković and Others v. Belgium ans Others (Judgement) [10], the Court examines the meaning and scope of state jurisdiction, maintaining that the jurisdiction of states is territorial- nearly completely overlooking its previous decisions, which had gradually extended the reach of the human rights obligations[11]– and considers that extraterritorial jurisdiction is limited by the sovereignty of other states. The key criterion was the place where the wrongful acts were committed or whether a particular case could be situated in an exceptional context permitting a derogation from the rule of territoriality[12].
Subsequently, a criterion identified by the Court as foundational to extraterritoriality is the degree of power and control exercised by the authorities of the State Party beyond its own territory. In this regard, the Court held in Loizidou v. Turkey (Preliminary Objections) [13] that the responsibility of States Parties may be engaged through the attribution of wrongful acts committed by their authorities, whether within or outside the State’s territory, so long as the consequences occur beyond the territorial boundaries of the State.
The effective control exercised implied that Turkey assumed authority over the administrative and political activity of northern Cyprus, resulting in the inability of the Cypriot authorities to perform governmental functions in the ordinary manner. Similarly, in Cyprus v Turkey[14] case, the attribution of the wrongful acts to the author State was, once again, founded on the actions of authorities exercising effective control over a territory situated outside the State’s own territory, expressly referring to Loizidou v. Turkey (Judgement)[15].
The engagement of state responsibility is examined from the perspective of the essential criterion of control exercised by Turkish authorities over northern Cyprus through Turkish military funding. In this regard, Turkey’s jurisdiction is not limited exclusively to acts committed by the regular Turkish army, but also extends to wrongful acts of the local authorities in the northern territory of Cyprus that depend on Turkish support.
By rendering its judgment in Al-Skeini and Others v. The United Kingdom[16], in establishing jurisdiction, the Court recognizes the status of the United Kingdom, together with the United States, as occupying powers over the territory of Iraq from 1 May 2003 until the establishment of the provisional government, whereby the United Kingdom exercised functions involving State authority that would ordinarily have been performed by the legitimate sovereign government. By virtue of the governmental power effectively exercised, the United Kingdom acted with a degree of effective control over persons who died as a result of security military operations, a fact which gave rise to the attribution of jurisdiction to the United Kingdom[17].
The link to the sovereign authority is considered to be the activities of public powers that may generate a functional jurisdiction, as manifested in legislative or executive acts[18]. Extraterritoriality needs to imply effective and overall control, meaning that the State’s exercise of power is based on a claim to legitimate authority, rather than being a result of mere coercion[19]. Following the aforementioned judgment, the Court developed the personal model as a form of extraterritoriality, meaning that a State exercises effective control through its agents, whereby the use of force outside its own territory triggers the extraterritorial application of human rights obligations[20].
With regard to extraterritoriality, two major consequences emerge[21]: first, the obligation of the State concerned to extend its protective measures beyond its own territory, as a primary obligation; and second, the corresponding and subsidiary obligation of the State or non-State actor on whose territory the individual is present to recognise and safeguard the rights of that individual, insofar as it exercises a degree of control over a source of danger affecting that person. The second category of obligation is regarded as subsidiary in nature, because the foreign State is not required, on the basis of extraterritoriality, to diminish the rights of its own nationals[22] in favour of foreign individuals, nor may it permit an excessive exercise of jurisdiction by foreign authorities within its territory. Correlatively, due to the universitality character of human rights[23], the persons concerned to be able to assert fundamental rights against these two categories of states[24].
2. Recognition of Extraterritorial Jurisdiction in Cyberspace. Due Diligence Obligations
The difficulties implied by extraterritoriality in the application of human rights in cyberspace arise from the absence of clearly defined jurisdiction. The spatial application of law is difficult to sustain in cyberspace, because the individual’s conduct may fall under multiple jurisdictions depending on the destination of data flows[25]. Furthermore, it must be acknowledged that there may be a discrepancy between the geographic place of access and the individual’s physical location[26].
The fact that States do not exercise sovereignty exclusively gives rise to the consequence that cyberspace cannot be placed under their control[27], which creates obstacles in establishing the jurisdiction. As a commonly recognized practice, it is universally acknowledged that States are permitted to access data and information that are publicly available within their territory but are in fact hosted on cyber infrastructure located within the territory of a foreign State, a situation in which extraterritorial jurisdiction applies[28].
As a general rule and in accordance with the principle of territoriality, States exercise sovereign prerogatives over cyber infrastructure, persons, and activities located within their territory. However, the sovereign prerogatives of States are maintained even in cases where the actual location of the cyber infrastructure- whether of a public or private nature- is established outside the State’s territory[29].
Based on the boundless nature of cyberspace, the concept of territory has been redefined as consisting of two components- objective territoriality (according to which States exercise jurisdiction even when cyber operations are carried out outside their territory, but the consequences occur within their borders), and subjective territoriality (where cyber acts are committed within a State’s territory, but the consequences occur outside it)[30].
Acts capable of generating extraterritorial effects may be classified into two principal categories. The first category consists of acts adopted or carried out within a State’s own territory which, by their nature or intended scope, produce effects on individuals or entities located outside that territory. The second category includes acts performed by a State outside its territorial boundaries which likewise have consequences for persons or activities situated beyond the State’s territory. In both cases, the defining feature of extraterritorial action lies in the cross-border impact of state conduct and in the extension of state authority beyond the traditional confines of territorial jurisdiction[31].
For establishing the connection between a state and foreign territory or persons present on foreign territory, the reference criterion in invoking extraterritorial jurisdiction lies in the effective power and control exercised by the state over the foreign territory or over persons located outside its national territory[32]. As previously indicated, the conditions established by the case law of the European Court of Human Rights are equally applicable and have been transposed to the cyberspace context.
A distinct discussion, which is particularly relevant in the context of cyberspace, concerns the due diligence obligations established under Principle 14 of the Maastricht Principles[33]. Within the category of State duties are included the obligation to prevent any cyber act committed on their territory, to take all necessary measures to ensure the implementation of a cyber security system, as well as the obligation to act with a view to bringing to an end any ongoing cyber operations[34]. Accordingly, the duty to ensure respect encompasses legislative, administrative, judicial, and other measures necessary to guarantee that human rights are protected against both direct and indirect infringements committed by third parties[35].
Furthermore, under customary international law, States can be held responsible for conduct that aids or facilitates violations of international law by other actors[36].In discharging this obligation, States may be required to adopt legislative and regulatory measures aimed at preventing and sanctioning wrongful conduct and expression, including activities undertaken in cyberspace, that infringe upon protected rights. Such measures may include the criminalization of certain forms of online behavior where they meet the requisite thresholds of seriousness and intent under international law, as exemplified by the prohibition of direct and public incitement to genocide[37].
In order to demonstrate the peremptory character and the erga omnes effects of fundamental human rights, beyond the reaffirmation of the prohibition of acts of genocide as a jus cogens rule, the application submitted by the State of The Gambia[38] is relevant both from the perspective of a State’s standing in the proceedings (even where it has not been directly harmed by the wrongful acts[39]) and from the perspective of the responsibility of the author State for failing to fulfil its obligation to prevent and punish acts of genocide[40].
In support of the factual situation, The Gambia based its submissions on the conclusions of the international commission of independent experts established by the United Nations Human Rights Council for the purpose of conducting an investigation aimed at determining the existence of internationally wrongful acts[41].
The link with cyberspace is established by acts of incitement to hatred against persons of Rohingya ethnicity and muslims, as well as by dehumanizing portrayals that contributed to the large-scale formation of a negative perception of these racial groups as threats to the state. Facebook constituted the primary source through which the population obtained information[42], with the result that messages were transmitted and disseminated rapidly within a very short period of time[43] and the statements made by State officials were directed against individuals belonging to distinct religious and ethnic groups, employing inflammatory language that characterized their presence as a threat to national security and called for their removal from within the state[44].
From the perspective of the international responsibility of the author State, two categories of obligations have been found to have been breached. On one hand, Myanmar failed to adopt the necessary measures, within its domestic legal order, to prevent gross violations of international human rights law and international humanitarian law (which falls within the scope of the failure to comply with the aforementioned due diligence obligations). On the other hand, the wrongful acts in question constitute acts of genocide, in respect of which the State has not demonstrated any intention to initiate judicial proceedings aimed at holding accountable the individuals found responsible for the acts committed, thereby breaching its obligation to punish such forms of wrongful conduct[45].
Conclusions
In light of the operational mechanisms of cyber infrastructure, reality confirms that State jurisdiction extends beyond physical territory, for which reason the legal regime of extraterritoriality ensures the coherence of the international protection system, preventing situations in which accountability is rendered impossible due to geographic fragmentation or non-participation in normative instruments. States are unequivocally under an obligation to prevent and punish wrongful acts that violate the sphere of protection of persons. From this perspective, it is beyond doubt that the category of due diligence obligations constitutes a set of duties that States are required to transpose into the online environment, irrespective of whether the wrongful acts are committed by the administrative authorities of the State concerned or by third parties- whether State or non-State actors.
* PhD Student, Faculty of Law, “Alexandru Ioan Cuza” University of Iasi, smaranda.azamfirei@gmail.com.
The opinions expressed in this paper are solely the author’s and do not engage any of the institutions she belongs to.
[1] Carmen Moldovan, Is Cybersovereignty the Future of Cyberspace, in Analele Științifice ale Universității ,,Alexandru Ioan Cuza” din Iași, Tomul LXVII, Supliment 2, Științe Juridice, 2021, pp.274-275.
[2] Daniel Rosenberg, Seizing the Means of Disruption: International Jurisdiction and Human Rights in the Expanding Frontier of Cyberspace, in New York University Journal of International Law and Politics, vol.55, 2023, p. 126.
[3] Bogdan Aurescu, Ion Galea, Elena Lazar, Ioana Oltean, Scurta culegere de jurisprudenta, ed. Hamangiu, 2018, p.205
[4] Menno T. Kamminga, Extraterritoriality, in Max Planck Encyclopedia of Public International Law, 2020, para. 1.
[5] Jennifer A. Zerk, Extraterritorial Jurisdiction: Lesson for the Businesas and Human Rights Sphere from Six Regulatory Areas, in Corporate Social Responsibility Initiative, Working Paper No. 59, 2010, pp.13-15,
[6] Vassilis P. Tzevelekos, Reconstructing the Effcetive Control Criterion in Extraterritorial Human Rights Breaches: Direct Attribution of Wrongfulness, Due Diligence, and Concurent Responsibility, in Michigan Journal of International Law, vol.36, issue 1, 2014, p.129.
[7] Permanent Court of International Justice, France v. Turkey (The Case of S.S.Lotus), Judgement No.9, 7 September 1927, paras. 45-46.
[8] Armin von Bogdandy, Markus Rau, Lotus, The, in Max Plank Encyclopedias of International Law, 2006, paras. 9-10.
[9] Ian Brownlie, Principles of Public International Law, 7th edition, Oxford University Press, 2008, p.299.
[10] European Court of Human Rights, Banković and others v. Belgium and others, Application No.52207/99, Judgement, 12 December 2001, paras.59-61.
[11] Conall Mallory, A second coming of extraterritorial jurisdiction at the European Court of Human Rights?, in QIL, vol.82, 2021, p.32.
[12] Lord Dyson, The Extraterritorial Application of the European Convention on Human Rights: Now on a Firmer Footing, but is it a Sound One?, speech delivered at Essex University, 2014, p.19, https://www.judiciary.uk/wp-content/uploads/JCO/Documents/Speeches/lord-dyson-speech-extraterritorial-reach-echr-300114.pdf, accessed 26 January 2026.
[13] European Court of Human Rights, Loizidou v Turkey, Application No.15318/89, Judgement on Preliminary Objections, 23 March 1995.
[14] European Court on Human Rights, Cyprus v Turkey, Application No. 25781/94, 10 may 2001, paras. 75-78.
[15] European Court of Human Rights, Loizidou v Turkey, Application No.15318/89, Judgement, 18 December 1996, paras.52-56.
[16] European Court of Human Rights, Al-Skeini and others v. The United Kingdom, Application No.55721/07, Judgement, 7 July 2011, paras.138-140.
[17] Barbara Miltner, Revising Extraterritoriality after Al-Skeini: The ECHR and Its Lessons, in Michigan Journal of International Law, vol.33, 2012, p.698.
[18] Mariagiulia Giuffre, A functional-impact model of jurisdiction: Extraterritoriality before of the European Court of Human Rights, in QIL Zoom-in, vol.82, 2021, p.65, https://www.qil-qdi.org/wp-content/uploads/2022/01/04_ECtHR-Jurisdiction_GIUFFRE_FIN.pdf, accessed 03.02.2026.
[19] Samantha Besson, The Extraterritoriality of the European Convention on Human Rights: Why Human Rights Depend on Jurisdiction and What Jurisdiction Amounts to, in Leiden Journal of International Law, vol.25, 2012, pp.872-874.
[20] Yves Haeck, Clara Burbano-Herrera, Hannah Ghulam Farag, Extraterritorial obligations in the European human rights system, in The Routledge Handbook on Extraterritorial Human Rights Obligations, Routledge, 2022, pp. 129-130.
[21] Human Rights Council, International solidarity and the extraterritorial application of human rights: prospects and challenges, Report of the Independent Expert on human rights and international solidarity, 19 April 2022, pp. 3-4.
[22] Sarah Joseph, Blame it on the WTO? A Human Rights Critique, in Oxford University Press, 2011, p.260, https://www.econstor.eu/bitstream/10419/118676/1/454396.pdf, accessed 03.02.2026.
[23] Samantha Besson, The Extraterritoriality …, loc.cit., p.859.
[24] Samantha Besson, Due Diligence and Extraterritorial Human Rights Obligations- Mind the Gap!, in ESIL Reflections, vol.9, issue 1, 2020, p.2.
[25] Wanshu Cong, A Critical Assessment on the Extraterritorial Application of Human Rights Treaties to Transnational Cyber Surveillance, in Canadian Journal of Law and Technology, vol.15, no.1, 2017, p.57.
[26] Ido Kilovaty, An Extraterritorial Human Right to Cybersecurity, Notre Dame Journal of International& Comparative Law, vol.10, issue 1, p.47.
[27] Carmen Moldovan, supra cit.
[28] Daniel Rosenberg, loc.cit., p. 136.
[29] Michael N. Schmitt, Tallin Manual 2.0 on the International Law Applicable to Cyber Operations, Cambridge University Press, 2017, p.13-14.
[30] Tsvetelina van Benthem, Joanna Kulesza, Ye Liu, Nanxiang Sun, Jurisdiction in Cyberspace, Sino-European Expert Working Group on the Application of International Law in Cyberspace, Research Group Report, 2024, p.10, https://www.gcsp.ch/sites/default/files/2024-12/EWG-IL_Partnered_Jurisdiction_2024-11%3Bdigital.pdf, accessed 26 January 2026.
[31] Michael N. Schmitt, op.cit., p.184.
[32] Human Rights Committee, General Comment No.31: The nature of the General Legal Obligation Imposed on States Parties to the Covenant, adopted at the 80th Session, CCPR/C/21/Rev.1/Add.13, 29 March 2004, para.10, https://digitallibrary.un.org/record/533996?v=pdf, accessed 26 January 2026.
[33] Sandy Liebenberg (Chair), Maastricht Principles on The Human Rights of Future Generations, adopted on 3 Frebruary 2023, https://www.ohchr.org/sites/default/files/documents/new-york/events/hr75-future-generations/Maastricht-Principles-on-The-Human-Rights-of-Future-Generations.pdf, accessed 26 January 2026.
[34] Matthias C. Kettemann, Anna Sophia Tiedeke, Cybersecurity and extraterritorial obligations of states, in The Routledge Handbook on Extraterritorial Human Rights Obligations, Routledge, 2022, p.410.
[35] Michael N. Schmitt, op.cit., pp.196-198.
[36] Lorand Bartels, The EU’s Human Rights Obligations in Relation to Policies with Extraterritorial Effects, in EJIL, vol.25, 2014, p.1080.
[37] Ibidem.
[38]International Court of Justice, Application instituing Proceedings and Request for Provisional Measures (The Gambia v. Myanmar), filed in the Registry of the Court on 11 November 2019.
[39] International Court of Justice, Application of the Convention on the Prevention and Punishment of the Crime of Genocide (The Gambia v. Myanmar), Order of Provisional Measures, 23 January 2020, p.18.
[40] Convention on the Prevention and Punishment of the Crime of Genocide, approved and proposed for signature and ratification or accession by General Assembly resolution 260 A (III) of 9 December 1948, entry into force on 12 January 1951 in accordance with article XIII.
[41] United Nations General Assembly, Resolution adopted by the Human Rights Council on 24 March 2017, A/HRC/RES/34/32, 2017, https://docs.un.org/en/a/hrc/res/34/22, accessed 26 January 2026.
[42] Carmen Moldovan, Freedom of Expression in Cyberspace: The Good and the Bad, in Recent Debates in Cyberspace and Artificial Intelligence Law, ADJURIS- Editura Academică Internațională, 2023, p.31.
[43] United Nations General Assembly, Report of detailed findings of the Independent International Fact-Finding Mission on Myanmar, 17 September 2018, p.323, https://documents.un.org/doc/undoc/gen/g18/277/04/pdf/g1827704.pdf?OpenElement, accessed 26 January 2026.
[44] Idem, pp.331-335.
[45] United Nations General Assembly, Report of the independent international fact-finding mission on Myanmar, 8 August 2019, pp.15-17, https://docs.un.org/en/a/hrc/42/50, accessed 26 January 2026.
