Cyberespionage and human rights: A disappointing balance

This Chapter assesses the potential of human rights to curtail cyberespionage practices. We first assess law-making efforts in multilateral settings, reviewing efforts to regulate state-sponsored operations in cyberspace, including cyberespionage, and the role that human rights norms have played in such norm-making endeavors. Concluding that a binding multilateral treaty regulating malicious cyber operations or cyberespionage specifically is extremely unlikely to be adopted in the near future, we move on to assessing the potential of human rights courts and bodies to curtail ever-expanding practices of electronic mass surveillance and indiscriminate data retention. Focusing especially on the case law of the European Court of Human Rights and the Court of Justice of the European Union, we argue that, despite procedural adaptations to cyberespionage and a promising early case law, European human rights courts have ultimately failed to mobilize the human rights framework to meaningfully curtail cyberespionage, instead succumbing to a balancing act favoring states’ national security arguments. Finally, we outline the consequences of law-making failures and of European courts’ principled acceptance of mass surveillance and indiscriminate data retention for future developments.