State and Sovereignty in Cyber Space: Government Frameworks, Laws, and Security Tools

Abstract

The emergence of cyberspace as a domain of geopolitical contestation has fundamentally disrupted conventional notions of territorial sovereignty and state authority. Unlike physical domains where boundaries are cartographically defined and legally recognized, cyberspace operates as a borderless, decentralized, and asymmetric environment — one in which the traditional Westphalian framework of state sovereignty faces its most formidable challenge yet. This chapter examines the intricate relationship between state power and cyberspace, interrogating how governments across the world have responded to the imperatives of digital governance through the development of legal frameworks, regulatory architectures, and technological security tools.
The chapter begins by deconstructing the myth that cyberspace exists beyond the reach of sovereign authority. While early internet discourse celebrated its emancipatory and ungovernable character, the reality of contemporary cyberspace reflects an increasingly fragmented landscape — one shaped by competing national interests, divergent regulatory philosophies, and the growing assertion of digital sovereignty by state actors. From China's "Great Firewall" and Russia's sovereign internet legislation to the European Union's General Data Protection Regulation (GDPR) and India's evolving data protection jurisprudence under the Digital Personal Data Protection Act, 2023, states have demonstrated both the will and the capacity to territorialize the digital domain.
Central to this analysis is a critical assessment of the international legal frameworks governing state conduct in cyberspace. The chapter evaluates the applicability of existing instruments of public international law — including the UN Charter, customary international law, and the Tallinn Manual 2.0 — to cyber operations, exposing significant normative gaps and interpretive ambiguities that states and non-state actors routinely exploit. The absence of a binding multilateral treaty on cybersecurity, combined with the attribution challenge inherent to cyber incidents, continues to undermine accountability and collective security in the digital realm.
The chapter further explores the domestic legal responses of key jurisdictions, analyzing how national cybersecurity laws, cybercrime legislation, and critical information infrastructure protection regimes function as instruments of both security and control.
Particular attention is given to the tension between state surveillance imperatives and the fundamental rights of citizens — a tension that legislation such as India's Information Technology Act, 2000 and its amendments, the United Kingdom's Investigatory Powers Act, 2016, and the United States'
Cybersecurity Information Sharing Act, 2015 have only partially resolved. The chapter argues that effective cybersecurity governance cannot be reduced to a technical exercise in deploying firewalls, encryption protocols, or intrusion detection systems; it is, at its core, a normative and institutional challenge demanding coherent legal architecture, inter-agency coordination, and meaningful democratic oversight.
The chapter concludes by proposing a multi-stakeholder model of cyber governance that reconciles state sovereignty with the transnational character of cyberspace. It advocates for enhanced international cooperation, capacity-building in developing nations, and the embedding of human rights principles within national cybersecurity strategies. Ultimately, the chapter contends that the myth of the impenetrable digital fortress — whether technological or legislative must yield to a more honest and resilient conception of cyber governance, one grounded in accountability, adaptability, and the rule of law.

DOI - https://doi.org/10.65525/SVUP.9788199328631.2025.103-116