Principles of Legal Provision of Information Security in the System of Principles of International Law

Duben' Andrei Kirillovich Scientific Associate, Institute of State and Law of the Russian Academy of Sciences; Assistant, Department of Civil and Administrative Proceedings, Russian State University of Justice 119019, Russia, Moscow region, Moscow, Znamenka str., 10 k.duben@mail.ru Other publications by this author

In the context of global digital transformation and the need to build an information society, the problems concerning the definition of the fundamental principles of legal provision of information security are of particular importance. In this regard, the issue of scientific understanding of the system of these principles, their development and correlation with each other, as well as the impact on information legal relations becomes quite relevant. At the same time, the conditionality of such an understanding is connected not only with the scientific interest of scientists in the field of the science of international and information law, but also with more practical goals concerning the improvement of legal regulation and the formation of law enforcement practice.

In the theory of law, the definition of legal principles has various formulations, most of which contain the key features of this concept. Thus, in the work of M.N. Marchenko, the principles represent "the main ideas, starting points or leading principles of the process of formation, development and functioning of law" ^{[1, p. 249]}. According to the position of L.A. Morozova, the principles of law are "fundamental ideas enshrined in official sources of law or recognized in legal practice and reflecting the patterns of development of public relations" ^{[2, p. 193]}. Thus, the principles of law are of fundamental importance for the regulation of public relations and at the same time can find regulatory and legal consolidation both at the state and international level.

The importance of legal principles in terms of their role in the formation of law enforcement practice and regulatory material is particularly high, including in the field of information security. Legal principles serve as a guideline for the legislator, since the norms formulated by him should not contradict the principles of law and at the same time should represent their detailed expression. These aspects also take place in relation to the field of information security.

First of all, it is worth touching upon the generally recognized principles of international law. The source of these principles is the UN Charter, the Declaration on Principles of International Law concerning Friendly Relations and Cooperation between States in Accordance with the UN Charter and the UN Millennium Declaration. The first two of the above-mentioned acts mention the principle that States resolve their international disputes by peaceful means in such a way as not to endanger international peace, security and justice. The information space of the absolute majority of modern countries is defined as a new theater of military operations. In this regard, it is worth concluding that the concept of international peace and security, mentioned within the framework of the content of this principle, also applies to the sphere of international information security. Consequently, the concepts of "international security" and "international information security" relate to each other as general and particular. At the same time, in the field of international information security, this principle is the most relevant, since the advantages of using information weapons make the conduct of information wars more preferable for countries.

The principle of non-use of force and threat of force for the sphere of information security is of high importance. Currently, this principle can be interpreted broadly and presuppose not only encroachment on the territorial integrity of another State and the possibility of conducting hostilities on its territory, but also acts of information aggression and the use of information weapons, including propaganda of war, the prohibition of which is enshrined in Article 20 of the International Covenant on Civil and Political Rights ^[3].

The obligation of States to cooperate with each other in the field of information security is manifested in the development of coordinated measures to counter information threats that encroach on the security of the global information space and affect the national interests of several States. Currently, this principle seems even more relevant due to the increasing level of integration interaction and interdependence between countries due to the cross-border nature of the information space.

The principle of sovereign equality of States presupposes the possibility of all States to participate equally in solving problems of international information security and to be participants in the global information space, regardless of differences of a political, social, economic or other nature. This principle plays a significant role in increasing the level of interstate interaction on the problems of protecting the information space from the negative impact of sources of information threats.

The principle of conscientious fulfillment of obligations is implemented through the proper fulfillment by States of obligations arising from international treaties in the field of information security or in accordance with generally recognized principles and norms of international law. The concept of "good faith" in this case presupposes voluntary execution, eliminating the need to use international legal levers of pressure.

Describing the sources of international information law, many authors mention the principle of respect for human rights and fundamental freedoms. This principle, in relation to the field of information security, is specified in the International Covenant on Civil and Political Rights, the International Covenant on Economic, Social and Cultural Rights ^[4] and the Universal Declaration of Human Rights ^[5]. In particular, these acts consolidate the norms on the secrecy of correspondence and the prohibition of illegal encroachment on honor and reputation.

The UN Millennium Declaration emphasizes commitment to the goals and principles of the UN, as well as increasing their relevance "as countries and peoples become more interconnected and interdependent." The latter statement fully corresponds to the development of the information environment and information technologies in the context of globalization, therefore, it also applies to ensuring information security.

The generally recognized principles of international law in the field of information security have also found expression in UN resolutions on cybersecurity and scientific and technological progress ^[6]. Most of these principles are consistent with the strategic planning documents of foreign countries and emphasize the importance of openness and transparency of the state's activities in the information space, as well as the need to form a global culture of information security.

The Okinawan Charter of the Global Information Society also enshrined a number of principles, some of which are directly related to the field of ensuring international information security ^[7]. So, among other principles, it is fixed: "further development and effective functioning of electronic identification, electronic signature, cryptography and other means of ensuring the security and reliability of transactions; development of an effective and meaningful mechanism for protecting consumer privacy, as well as protecting privacy when processing personal data, while ensuring the free flow of information." Thus, this international act focuses primarily on the information security of the individual, as well as on the development of information and technical means of ensuring security.

The formation of the principles of legal provision of information security was also influenced by the Declaration of Principles adopted in Geneva in 2003 ^[8]. The document points out the importance of observing the principle of legality, which implies strict compliance with national laws and regulations, as well as relevant international agreements. One of the most important principles directly related to the field of international information security is the principle of confidence-building and security in the use of ICT. It follows from the analysis of the Declaration that this principle consists of the following elements: 1) strengthening the foundation for trust, including information security and network security, authentication, protection of privacy and consumer rights; 2) formation, development and implementation of a global culture of cybersecurity; 3) prevention of the use of information resources and technologies for criminal and terrorist purposes.

The Tunisian Program for the Information Society, adopted in 2005, emphasizes the importance of ensuring the stability, security and continuity of the Internet, strengthening trust and security in the use of ICT, enhancing international cooperation to strengthen security while ensuring greater protection of personal information, privacy and data ^[9]. In general, the provisions of these documents differ little from the ideas set out in UN resolutions.

As you can see, the general principles designed to ensure international information security can already be considered formed at the moment. However, it cannot be said that the basic principles of legal support for international information security, enshrined at the international level, are a structured system. An attempt to structure and give a systematic look to the basic principles of ensuring information security was carried out by the Russian Federation, which proposed in 1999 within the framework of the UN "Principles concerning International Information Security" ^[10]. However, the proposed document with five basic principles was never adopted as a resolution. Over time, due to the rapid development of information technologies and the formation of a global information society, there will inevitably be a need to formulate new principles, revise previously fixed ones or interpret them differently.

The principles of ensuring information security can be formulated not only at the global level, but also at the regional level. The principles enshrined as a result of Russia's integration cooperation with other countries have a certain significance.

Over time, due to changes in the political and economic situation in the world caused by globalization, integration cooperation between states is only increasing, including on issues of international information security. These problems were the subject of consideration at the XIII Internet Governance Forum held at UNESCO headquarters, where the French President made a Paris Appeal for Trust and Security in Cyberspace ^[11]. However, Russia was not among the more than 50 countries that signed this document. It seems that this is primarily due to the fact that the specified document is declarative in nature, and therefore the binding nature of its execution is not legally supported.

At the same time, in terms of rapid response to the problems of international information security of the Russian Federation, it is also no exception in this case, in connection with which the Foundations of the State Policy of the Russian Federation in the field of International Information Security were adopted. The active role of the Russian Federation in the field of ensuring international information security can be traced based on its activities in the UN. So, in December 2018, two draft resolutions proposed by Russia were adopted at once: The resolution "Achievements in the field of informatization and telecommunications in the context of international security" ^[12] and the Resolution "Countering the use of information and communication technologies for criminal purposes" ^[13].

It follows from the analysis of international acts that a large number of legal acts in the field of information security have been concluded with the participation of the Russian Federation. The purpose of integration interaction in this case is the harmonization of the laws of various states in the field of international information security, which will avoid such an urgent problem as the lack of certainty of the conceptual apparatus used in various legal acts, without which it is impossible to fully cooperate between countries. Stable integration relations between various States allow them to take joint coordinated measures to combat information threats and challenges affecting regional and global interests, the effective prevention of which requires the consolidation of international State resources.

It is worth noting that official documents adopted within the framework of one integration organization sometimes have a positive impact on the regulatory framework of another organization. Thus, the Model Law of the IPA CIS "On International Information Exchange" ^[14] and the Concept of Cooperation of the CIS member states in the field of information security ^[15] had different definitions of the concept of "information security", which was unacceptable from the point of view of the need to ensure a single conceptual apparatus and terminological certainty. In this regard, the concept of information security in the Information Security Strategy of the CIS member states, adopted in 2019, began to be defined in accordance with a more appropriate definition enshrined in the Agreement between the Governments of the SCO Member States on Cooperation in the field of international information security, that is, as the state of security of the individual, society and the state and their interests are protected from threats, destructive and other negative impacts in the information space.

Thus, the fundamental principles in the field of ensuring international information security require consolidation at the global level, since the supranational level of legal support on a regional scale, involving the participation of several (or several dozen) states, cannot fully satisfy the need of the world community to solve problems of international information security. In conditions when the information space actually blurs the boundaries between States, not limited to the framework of one State, region or continent, issues of international information security, including the basic principles of its provision, should be a universal and clearly defined system, compliance with the rules of which will be mandatory for the entire international community.