It has been a true pleasure to edit this special issue of the Nordic Journal of International Law, which is based on the symposium “Security and the formation and application of international law” in honour of Marie Jacobsson, hosted on 24 January 2024 by the Stockholm Centre for International Law and Justice (scilj) in collaboration with the European Society of International Law and the Swedish Branch of the International Law Association.1The purpose of the symposium was to explore the interplay between international law, policy and decision-making regarding security. International lawyers assume that international law influences both general policies and concrete decisions by states. But we also acknowledge that law is a by-product, as it were, of concrete political decisions. The intricate dialectic between law and concrete practice, between formation and application, is omnipresent. When states act they may contribute to state practice, subsequent treaty practice or also to opinio juris and must think beyond the case at hand. Conversely, in the more relaxed chambers of codification where lawyers try to make sense of what states do, they will inevitably consider the political and practical implications.

Sustainable Development Goal (SDG) 16, Peace, Justice, and Strong Institutions, is both the most legal and the most political sustainable development goal. Not only does it underpin all the other SDGs, it concerns the makeup of the whole international system. For reformers, SDG 16 looks promising by putting governance, justice, and accountability at the centre of development. Disappointingly, however, the targets and indicators often reduce the goal, sometimes beyond recognition. By and large, SDG 16 leaves the fragmented international political and legal order as it is. Nevertheless, SDG 16 has a rhetorical potential beyond its nitty-gritty content, and its malleability enables interpretations that go beyond those intended by states.

This essay will discuss how intrusive (hacking) cyber espionage in peacetime is legally justified, in particular by some US defense sources.  In their reading, “cyberspace” has become a virtual "space" of exception from the usual peacetime rules of respect for sovereignty. Given the ubiquitous and interlinked nature of “cyberspace”, exceptions previously applicable only in war or in other hostile relations, have now de facto become the rule, and states have sought ways to rationalise and justify that, without openly flouting the established categories of war, peace and sovereignty. In the US, this has occurred through a very limited conception of sovereignty (sovereignty as a non-binding principle). This leaves much of “cyberspace” in a legal no-mans-land, or more adequately, a free-for-all-land, in which states can search and manipulate data on computers in foreign states without much legal consequence. This very limited conception of territorial sovereignty is related to the metaphorical spatialalisation of the Internet as a new "domain", a "cyberspace", rather than as a network of hardware located in interlinked but still separate national jurisdictions.