Cyber Law Toolkit tests surveillance and data collection under occupation

Editor’s Note: The Cyber Law Toolkit’s newest entry — formally titled “Data collection in occupied territory” and numbered Scenario 35 — puts a worked international-law analysis around three operations any cyber, legal, or compliance team would otherwise face cold: the rerouting of internet traffic out of occupied territory, the imposition of mass surveillance on a civilian population, and the systematic collection of population data. The Toolkit, developed collaboratively by NATO’s CCDCOE, the University of Exeter, the International Committee of the Red Cross, and three other partner institutions, was awarded the American Society of International Law’s 2025 Jus Gentium Research Award, recognition announced in the same year as the 2025 update.

For cybersecurity, information governance, eDiscovery, and data privacy professionals, the occupation analysis is one of the most operationally relevant entries the Toolkit has produced to date. It maps the line between security-emergency measures and entrenched regimes of digital control, and it gives multinational telecom, cloud, and data teams a framework for which authority requests they can lawfully honor in contested territory and which they are obligated to resist or escalate.

Watch for the 2026 update, due this autumn, which is likely to engage with AI-enabled cyber operations and the maturing national-position practice from states that have only recently begun publishing their views.

Industry News – Cybersecurity Beat

Cyber Law Toolkit tests surveillance and data collection under occupation

ComplexDiscovery Staff

A foreign intelligence service that quietly reroutes internet traffic out of an occupied territory. A surveillance program turned on a civilian population that no longer has a working domestic government. A data-collection operation that runs under emergency administration but lasts long enough to look like infrastructure. Each used to be the kind of question that landed on a national security lawyer’s desk with no obvious answer.

That fact pattern sits at the center of the Cyber Law Toolkit’s newest entry — formally numbered Scenario 35 and titled “Data collection in occupied territory” — released in the project’s September 2025 update. The Toolkit, an open-access international cyber law resource developed by an international editorial consortium that includes the NATO Cooperative Cyber Defence Centre of Excellence and five partner institutions, is recognized and used as a working reference in several published national positions and multilateral settings, by governments, military legal advisers, and academics. As of September 2025, it featured 35 worked scenarios, nearly 80 real-world cyber incidents, and 35 national positions, plus the African Union and European Union common positions on international cyber law.

What the occupation-cyber analysis actually asks

The new scenario walks through three operations and tests each against international humanitarian law and international human rights law: the rerouting of internet traffic out of occupied territory, the imposition of mass surveillance on the civilian population there, and the systematic collection of population data. The analysis asks whether each measure squares with the obligations an occupying power assumes under the law of occupation, including the duty to respect the existing legal order, the prohibition on collective punishment, and the human rights protections that continue to apply where humanitarian law sets the floor — drawing on the law of occupation in international humanitarian law and on applicable international human rights treaties.

The scenario’s analysis is closely tied to real-world practice; the questions it poses map onto disputes over surveillance systems and data routing in occupied or contested territories that have surfaced in recent state practice and incident reporting.

The data-collection-and-surveillance scenario is among the most operationally specific additions the Toolkit has made on the civilian-harm side. Where prior entries focused on use-of-force questions or attribution, this one takes the reader deep into the everyday architecture of digital control — network engineering, telecom contracts, lawful-interception interfaces — and asks where the legal lines run.

Why this lands on cybersecurity, IG, and eDiscovery desks

The takeaways below are risk-management implications, not legal conclusions; specific decisions belong to qualified counsel applying the analysis to a given organization’s facts.

For the cybersecurity practitioner, the occupation analysis is a primer on what happens when cyber operations cross from “incident” to “policy.” The scenario distinguishes among measures that may be permissible during a brief security emergency, measures that become legally impermissible as a temporary security emergency hardens into a more permanent regime of control, and measures that fail any test from the outset. That distinction informs tabletop exercises and vendor due diligence work; companies operating telecom or cloud infrastructure across contested geographies use such analyses to inform internal risk discussions about which authority requests align with established legal grounds and which warrant escalation to outside counsel.

For information governance leads, the scenario reads as a sovereignty atlas. The same question the analysis poses for state authorities — when does this data collection violate the rights of the data subject — is the question a multinational privacy program faces when its in-country operator is asked to provide data feeds to a transitional administration. The Toolkit’s framework lays out the legal grounds the regulator will reach for; the IG lead can use that to anchor a working policy.

For eDiscovery counsel, the scenario is a reminder that international law has worked answers for the questions that show up in cross-border data preservation, lawful-interception subpoenas, and chain-of-custody disputes when records pass through occupied territory. Defense counsel preparing a litigation hold for a multinational data-exfiltration matter should treat the relevant national position pages as a starting research index.

How the rest of the Toolkit sets the stage

The occupation analysis lives inside an editorial pipeline that has been adding three to five new scenarios each year since 2019. The Cyber Law Toolkit, hosted at International Cyber Law in Practice: Interactive Toolkit and operating as a wiki-style platform, launched in Tallinn, Estonia, was originally seeded with funding from the United Kingdom’s Economic and Social Research Council, and is now developed collaboratively by an international editorial consortium that includes the Czech National Cyber and Information Security Agency (NÚKIB), the International Committee of the Red Cross, the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE), the University of Exeter, the U.S. Naval War College and Wuhan University. Professor Kubo Mačák of the University of Exeter serves as general editor; Tomáš Minárik of NÚKIB serves as managing editor; and Otakar Horák of the NATO CCDCOE serves as scenario editor. As of September 2025, the project had received the Jus Gentium Research Award from the American Society of International Law, placing it among a roster of recognized references that includes the United Nations Digital Library and the ICC Legal Tools Database.

“Each year, the Toolkit evolves to reflect how international law is being tested and shaped by cyber activities,” Mačák said in announcing the 2025 update. “The 2025 update ensures that policymakers, legal advisers, and scholars have access to up-to-date, reliable guidance on these rapidly developing issues.”

The occupation scenario was released alongside two companions in 2025. The peaceful-settlement scenario, numbered 33, takes on the international-law duty to settle disputes peacefully and what good-faith negotiation looks like when a cyber incident touches multiple jurisdictions. The civilian-infrastructure scenario, numbered 34, runs severe cyberattacks on civilian infrastructure against the Rome Statute’s threshold for crimes against humanity and analyzes when, if ever, those operations might meet that bar. Earlier entries that practitioners pair with the new occupation analysis include the power-grid scenario (number 3), which walks through a state intelligence service that gets into another country’s electric grid by tainting the supply chain of an industrial control system; the ransomware scenario (number 14), which maps a state’s options when foreign-origin ransomware disables municipal and health-care services and argues that, on the modeled facts in that scenario, only retorsion fits among the four standard responses (countermeasures, the plea of necessity, self-defense and retorsion); the medical-facilities scenario (number 20), which runs cyber operations against medical facilities through both peacetime law and the international humanitarian law that applies during armed conflict; and the election-interference scenario (number 1), which picks apart election interference and asks where the line of prohibited intervention runs. Read in sequence, the Toolkit moves from use-of-force questions toward civilian harm and the gray zones below the threshold of armed conflict.

State practice has been catching up to the Toolkit’s analytical framing. Austria, the Czech Republic, and Costa Rica have publicly credited the Toolkit as a resource they relied on in preparing their own national positions, and Costa Rica named the Toolkit as a legal capacity-building initiative in its statement at a U.N. Security Council open debate on cyberspace threats in June 2024. That third-party validation matters because a resource that began as a description of the law has started to influence how the law is applied in practice — when states cite the Toolkit as their working reference, it shapes the very state practice that international law watchers track.

Where the Toolkit fits with the Tallinn Manual

The Toolkit is best understood next to its better-known sibling. The Tallinn Manual, a non-binding but highly influential scholarly restatement of international law in the cyber context, is published in periodic editions by Cambridge University Press and is currently being updated as Tallinn 3.0 under Professor Michael Schmitt. The Toolkit, by contrast, is the practitioner-facing layer: continuously updated, scenario-driven, and free to access. Where the Manual codifies the rules, the Toolkit walks the reader through how those rules apply to a specific fact pattern. For a CISO or an information governance lead working through the occupation analysis, the two resources pair — the Manual sets the legal taxonomy, the Toolkit applies it to the operation in front of you.

What’s next, and where to find the resources

The 2026 update is already in the pipeline. The editorial team published a call for submissions in September 2025 and accepted proposals through Nov. 14, 2025. That submission window suggests the next round of scenarios will arrive in autumn 2026. The current 35-scenario set predates the post-2024 surge in artificial intelligence-enabled cyber operations, which means readers should expect the 2026 update to begin engaging with AI-specific fact patterns alongside the durable surge in geopolitical incidents and the maturing national-position practice.

“The Centre considers the Toolkit as one of our key joint endeavors, one that connects the academic legal expertise with real-life occurrences,” Horák said in connection with the 2025 release.

For practitioners ready to put the occupation analysis to work, the Toolkit’s accompanying resources are where the depth lives. The scenario itself sits at Scenario 35: Data collection in occupied territory under the formal title “Data collection in occupied territory.” The wiki’s database of nearly 80 real-world cyber incidents — paired with the 35 national positions and the African Union and European Union common positions on international cyber law — gives a primary research index for cross-border incident planning; the full list of articles is available for review and study. The Tallinn Manual, hosted at the NATO CCDCOE, pairs with the Toolkit for practitioners who need both the rules and the worked applications. And the September 2025 release announcement from the CCDCOE and the University of Exeter remains the single best pointer to what changed in the most recent annual update.

Which scenario, walked through with your incident-response counsel and your information governance lead before you need it, would tell you the most about how your organization would actually fare in a cross-border cyber crisis?

News sources

• Cyber Law Toolkit. (2025). Scenario 35: Data collection in occupied territory. Available at: https://cyberlawtoolkit.org/scenario-35/ (Accessed: April 28, 2026).
• Scenario 35: Data collection in occupied territory  (Cyber Law Toolkit)
• Award-winning cyber law resource releases 2025 update and opens call for submissions  (NATO CCDCOE)
• Award-winning cyber law resource has 2025 update  (University of Exeter News)
• Cyber law resource receives 2025 update  (Scottish Legal News)
• Cyber Law Toolkit 2025 Update Strengthens Global Legal Framework for Cybersecurity  (ComplexDiscovery OÜ)
• List of articles — International cyber law: interactive toolkit  (Cyber Law Toolkit)
• International cyber law: interactive toolkit  (Cyber Law Toolkit)

Assisted by GAI and LLM technologies

Additional reading

• The router on the shelf is now a national security problem
• Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery
• When Your Legal Tech Vendor Gets Breached: DocketWise Incident Exposes 116,666 Immigration Records and a Profession’s Blind Spot
• The DOJ’s Cyber FCA Playbook Is Working as Enforcement Triples and Shows No Signs of Slowing
• FTC’s OkCupid Action Reframes AI Training Data as a Consumer Protection Issue
• White House AI Framework Signals New Compliance Stakes for Legal, Cybersecurity, and eDiscovery
• The Gatekeeper’s Key: How the Conformity Assessment Unlocks the EU AI Market

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.