Cybersecurity, Foreign Investment, and the Evolving Meaning of Full Protection and Security

Abstract

Foreign investors increasingly rely on digitally mediated assets and operations, like data centres, cloud services, and industrial control systems, that are situated within or controlled by host states. The law governing the obligations of host states to prevent and respond to cyber incidents affecting those investments remains uneven and fragmented. Current study examines whether, and in what manner, the classical investment law standard of full protection and security (FPS) can be interpreted to encompass a positive duty of cyber due diligence. Drawing on treaty practice, arbitral jurisprudence, and general public international law on state responsibility, it traces the conceptual and doctrinal routes through which cyber risks may be characterized as security risks to an investment and brought within the ambit of FPS. The research provides an ordered understanding of cyber due diligence, built around three core dimensions namely regulatory preparedness, operational readiness and remedial responsiveness. Regulatory preparedness is the existence of reasonably up-to-date legal frameworks on cybersecurity and breach notification; operational readiness is the institutional capacity and technical and organizational measures in critical infrastructure; and remedial responsiveness is the incident handling, cooperation with affected investors, and transparency in the aftermath of an attack. These dimensions are tested against hypothetical but realistic scenarios, including ransomware attacks on industrial facilities and systemic data exfiltration from state licensed data centers, to explore how arbitral tribunals approach questions of causation, attribution, and contributory fault in cyber related FPS claims. Recognizing a digital variant of FPS need not transform host states into insurers against all cyber harm. Properly framed as an obligation of conduct, cyber due diligence clarifies the standard of reasonableness in circumstances where regulatory indifference or institutional inaction can significantly magnify transboundary harm. The article concludes with drafting suggestions for next generation investment treaties that seek to integrate cyber due diligence into FPS and related clauses while preserving the regulatory autonomy required for evolving cybersecurity policy.