Civil Law And Cross-Border Information Warfare Civil Liability In Europe

1. Introduction

Cross-border information warfare civil liability concerns private-law claims arising when deliberately false, manipulated, deceptive, defamatory, or otherwise harmful information is created, amplified, distributed, or coordinated across European borders and causes legally recognizable damage.

The concept can cover activities such as:

coordinated disinformation campaigns;

fabricated news or documents;

manipulated photographs, audio or video;

false allegations against companies or individuals;

coordinated online defamation;

bot-assisted amplification;

impersonation and fake accounts;

malicious information designed to damage a business;

disclosure or manipulation of private information;

false information causing financial or reputational loss;

platform-based dissemination of unlawful content; and

cross-border campaigns where the perpetrator, platform, victim and damage are located in different countries.

A crucial legal point is that “information warfare” is not itself a single European civil-law cause of action. Civil liability normally has to be established through existing doctrines such as defamation, personality-right infringement, privacy violations, unlawful interference, protection of commercial reputation, economic loss, abuse of rights, or other applicable tort/delict rules.

European law becomes particularly important because online information can cross borders instantly. The CJEU has developed specific rules concerning jurisdiction, centre of interests, territorial damage, removal orders and intermediary liability. (EUR-Lex)

2. Meaning of Cross-Border Information Warfare

In civil-law analysis, the following elements are normally examined:

A. Information operation

There must be some dissemination or manipulation of information, for example:

false statements;

fabricated evidence;

misleading commercial information;

defamatory allegations;

manipulated digital media;

coordinated social-media publications.

B. Cross-border element

At least two jurisdictions may be involved:

Country A → perpetrator

Country B → platform/server

Country C → victim

Country D → economic damage

The same information may therefore create several potentially relevant jurisdictions.

C. Wrongfulness

The information must violate a protected legal interest. Examples include:

reputation;

personality rights;

privacy;

commercial goodwill;

contractual interests;

property;

economic interests.

D. Damage

The claimant normally needs to establish legally recognized damage, such as:

reputational damage;

loss of customers;

loss of contracts;

financial loss;

professional damage;

non-material harm.

E. Causation

The claimant must connect the unlawful information campaign with the damage.

This becomes particularly difficult when information has been reproduced thousands of times by third parties.

3. European Legal Framework

Several bodies of law may interact.

The European framework therefore does not automatically transform a disinformation campaign into a civil tort. The underlying national substantive law remains important.

4. Freedom of Expression vs Civil Liability

Information-war litigation frequently involves a conflict between:

Article 10 ECHR — freedom of expression

and

Article 8 ECHR — private life and reputation.

Courts generally have to consider:

whether the statement is fact or opinion;

whether the factual allegation is true;

whether the publication contributed to public debate;

the position of the person concerned;

the seriousness of the allegation;

the method of obtaining the information;

the size and nature of the audience;

whether the defendant acted as publisher or intermediary; and

proportionality of the remedy.

Thus, false information deliberately designed to cause damage may receive different treatment from genuine criticism, political opinion, satire, or good-faith journalism.

5. Cross-Border Jurisdiction

This is one of the most important issues.

Suppose:

a Russian-based actor creates the content;

a French company hosts it;

an Estonian company is attacked;

German customers see it; and

the company's main business is in Sweden.

Which court can hear the civil claim?

The CJEU's internet-personality-rights jurisprudence provides important answers.

6. Case Law

Case 1 — eDate Advertising GmbH v X and Martinez v MGN Ltd

Joined Cases C-509/09 and C-161/10, CJEU, 25 October 2011

This is one of the foundational European cases concerning internet-based personality-rights damage.

The Court considered harmful material published on the internet and the question of where the victim could sue.

The CJEU recognised that internet publication is fundamentally different from traditional territorial publication because online content can be accessed throughout the world.

The victim may bring an action concerning all damage in the EU before:

the courts of the Member State where the publisher is established; or

the courts of the Member State where the victim has his or her centre of interests.

Alternatively, courts in individual Member States where the content was accessible may deal with damage occurring within that territory. (EUR-Lex)

Importance

For information warfare, this is extremely important.

A victim does not necessarily have to sue only where the information operator is physically located.

Principle:

Online personality-right infringement can create jurisdiction at the victim's centre of interests.

7. Case 2 — Bolagsupplysningen OÜ v Svensk Handel AB

Case C-194/16, CJEU, 17 October 2017

This case concerned an Estonian company that claimed that incorrect and damaging information had been published about it on a Swedish website.

The information allegedly described the company as engaging in fraud and deceit, and the website contained numerous comments. (EUR-Lex)

The CJEU held that a legal person whose personality rights are allegedly infringed by incorrect internet information can bring proceedings for:

rectification;

removal of harmful comments; and

compensation for all damage

before the courts of the Member State where its centre of interests is located.

The Court also explained that the centre of interests of a company may depend upon where it conducts the main part of its activities, rather than simply its registered office. (EUR-Lex)

Importance

This is especially relevant to corporate information warfare.

A company attacked by a cross-border campaign can potentially establish jurisdiction by demonstrating where its real commercial reputation and activities are concentrated.

8. Case 3 — Glawischnig-Piesczek v Facebook Ireland

Case C-18/18, CJEU, 3 October 2019

This case concerned defamatory material posted on Facebook.

The central issue was whether a court could order a hosting provider to remove not merely the original unlawful statement but also:

identical material; and

materially equivalent unlawful material.

The CJEU recognised that national courts can, in appropriate circumstances, require a hosting provider to terminate or prevent an infringement and can impose measures concerning identical or equivalent content. At the same time, EU law does not establish a general obligation on platforms to monitor everything proactively. (EUR-Lex)

Importance for information warfare

This case is highly relevant where an information campaign repeatedly republishes substantially the same unlawful allegation.

The remedy can therefore move beyond:

“delete this one post”

towards:

“prevent recurrence of the same unlawful content.”

That is particularly significant for coordinated online campaigns.

9. Case 4 — L'Oréal SA v eBay International AG

Case C-324/09, CJEU, 12 July 2011

This case concerned intermediary liability in the online environment.

The CJEU examined the circumstances in which an online platform could rely upon intermediary protections under the E-Commerce Directive.

A particularly important distinction is between a genuinely neutral intermediary and an operator playing an active role that gives it knowledge of or control over the information.

That distinction was subsequently reflected in later CJEU jurisprudence concerning online platforms. (EUR-Lex)

Importance

In an information-warfare case, simply saying:

“We are only a platform”

does not necessarily resolve the liability question.

The court may examine the platform's actual role, knowledge and control.

10. Case 5 — YouTube/Cyando

Joined Cases C-682/18 and C-683/18, CJEU, 22 June 2021

These cases examined liability of online platforms for unlawful user-uploaded content.

The CJEU considered whether platform operators could benefit from the intermediary liability regime and emphasised the importance of whether their activity remained genuinely technical, automatic and passive. (EUR-Lex)

The Court's reasoning reinforces the importance of distinguishing:

passive hosting

from

active involvement in unlawful content dissemination.

Importance for information warfare

Modern information operations may involve platforms that:

recommend content;

organise content;

monetise it;

amplify it;

facilitate its distribution.

The precise legal consequences depend on the applicable EU and national legal framework, but the nature of the intermediary's role remains a central issue.

11. Case 6 — Delfi AS v Estonia

Application No. 64569/09, ECtHR Grand Chamber, 16 June 2015

This is an important European human-rights authority concerning intermediary liability.

Delfi operated a major Estonian news portal. Users posted offensive and threatening comments beneath an article concerning a ferry company.

The Estonian courts imposed liability on the portal for some of those comments.

The ECtHR Grand Chamber examined the issue under Article 10 ECHR, balancing freedom of expression against the rights and reputation of others.

The case is particularly important because it concerned the liability of a commercially operated news portal for user-generated comments.

Importance

The case demonstrates that intermediary liability cannot be analysed solely through ordinary publisher liability.

Courts can consider factors such as:

the nature of the platform;

the seriousness of the comments;

whether the comments constituted hate speech or direct threats;

the measures available to the operator;

the interests of victims; and

proportionality of the sanction.

It therefore provides an important European human-rights dimension to information-war litigation.

12. Case 7 — Magyar Tartalomszolgáltatók Egyesülete and Index.hu Zrt v Hungary

Application No. 22947/13, ECtHR, 2 February 2016

This case concerned comments posted on Hungarian internet portals concerning the business practices of a real-estate company.

The domestic courts had imposed liability on the operators for some user comments.

The ECtHR examined the balance between:

commercial reputation;

freedom of expression; and

intermediary responsibility.

The Court distinguished this situation from cases involving exceptionally serious threats or hate speech and placed considerable emphasis on proportionality.

Importance

The case shows that not every offensive or damaging online comment automatically produces civil liability for the intermediary.

The circumstances of the content and the intermediary's role matter.

13. Case 8 — Shevill v Presse Alliance SA

Case C-68/93, CJEU, 7 March 1995

Although this case predates modern social media, it remains important for cross-border defamation.

The CJEU addressed jurisdiction for defamatory newspaper publications distributed in several Member States.

It established a territorial approach under which:

the publisher could be sued in the publisher's jurisdiction for the overall damage; and

courts in individual places where the publication was distributed could deal with damage occurring in that territory.

The later eDate judgment adapted this logic to the special characteristics of internet publication. The CJEU itself expressly referred to Shevill when developing the internet framework. (EUR-Lex)

Importance

Shevill provides the historical foundation for understanding why internet defamation required a modified jurisdictional approach.

14. Case 9 — Google France and Google

Joined Cases C-236/08 to C-238/08, CJEU, 23 March 2010

The Google France cases concerned online advertising and intermediary liability.

The CJEU examined when an internet service provider could rely upon the intermediary protections of the E-Commerce Directive.

The Court's reasoning contributed to the distinction between a provider performing a passive technical function and an operator exercising a more active role.

This distinction was later used in cases such as L'Oréal v eBay and YouTube/Cyando. (EUR-Lex)

Information-warfare relevance

Where an information campaign uses advertising systems, search services or other online intermediaries, the legal character of the intermediary's activity becomes important.

15. Case 10 — Hejduk v EnergieAgentur.NRW GmbH

Case C-441/13, CJEU, 22 January 2015

This case concerned copyright infringement through online publication of photographs.

Although it was an intellectual-property case rather than an information-warfare case, it is useful for understanding territorial online harm.

The CJEU recognised that accessibility of online material can create jurisdiction concerning damage occurring in the territory concerned.

The decision forms part of the wider CJEU jurisprudence concerning online harm and territorial jurisdiction, subsequently considered in personality-right cases. (EUR-Lex)

Importance

It demonstrates that different areas of civil law increasingly require special jurisdictional rules for internet-based harm.

16. Main Legal Issues in Cross-Border Information Warfare

A. False information

A claimant may argue that information was:

objectively false;

presented as fact;

published without reasonable basis;

deliberately fabricated; or

deliberately manipulated.

The claimant must still satisfy the relevant national substantive-law requirements.

B. Defamation

Defamation may arise where information unlawfully damages:

an individual's reputation;

a company's commercial reputation;

professional standing; or

business relationships.

Cross-border defamation creates special jurisdictional problems because the same publication may be accessible throughout Europe.

C. Corporate reputation

Companies can also suffer information-war damage.

Examples:

“Company X is fraudulent.”

“Company Y illegally manipulates its accounts.”

“Company Z sells unsafe products.”

If false and unlawfully published, such allegations can potentially generate claims under the relevant national law.

Bolagsupplysningen is particularly important because the CJEU expressly recognised jurisdiction concerning damage to a legal person's personality rights. (EUR-Lex)

17. Economic Loss

Civil liability can extend beyond reputation.

A claimant may allege:

False information → customers lose confidence → contracts cancelled → financial loss.

Possible heads of damage may include:

lost profits;

lost contracts;

business interruption;

loss of goodwill;

loss of customers;

professional damage;

mitigation expenses.

However, economic damages normally require sufficiently established causation.

A court will ask:

Was the financial loss actually caused by the unlawful information?

This can be difficult when the information has been widely reproduced.

18. Causation in Information Warfare

Causation may be represented as:

Information → publication → audience exposure → reliance/reaction → injury

But modern campaigns may look like:

Actor A → fake content → Platform 1 → Bot network → Platform 2 → Media outlet → Customers → economic loss

The claimant therefore may have to identify:

original content;

subsequent republication;

responsible actors;

relevant audiences;

actual exposure;

resulting conduct; and

resulting loss.

19. Platform Liability

A major issue is whether liability should fall on:

Primary author

The person who created the false information.

Publisher

The entity that intentionally published it.

Platform

The service that hosted or distributed it.

Amplifier

An actor deliberately increasing its reach.

Automated system

Algorithmic recommendation or amplification may raise difficult questions concerning causation and responsibility.

The legal position differs according to the applicable EU and national rules.

20. Removal and Injunctions

Civil remedies can include:

damages;

injunctions;

deletion;

correction;

rectification;

cessation of publication;

prevention of repetition;

disclosure of information concerning the responsible actor.

Glawischnig-Piesczek is especially important because the CJEU accepted the possibility of orders covering identical and equivalent unlawful content. (EUR-Lex)

However, remedies must remain consistent with applicable fundamental rights and procedural safeguards.

21. Cross-Border Evidence

Information-war litigation frequently requires evidence from several countries.

Examples:

IP records;

account registration data;

server logs;

platform communications;

advertising records;

payment information;

metadata;

emails;

screenshots;

archived webpages;

blockchain records;

expert evidence.

A major practical difficulty is that the evidence may be controlled by an entity located in another jurisdiction.

22. Anonymous Actors

Civil proceedings may sometimes begin against an unidentified perpetrator.

The claimant may need judicial procedures to obtain information capable of identifying:

account holders;

publishers;

domain owners;

advertisers;

intermediaries;

persons controlling anonymous accounts.

The availability of such relief depends heavily on national procedural law and applicable privacy/data-protection requirements.

23. Data Protection Dimension

Information warfare may also involve personal data.

For example:

publication of personal information;

unlawful profiling;

publication of private records;

doxxing;

misuse of photographs;

dissemination of identifying information.

Such conduct may potentially create overlapping claims involving:

personality rights + privacy + data protection + tort/delict.

These claims should not automatically be treated as identical because they have different legal elements.

24. Information Warfare Against Businesses

A company could face a coordinated campaign involving:

fabricated allegations;

fake customer reviews;

impersonation;

manipulated financial information;

fake regulatory documents;

misleading social-media posts;

coordinated complaints;

targeted publication to investors.

The company may potentially seek:

removal;

correction;

injunction;

damages;

identification of responsible persons;

preservation of evidence.

Bolagsupplysningen provides particularly useful guidance for a company seeking comprehensive relief in a cross-border internet dispute. (EUR-Lex)

25. Information Warfare Against Individuals

Individuals may suffer:

reputational injury;

employment consequences;

loss of professional opportunities;

harassment;

privacy invasion;

psychological or non-material harm;

threats;

financial consequences.

The eDate jurisdictional principle is particularly important because the victim's centre of interests can provide a forum for an action concerning all EU damage. (EUR-Lex)

26. Civil Liability vs Criminal Liability

These should be separated.

Criminal proceedings

The State prosecutes conduct such as:

fraud;

threats;

cyber offences;

terrorism-related conduct;

unlawful interference.

Civil proceedings

A private claimant seeks:

compensation;

injunction;

removal;

rectification;

protection of reputation.

Administrative proceedings

Authorities may also impose regulatory measures.

One information operation can therefore produce criminal, civil and administrative proceedings simultaneously.

27. Role of Intent

Intent can be especially important in an information-warfare scenario.

Compare:

Scenario 1

A journalist publishes an incorrect statement after reasonable investigation.

Scenario 2

An individual knowingly fabricates evidence and distributes it to damage a competitor.

Scenario 3

A platform unknowingly hosts a user's statement.

The civil consequences may differ substantially because the relevant national laws may attach different significance to:

knowledge;

intent;

negligence;

recklessness;

notice;

failure to remove;

active participation.

28. The "Information → Damage" Model

For examination purposes, remember:

Information

↓

Publication

↓

Wrongfulness

↓

Cross-border dissemination

↓

Victim / protected interest

↓

Damage

↓

Causation

↓

Jurisdiction

↓

Applicable law

↓

Liability

↓

Remedy

This is the basic analytical structure.

29. Important Defences

A defendant may argue:

Truth

The information was substantially true.

Opinion

The statement represented opinion rather than an objectively verifiable fact.

Public interest

The publication contributed to legitimate public debate.

Freedom of expression

The claim improperly restricts protected expression.

Lack of causation

The alleged information did not actually cause the claimed loss.

Lack of knowledge

An intermediary did not know about unlawful material.

Passive intermediary

The defendant merely provided technical hosting or transmission.

Proportionality

The requested injunction is excessively broad.

Jurisdiction

The chosen court lacks jurisdiction over the dispute or particular damage.

30. Territoriality Problem

A particularly difficult question is:

How far should a European civil judgment concerning internet information extend?

There are potentially three approaches:

Territorial

Remove information only in the relevant country.

European

Apply the order throughout the EU/EEA where legally appropriate.

Global

Require removal or restriction worldwide.

Glawischnig-Piesczek demonstrates that the territorial scope of online injunctions can raise difficult questions under EU law; the CJEU did not treat the E-Commerce Directive as imposing an automatic worldwide limitation on national measures. (EUR-Lex)

31. Important Distinction: Information Warfare Is Not Automatically Tortious

This is an important legal qualification.

Not every:

propaganda campaign;

political statement;

inaccurate statement;

controversial opinion;

criticism;

satire;

media report

creates civil liability.

A civil court must identify a recognised legal right or interest and apply the relevant substantive law.

Therefore:

“Information warfare” describes the factual context.

Civil liability comes from the applicable legal wrong.

32. Key Case-Law Principles

33. Most Important Six Cases for Examination

If only six cases are required, remember:

Shevill v Presse Alliance SA — C-68/93

Cross-border defamation jurisdiction.

eDate Advertising and Martinez — C-509/09 & C-161/10

Internet personality rights and centre of interests. (EUR-Lex)

Bolagsupplysningen — C-194/16

Corporate reputation and comprehensive cross-border remedies. (EUR-Lex)

Glawischnig-Piesczek — C-18/18

Removal of identical/equivalent unlawful online material. (EUR-Lex)

L'Oréal v eBay — C-324/09

Active versus passive intermediary.

Delfi AS v Estonia — 64569/09

Intermediary liability balanced against freedom of expression.

34. Exam-Oriented Legal Formula

Cross-Border Information Warfare Civil Liability

Information campaign

→ Wrongful publication

→ Protected right

→ Victim

→ Cross-border dissemination

→ Jurisdiction

→ Applicable substantive law

→ Causation

→ Damage

→ Intermediary responsibility

→ Injunction/removal

→ Compensation

→ Enforcement

35. Short Revision Notes

Meaning

Civil liability arising from unlawful cross-border dissemination or manipulation of information.

Main wrongs

defamation;

personality-right infringement;

privacy violation;

commercial reputation damage;

economic loss;

unlawful interference.

Main problems

anonymous perpetrators;

multiple jurisdictions;

viral republication;

platform liability;

causation;

evidence;

applicable law;

enforcement.

Important CJEU cases

Shevill → eDate → Bolagsupplysningen → Glawischnig → L'Oréal → YouTube/Cyando

Important ECtHR cases

Delfi → MTE and Index.hu

Conclusion

Cross-border information warfare civil liability in Europe is primarily a combination of traditional civil liability and modern internet private international law. The central questions are not simply whether information was harmful, but whether it was legally wrongful, where the resulting damage occurred, which court has jurisdiction, which national law applies, whether an intermediary can be held responsible, and what remedy is proportionate.

The CJEU's jurisprudence has progressively adapted traditional territorial rules to internet publication. eDate established the importance of the victim's centre of interests; Bolagsupplysningen extended the logic to legal persons and comprehensive remedies; and Glawischnig-Piesczek addressed preventive removal of repeated unlawful content. (EUR-Lex)

The overall principle can therefore be remembered as:

Cross-border information harm → identify the protected right → establish jurisdiction → determine applicable law → prove wrongfulness, causation and damage → determine intermediary responsibility → obtain proportionate civil remedies.