Full Protection and Security for Investors in Cyberspace:

Due Diligence Obligations and Developing States

Dao Kim Anh and Tran Duc Phu

 

ABSTRACT: This article examines whether the full protection and security (FPS) standard in international investment law can extend to cyber-attacks affecting foreign investors’ digital assets and digital business operations. It argues that such an extension is, in principle, doctrinally defensible, but that the content of the host State’s obligations must remain framed by due diligence. In the cyber context, due diligence cannot be assessed in abstract or uniform terms. Rather, the scope of the State’s obligations must be evaluated in light of its actual capacities, available resources, and institutional constraints, a consideration that is particularly important for developing countries facing structural limitations in cybersecurity infrastructure, technical expertise, and enforcement capabilities. The article further argues that the interpretation of FPS in cyberspace should take account of recent developments in international cybersecurity governance, including the United Nations Convention against Cybercrime (Hanoi Convention), as part of the broader framework relevant to assessing State conduct. On that basis, it proposes a more balanced reconciliation between investment protection and regulatory reality through three complementary avenues: clearer treaty practice, context-sensitive arbitral interpretation, and stronger capacity-building and technical assistance within international and regional cybersecurity frameworks. In this way, the article shows how FPS may be adapted to cyber risk without disregarding persistent inequalities in State capacity.