Territorial jurisdiction is the authority of a state to prescribe and enforce laws over all acts committed on its territory and over all persons present within its land, sea, and airspace, as derived from state sovereignty. It cannot be invoked for offences committed entirely abroad merely because the offender later enters the state. The principle applies equally to cyber activities and infrastructure located within the territory, as recognised in the Tallinn Manual 2.0.

Two approaches address cross-border conduct: objective territoriality, where an offence is completed on the state’s territory, and subjective territoriality, where an offence is initiated or planned there — the latter being crucial in combatting transnational crime. It remains disputed whether territoriality extends to extraterritorial acts with only economic effects, as reflected in the contested U.S. effects doctrine, which has been resisted by European states and narrowed in scope. In the cyber domain, the Tallinn Manual 2.0 accepts jurisdiction based on substantial effects but requires it be exercised reasonably and with due regard for other states.