Cyberspace, Non-State Actors and the Obligation to Prevent Transboundary Harm

Abstract

That states are subject to an obligation to prevent their cyber infrastructure from being used in a manner injurious to the international legal rights of other states is well established in customary international law. This obligation imposes a dual duty upon states. The first duty is an obligation of result insofar as it requires states to implement the laws and institutions necessary to prevent and punish malicious cyber conduct emanating from their territory, although international law confers upon states a wide margin of appreciation in deciding the design and content of such measures. The second duty is an obligation of conduct in the sense that where a threat emanates from their cyber infrastructure and states have (actual or constructive) knowledge of that threat they must act reasonably in utilising their capacity and resources to suppress it. What is reasonable in the circumstances will depend upon various factors operating at the time such as the resources available to the state and the risks involved in the particular activity. Taken together, these duties construct an international legal obligation which offers states a certain degree of protection from malicious transboundary cyber conduct committed by non-state actors. However, the conclusion of an international treaty or several international treaties dealing with specific cyber threats will be crucial to achieving a secure cyberspace.

Due Diligence Obligations and Transboundary Environmental Harm: Cybersecurity Applications

“…Further extension of this theory may be possible, that is, even transiting states whose cyberinfrastructure is being used in their territories for malicious cyber conduct have an obligation to prevent their territories from being used by referencing the ICJ Nicaragua case 28 , in which their territory was used as a trafficking route for military equipment (Buchan 2016). However, a challenge in cyberspace is that identifying the source is extremely difficult, if not impossible, when it is malicious (Gross 2015), while it is contrarily claimed that the attribution of malicious actions is becoming increasingly possible for a few countries that possess advanced technologies (Lewis 2016).…”

“…Cyberspace is also not immune from state sovereignty claims, and states have imposed the obligation to prevent transboundary harm toward activities occurring within their sovereign territory (Buchan 2016). In terms of state responsibility, on the one hand, neighboring countries are likely to suffer in the case of environmental issues, such as water pollution, or it may take time in the long term to suffer or recover from negative consequences, such as nuclear disaster and climate change.…”

“…Indeed, the states' duty to better monitor the Internet in their respective territories is triggered by the state sovereignty principle (Jolley 2017). While such monitoring may lead to concerns in relation to privacy, states are also under obligation to respect the right to privacy when monitoring activities, as it was confirmed in the Genocide case 34 and the UN General Assembly 35 (Buchan 2016).…”

“…This results in the principle of due diligence being an obligation of conduct, rather than an obligation to achieve a result (Kulesza 2016); that is, states are not required to achieve specific results as long as states exercise the best possible efforts to obtain the results. If a state fails to take "all reasonable or necessary measures to prevent" harm, then the states are liable for their conduct, not the result of harm (Buchan 2016).…”

Emanations of the informational state: Cyber operations and the difficulties

“…According to Buchan (2016), harmful transborder cyber operations by non-state actors actually exceed those of states. 7 In the United States, there is a similar distinction between the legal treatment of symbolic political speech that is protected and that which is not based on whether or not the speech interferes with institutional processes.…”