“26. In international law, \u2018due diligence\u2019 refers to a flexible standard of reasonable care against which State conduct can be assessed. This standard is found in different rules and regimes of international law, both general and specific. These rules usually require States to take action with a view to preventing, stopping or redressing different harms to certain protected persons or objects, irrespective of the author or source of the harmful act.\n <\/p>\n

27. Under customary international law, States have a general obligation \u2018not to allow knowingly its territory to be used for acts contrary to the rights of other States\u2019. This duty is a corollary of State sovereignty and requires States to protect the rights of other States in their territory. It may be breached when a State knows or should have known that an act contrary to the rights of another State originates or transits through its territory, and yet fails to take reasonable action to stop or prevent it, and the harm materializes. This means that States must strive to prevent State or non-State actors, including cybercriminals, from conducting cyber operations against the rights of other States.\n <\/p>\n

28. Costa Rica believes that this obligation applies online as it does offline. It covers acts that contravene the sovereign rights of another State, such as ransomware and cyber electoral interference, whether or not these are perpetrated by a State or a non-State actor. Though this does not entail a general monitoring obligation, States must exercise a reasonable degree of vigilance over their networks. They must also put in place certain basic protective measures in line with their capabilities and other obligations under international law. Examples of diligent behavior in the cyber context may include the enactment of cybercrime legislation, the notification of cyber incidents to the victim State, and the establishment of a Computer Emergency Response Team and National Points of Contact.\n <\/p>\n

29. In Costa Rica\u2019s view, States also have a general obligation to \u2018take all appropriate measures to prevent significant transboundary harm or at any event to minimize the risk thereof\u2019, where such harm originates from their territory or jurisdiction and significantly affects persons, property, or the environment in other States. This customary obligation applies to the physical consequences of significant transboundary harms beyond the ecological environment, whether or not the activity causing the harm is lawful or not under international law. Costa Rica also believes that this duty applies to non-physical harms to persons, property or the environment, including those caused through or to ICTs. Examples include instances of online incitement to violence, hostility or discrimination and disinformation campaigns causing harm to individuals, irrespective of whether they are contrary to a State\u2019s sovereign or other rights.\n <\/p>\n

As for ensuring cyber security worldwide, the Czech Republic would like to point out one very important element – application of due diligence to the use of ICTs. As already mentioned by some of my colleagues in the segment on international law, and as recognized by the Czech Republic, States have a legal obligation to act against unlawful and harmful cyber activities emanating from their territory or conducted through cyber infrastructure under their governmental control, provided that they are aware of, or should reasonably be expected to be aware of, such activities. This is not an obligation of result, but rather an obligation of conduct. And here lies the key problem and link to capacity building.\n <\/p>\n

“Denmark is of the view that a State may bear international responsibility where a State fails to take adequate measures against a non-State actor – or third State – that conducts harmful cyber operations against another State from its territory or other cyber infrastructure under its effective control.\n <\/p>\n

As the ICJ Stated in the Corfu Channel<\/i> Case[7], States are under an \u201cobligation not to knowingly allow its territory to be used for acts contrary to the right of other States\u201d. This obligation is a natural corollary of a State\u2019s sovereignty over persons and cyber infrastructure on its territory.\n <\/p>\n

As a general rule due diligence requires States to take all reasonable measures to prevent, eliminate and mitigate potentially significant harm to legally protected interests of another State, or the international community as a whole. The general principle of due diligence has developed with some variation in different fields of international law, including international environmental law, transboundary harm, and human rights. Similarly, Denmark believes that the precise contours of the due diligence obligation in cyberspace will continue to develop and crystalize in the coming years. It is, however, possible to set out some key features.\n <\/p>\n

Due diligence is an obligation of conduct, not of result. A State is obliged to take all reasonable measures to stop or prevent a given cyber act from occurring. Not all harmful cyber operations emanating from another State\u2019s territory entail due diligence obligations and corresponding rights of the target State. While there is still scope for State practice to clarify the precise threshold, Denmark subscribes to the view that the harm suffered must be significant and not merely amount to inconveniences or minor disruptions.\n <\/p>\n