Due diligence

== Definition ==
Due diligence
According to the traditional formulation by the ICJ in the Corfu Channel case, every State is under an “obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States”.Corfu Channel Case (UK v Albania) (Merits) [1949] ICJ Rep 4, 22. In the cyber context, the UN General Assembly urged States already in 2000 to “ensure that their laws and practice eliminate safe havens for those who criminally misuse information technologies”.UN GA Res 55/63 (4 December 2000), Doc A/RES/55/63, para 1(a). 
It is the matter of some controversy whether the principle of due diligence reflects a binding obligation applicable to cyber operations.Cf. UN GGE 2015 report, paras 13(c) and 28(e) (using non-mandatory language to express the due diligence principle in the cyber context: “States should not knowingly allow their territory to be used for internationally wrongful acts using [cyber means]” and “States ... should seek to ensure that their territory is not used by non-State actors to commit such acts”, respectively) (emphases added); See also UN Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security, A/76/135 (14 July 2021) paras 29-30. Some States have framed it within their national positions as one of the "voluntary, non-binding norms of responsible State behaviour"Dapo Akande, Antonio Coco and Talita de Souza Dias, ‘Old Habits Die Hard: Applying Existing International Law in Cyberspace and Beyond’, EJIL Talk! (5 January 2021) in cyberspace, including Israel,Roy Schöndorf, Israel’s Perspective on Key Legal and Practical Issues Concerning the Application of International Law to Cyber Operations (8 December 2020) 403-4. The position states that "we have not seen widespread State practice beyond this type of voluntary cooperation, and certainly not practice grounded in some overarching opinio juris, which would be indispensable for a customary rule of due diligence, or something similar to that, to form". New Zealand,New Zealand Foreign Affairs and Trade, ‘The Application of International Law to State Activity in Cyberspace’ (1 December 2020) 3. According to the position, "An agreed norm of responsible state behaviour provides that states should not knowingly allow their territory to be used for internationally wrongful acts using ICTs. Whether this norm also reflects a binding legal obligation is not settled". the United KingdomUnited Kingdom Foreign, Commonwealth & Development Office, ‘Application of international law to states’ conduct in cyberspace: UK statement’ (3 June 2021) para 12. According to the position: "the fact that States have referred to this as a non-binding norm indicates that there is not yet State practice sufficient to establish a specific customary international law rule of ‘due diligence’ applicable to activities in cyberspace". and Canada.Government of Canada, International Law applicable in cyberspace (April 2022) para. 26. According to the position, this does not "precludes the recognition of a binding legal rule of due diligence under customary international law. Canada continues to study this matter".
It has also been proposed that in the cyber context, it is preferable to construe due diligence as a standard of attribution rather than as a standalone primary rule of international law.See Luke Chircop, ‘A Due Diligence Standard of Attribution in Cyberspace’ (2018) 67 ICLQ 643. Nevertheless, the present analysis proceeds on the basis that as a matter of lex lata, due diligence constitutes a general international obligation for every State not to knowingly allow its territory to be used for internationally wrongful acts using cyber means.See also Tallinn Manual 2.0, commentary to rule 6, para 4 (unanimously endorsing this view). This view has also been endorsed by a growing number of States, including Australia,Australia, ‘Australia’s International Cyber Engagement Strategy - Annex A: Australia’s Position on How International Law Applies to State Conduct in Cyberspace’ (October 2017) 91, stating that “if a state is aware of an internationally wrongful act originating from or routed through its territory, and it has the ability to put an end to the harmful activity, that state should take reasonable steps to do so consistent with international law”. Czech Republic,Czech Republic, Comments submitted by the Czech Republic in reaction to the initial “pre-draft” report of the Open-Ended Working Group on developments in the field of information and telecommunications in the context of international security (undated), stating that “ICT-specific norms reflect a general principle of international law obliging States to ensure that territory and objects over which they enjoy sovereignty are not used to harm other States’ rights.” Estonia,Estonia, ‘President of the Republic at the opening of CyCon 2019’ (29 May 2019), stating that “states have to make reasonable efforts to ensure that their territory is not used to adversely affect the rights of other states.” Finland,Finland, ‘Statement by Ambassador Janne Taalas at the second session of the open-ended Working Group (OEWG) on developments in the field of information and telecommunications in the context of international security’ (11 February 2020), stating that “States have an obligation not to knowingly allow their territory to be used for activities that cause serious harm to other States, whether using ICTs or otherwise.” France,French Ministry of the Armies, ‘International Law Applied to Operations in Cyberspace’ (9 September 2019) 6, stating that “In compliance with the due diligence requirement, [France] ensures that its territory is not used for internationally wrongful acts using ICTs. This is a customary obligation for States, which must (i) use cyberspace in compliance with international law, and in particular not use proxies to commit acts which, using ICTs, infringe the rights of other States, and (ii) ensure that their territory is not used for such purposes, including by non-state actors.” Germany,Federal Government of Germany, ‘On the Application of International Law in Cyberspace’, Position Paper (March 2021) 3. Italy,Italian Ministry for Foreign Affairs and International Cooperation, ‘Italian position paper on International law and cyberspace’ (2021) 6-7. Japan,Ministry of Foreign Affairs of Japan, ‘Basic Position of the Government of Japan on International Law Applicable to Cyber Operations’ (28 May 2021) 5. the Netherlands,Dutch Ministry of Foreign Affairs, ‘Letter to the parliament on the international legal order in cyberspace’ (5 July 2019), stating that ‘The Netherlands ... does regard the principle [of due diligence] as an obligation in its own right, the violation of which may constitute an internationally wrongful act.’ Norway,‘Official compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States’ UNODA, A/76/136 (August 2021) 71-2. Switzerland,Federal Department of Foreign Affairs, ‘Switzerland's position paper on the application of international law in cyberspace’ (May 2021) 7. and Sweden.Government Offices of Sweden, ‘Position Paper on the Application of International Law in Cyberspace’ (July 2022) 4.
Due diligence does not entail a duty of prevention,Tallinn Manual 2.0, commentary to rule 6, para 5. but rather an obligation of conduct.Cf. Case Concerning Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro) (Judgement) [2007] ICJ Rep 43, para 430; see further James Crawford, State Responsibility: The General Part (CUP 2013) 226–32 (on the distinction between due diligence and obligations of prevention); Rudiger Wolfrum, ‘Obligation of Result Versus Obligation of Conduct: Some Thoughts About the Implementation of International Obligations’ in Mahnoush H Arsanjani et al, Looking to the Future: Essays on International Law in Honor of Michael Reisman (Brill 2010). A State breaches its due diligence obligation in the presence of the following cumulative elements:
# The existence of acts (by a non-State actor or a third StateWhile, in general, it is States, not individuals or private entities, which are able to violate international law, cyber operations carried out by individuals or private entities that nevertheless result in serious adverse consequences fall within a State’s due diligence obligation. See Tallinn Manual 2.0, commentary to rule 6, para 21.) contrary to the rights of a victim State,Corfu Channel judgment, para 22; Tallinn Manual 2.0, commentary to rule 6, para 2 and 15.
# which are conducted from or through the territory of the potentially responsible State (or from or through the territory or cyber infrastructure under its control),Tallinn Manual 2.0, rule 6.
# which would have been unlawful if conducted by the potentially responsible State,Tallinn Manual 2.0, commentary to rule 6, para 18-24.
# which have serious adverse consequences for the victim State,Tallinn Manual 2.0, rule 6.
# with respect to which the potentially responsible State has actual or constructive knowledge,Tallinn Manual 2.0, commentary to rule 6, para 37-42. and
# upon which the potentially responsible State can act, but fails to take all feasible measures.Tallinn Manual 2.0, commentary to rule 6, para 43; commentary to rule 7, para 2 and 18.
Publicly available common and national positions that address this issue include:
 (2024),
 (2024),
 (2020),
 (2024),
 (2022),
 (2021), 
 (2023),
 (2024),
 (2020),
 (2024), 
 (2023),
 (2019), 
 (2021), 
 (2019), 
 (2021),
 (2023), 
 (2020),
 (2021), 
 (2021), 
 (2019), 
 (2020), 
 (2021),
 (2022),
 (2021), 
 (2021),
 (2022), 
 (2021), 
 (2021),
 (2021).
==Common positions==
===African Union (2024)===
===European Union (2024)===
==National positions==
===Australia (2020) ===
===Austria (2024) ===
===Canada (2022)===
===China (2021)===
===Costa Rica (2023)===
===Cuba (2024)===
===Czech Republic (2020)===
===Czech Republic (2024)===
===Denmark (2023)===
===Estonia (2019)===
===Estonia (2021)===
===France (2019)===
===Germany (2021)===
===Ireland (2023)===
===Israel (2020)===
===Italy (2021) ===
===Japan (2021) ===
===Netherlands (2019)===
===New Zealand (2020)===
===Norway (2021) ===
===Poland (2022)===
===Romania (2021)===
===Singapore (2021) ===
===Sweden (2022)===
===Switzerland (2021)===
===United Kingdom (2021)===
===United States of America (2021)===
==Appendixes==
===See also===
*Scenario 05: State investigates and responds to cyber operations against private actors in its territory
* Scenario 06: Cyber countermeasures against an enabling State 
* Scenario 07: Leak of State-developed hacking tools
*Scenario 14: Ransomware campaign
*Scenario 23: Vaccine research and testing
===Notes and references===
===Bibliography and further reading===
Category:Due diligence
Category:Legal concepts