Due diligence: Difference between revisions
m fixed the hyperlink to Corfu Channel |
|||
Line 12: | Line 12: | ||
Due diligence does not entail a duty of prevention,<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 6, para 5.</ref> but rather an obligation of conduct.<ref>Cf. ''[https://www.icj-cij.org/files/case-related/91/091-20070226-JUD-01-00-EN.pdf Case Concerning Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro)]'' (Judgement) [2007] ICJ Rep 43, para 430; see further James Crawford, ''State Responsibility: The General Part'' (CUP 2013) 226–32 (on the distinction between due diligence and obligations of prevention); Rudiger Wolfrum, ‘Obligation of Result Versus Obligation of Conduct: Some Thoughts About the Implementation of International Obligations’ in Mahnoush H Arsanjani et al, ''Looking to the Future: Essays on International Law in Honor of Michael Reisman'' (Brill 2010).</ref> A State breaches its due diligence obligation in the presence of the following cumulative elements: |
Due diligence does not entail a duty of prevention,<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 6, para 5.</ref> but rather an obligation of conduct.<ref>Cf. ''[https://www.icj-cij.org/files/case-related/91/091-20070226-JUD-01-00-EN.pdf Case Concerning Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro)]'' (Judgement) [2007] ICJ Rep 43, para 430; see further James Crawford, ''State Responsibility: The General Part'' (CUP 2013) 226–32 (on the distinction between due diligence and obligations of prevention); Rudiger Wolfrum, ‘Obligation of Result Versus Obligation of Conduct: Some Thoughts About the Implementation of International Obligations’ in Mahnoush H Arsanjani et al, ''Looking to the Future: Essays on International Law in Honor of Michael Reisman'' (Brill 2010).</ref> A State breaches its due diligence obligation in the presence of the following cumulative elements: |
||
# The existence of acts (by a non-State actor or a third State) contrary to the rights of a victim State,<ref>''[https://www.icj-cij.org/files/case-related/1/001- |
# The existence of acts (by a non-State actor or a third State) contrary to the rights of a victim State,<ref>''[https://www.icj-cij.org/files/case-related/1/001-19490409-JUD-01-00-EN.pdf Corfu Channel]'' judgment, para 22; [https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 6, para 2 and 15.</ref> |
||
# which are conducted from or through the territory of the potentially responsible State (or from or through the territory or cyber infrastructure under its control),<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], rule 6.</ref> |
# which are conducted from or through the territory of the potentially responsible State (or from or through the territory or cyber infrastructure under its control),<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], rule 6.</ref> |
||
# which would have been unlawful if conducted by the potentially responsible State,<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 6, para 18-24.</ref> |
# which would have been unlawful if conducted by the potentially responsible State,<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 6, para 18-24.</ref> |
Revision as of 18:51, 29 April 2020
Definition
Due diligence |
---|
It is the matter of some controversy whether the principle of due diligence reflects a binding obligation applicable to cyber operations.[3] It has also been proposed that in the cyber context, it is preferable to construe due diligence as a standard of attribution rather than as a standalone primary rule of international law.[4] Nevertheless, the present analysis proceeds on the basis that as a matter of lex lata, due diligence constitutes a general international obligation for every State not to knowingly allow its territory to be used for internationally wrongful acts using cyber means. This view has also been unanimously endorsed by the drafters of the Tallinn Manual 2.0.[5] Due diligence does not entail a duty of prevention,[6] but rather an obligation of conduct.[7] A State breaches its due diligence obligation in the presence of the following cumulative elements:
|
Appendixes
See also
- Scenario 05: State investigates and responds to cyber operations against private actors in its territory
- Scenario 06: Cyber countermeasures against an enabling State
- Scenario 07: Leak of State-developed hacking tools
- Scenario 14: Ransomware campaign
Notes and references
- ↑ Corfu Channel Case (UK v Albania) (Merits) [1949] ICJ Rep 4, 22.
- ↑ UN GA Res 55/63 (4 December 2000), Doc A/RES/55/63, para 1(a).
- ↑ Cf. UN GGE 2015 report, paras 13(c) and 28(e) (using non-mandatory language to express the due diligence principle in the cyber context: “States should not knowingly allow their territory to be used for internationally wrongful acts using [cyber means]” and “States ... should seek to ensure that their territory is not used by non-State actors to commit such acts”, respectively) (emphases added).
- ↑ See Luke Chircop, ‘A Due Diligence Standard of Attribution in Cyberspace’ (2018) 67 ICLQ 643.
- ↑ Tallinn Manual 2.0, commentary to rule 6, para 4.
- ↑ Tallinn Manual 2.0, commentary to rule 6, para 5.
- ↑ Cf. Case Concerning Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro) (Judgement) [2007] ICJ Rep 43, para 430; see further James Crawford, State Responsibility: The General Part (CUP 2013) 226–32 (on the distinction between due diligence and obligations of prevention); Rudiger Wolfrum, ‘Obligation of Result Versus Obligation of Conduct: Some Thoughts About the Implementation of International Obligations’ in Mahnoush H Arsanjani et al, Looking to the Future: Essays on International Law in Honor of Michael Reisman (Brill 2010).
- ↑ Corfu Channel judgment, para 22; Tallinn Manual 2.0, commentary to rule 6, para 2 and 15.
- ↑ Tallinn Manual 2.0, rule 6.
- ↑ Tallinn Manual 2.0, commentary to rule 6, para 18-24.
- ↑ Tallinn Manual 2.0, rule 6.
- ↑ Tallinn Manual 2.0, commentary to rule 6, para 37-42.
- ↑ Tallinn Manual 2.0, commentary to rule 6, para 43; commentary to rule 7, para 2 and 18.