View source for Scenario 07: Leak of State-developed hacking tools

=== Breach of an international obligation by State A ===
==== Due diligence ====
{{#lst:Due diligence|Definition}}
'''[L4]''' In the present scenario, all the required elements would likely not be met. First, the leak of the hacking tools and failure to inform the software manufacturers from State A (incidents 1-2) could be contrary to the rights of third States, because it makes their cyber infrastructure more vulnerable to malicious activities. However, the leak is a fairly remote cause of the malicious activities, because an intervening act of a malicious actor is required; it is, therefore, questionable whether the consequence can still be attributed to State A (condition 1).

'''[L5]''' The leak utilised the computer systems (cyber infrastructure) of State A. However, it is questionable if the leak itself is the harmful activity: rather, the abuse of the hacking tools is. Nevertheless, even if cyber infrastructure is interpreted broadly to include software<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Glossary.</ref> such as some of the hacking tools originally developed by State A, these tools were nonetheless no longer under the sole control of State A when they were repurposed and used to cause harm to third parties (condition 2).

'''[L6]''' If State A had purposefully sold or transferred their hacking tools to a third party, be it a State or a non-State actor, it would be responsible for further operations utilizing the hacking tools only if these were [[attribution|attributable]] to State A – for instance, if State A also exercised direction and control over the non-State actor - and those operations amounted to a breach of an international legal obligation (condition 3).

'''[L7]''' The leak led to substantial losses, which might qualify as “serious adverse consequences” if they cause, for instance, serious disruptions of societal functions, but again, the leak is causally remote from these consequences (condition 4). 

'''[L8]''' State A knew about the leak. The scenario does not say since when exactly, but it is assumed that State A knew at the latest when the origin of the hacking tools was confirmed by independent researchers (condition 5).

'''[L9]''' State A did not inform the software manufacturers, which could have mitigated the consequences. This was an omission on its part to take all feasible measures in response to acts harmful to third parties (condition 6).

'''[L10]''' In sum, it would be difficult to determine a breach of the due diligence obligation by State A. The major stumbling blocks are the absence of an unqualified international obligation not to transfer State hacking tools to third parties (condition 3)<!--Q: This seems to be about attribution, not breach – am I missing something? A: In condition 3, we are trying to determine what kind of conduct would be illegal if done by a State. Therefore we must also look at the hypothetical attribution. I was trying to say that such conduct would only be illegal in specific circumstances, so there is no general obligation not to share the tools. See also the first question in the checklist.-->, remoteness of the causality (conditions 1 and 4), and the uncertainty about the seriousness of the adverse consequences (condition 4).