A/76/136 to civilian objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated. Australia, and other States parties to Additional Protocol I to the Geneva Conventions of 1949 are required under Article 36 to determine whether the employment of new weapons, or means or method of warfare, would, in some or all circumstances be prohibited by Additional Protocol I or any other rule of international law applicable to that State. A cyber capability could, in certain circumstances, constitute a ‘weapon, or a means or method of warfare’ within the meaning of Article 36 and require a review in accordance with Article 36 obligations. In armed conflict, Australian military capabilities are employed within a wellestablished system of command and control, within applicable legal frameworks, and subject to orders, directives and procedures. This includes approved targeting procedures. Cyber activities are no different. Where cyber actions or activities amount to an attack under IHL, as for conventional activities, Australian targeting procedures comply with the requirements of IHL. Trained legal officers are available to support Commanders with advice to ensure that Australia satisfies its obligations under international law and operates in accordance with its domestic legal requirements. International human rights law (IHRL) also applies to State conduct in cyberspace. Under IHRL, States have obligations to protect relevant human rights of individuals under their jurisdiction, including the right to privacy, where those rights are exercised or realised through or in cyberspace. Subject to lawful derogations and limitations, States must ensure without distinction individuals’ rights to privacy, freedom of expression and freedom of association online. 3. General principles of international law, including the law on State responsibility The customary international law on State responsibility, much of which is reflected in the International Law Commission’s Articles on the Responsibility of States for Internationally Wrongful Acts (ARSIWA), applies to State behaviour in cyberspace. Under the law on State responsibility, there will be an internationally wrongful act of a State when its conduct in cyberspace – whether by act or omission – is attributable to it and constitutes a breach of one of its international obligations. To the extent that a State enjoys the right to exercise sovereignty over objects and activities within its territory, it necessarily shoulders corresponding responsibilities to ensure those objects and activities are not used to harm other States. In this context, we note it may not be reasonable to expect (or even possible for) a State to prevent all malicious use of ICT infrastructure located within its territory. However, in Australia’s view, if a State is aware of an internationally wrongful act originating from or routed through its territory, and it has the ability to put an end to the harmful activity, that State should take reasonable steps to do so consistent with international law. States are entitled, in their sole discretion, and based on their own judgement, to attribute unlawful cyber activities to another State. States should act reasonably when drawing conclusions based on the facts before them. A cyber activity will be attributable to a State under international law where, for example, the activity was conducted by an organ of the State; by persons or entities exercising elements of governmental authority; or by non-State actors operating under the direction or control of the State. Australia recognises the need to distinguish between different attribution assessments, including factual attribution (which includes an assessment of technical and other contextual information) and legal attribution (that there has been a breach 21-09670 7/142