General international law does not confine countermeasures to those with the same means as the preceding internationally wrongful act in response to which they are taken. Japan considers that this is the same for the countermeasures against internationally wrongful acts in cyberspace. The Government of Japan is of the view that a State may invoke necessity under international law when the requirements shown in Article 25 of the ILC’s Articles on State Responsibility are satisfied. (4) Due diligence States have a due diligence obligation regarding cyber operations under international law. Norm 13(c) and (f) and the second half of paragraph 28(e) of the 2015 GGE report are related to this obligation. In the Corfu Channel case (1949), the ICJ referred to the existence of "every State’s obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States".11 In relation to cyber operations, the due diligence obligation in this sense has significance. Furthermore, with regard to the concept of the due diligence obligation, the Alabama Arbitral Award (1872) held that “ due diligence ” ought to be exercised by neutral governments in exact proportion to the risks to which either of the belligerents may be exposed, from a failure to fulfil the obligations of neutrality on their part,12 and, in the Genocide Convention (Bosnia and Herzegovina v. Serbia and Montenegro) case (2007), the ICJ seems to consider the nature of the obligation to prevent genocide under the Genocide Convention to be the due diligence obligation and referred to an obligation of the contracting States to exercise the capacity to influence the actions of persons likely to commit genocide to prevent genocide so far as possible.13 The outer limit of the due diligence obligation of territorial States with respect to cyber operations is not necessarily clear. By reference to these judgements related to the concept of the due diligence obligation, it seems necessary to consider on a case-by-case-basis the scope of the obligation taking into account such factors as the seriousness of the cyber operations in question and the capacity of the territorial States to influence a person or group of persons conducting the attacks. In light of the above, at the least, for example, when a State has received a credible notification from another State of the possibility that a person or group of persons located in its territory and receiving from it financial and other forms of support may be involved in a cyber operation that may cause serious adverse consequences, such as damage to a target State's critical infrastructure, the due diligence obligation owed by the informed 11 Corfu Channel case, Judgment of April 9th, 1949: I.C.J. Reports 1949, P.22. Alabama claims of the United States of America against Great Britain, RIAA, Vol XXIX, p.129 13 Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro), Judgment, I.C.J. Reports 2007, p. 221, paragraph 430. 12 5

Select target paragraph3