NORM “Non-state actors should not engage in offensive cyber operations and state actors should prevent and respond to such activities if they occur.” BACKGROUND While information and communication technologies have positively transformed societies, they also pose new security challenges. The speed and ubiquity of cyber operations often poses considerable difficulties to states’ judicial systems and international law enforcement cooperation. Despite these difficulties, it should be recalled that state sovereignty is the cornerstone of the rules-based international system of peace and security. States have a monopoly on the legitimate use of force, strictly bound by international law. Some non-state actors, mainly private companies, advocate for the right to conduct offensive cyber operations across national borders, potentially claiming that it constitutes “self defense” as states do not have the capacity to adequately protect them against cyber threats. These non-state actors’ offensive cyber operations are sometimes euphemistically referred to as “active cyber defense,”13 including but not limited to so-called “hack-back,” as they are conducted for defensive purposes. Some states are unable to control — or chose to actively ignore — these practices, despite the risk they impose upon the stability and security of 13 Active cyber defense should be understood as a set of measures ranging from self defense on the victim’s network to destructive activity on the attacker’s network. Offensive cyber operations within this continuum imply for the defender to act outside of its own network independently of their intention (offense or defense) and the legal qualification of their acts. Further work should be conducted on the definition of offensive cyber operations and active cyber defense. cyberspace. However, in most states such practices would be unlawful, if not criminalized, while in other states they appear to be neither prohibited nor explicitly authorized. A few states are, nevertheless, considering legitimizing non-state actors’ offensive cyber operations. Indeed, some have decided or proposed legislation to allow offensive operations by non-state actors in their domestic legislation. The Global Commission on the Stability of Cyberspace believes that these practices undermine the stability of cyberspace. They can result in serious disruption and damages, including for third parties, and are thus likely to trigger complex international legal disputes and escalate conflicts. States explicitly granting or knowingly allowing non-state actors the authorization to conduct offensive operations, for their own purposes or those of third parties, would set a dangerous precedent and would breach international law in most cases. The Commission believes that offensive measures should be reserved solely to states and recalls that international law establishes a strict and exclusive framework for international response to hostile acts that also applies to cyber operations. Similarly, under international law, non-state actors acting on behalf of states must be considered their agents and are therefore considered extensions of the state.14 If states permit such action, they may therefore be held responsible under international law.15 States must act, domestically and internationally, to prevent offensive cyber operations by non-states actors. 14 See ”additional note” for a wider treatment of the case within international law, available here: https://cyberstability.org/wp-content/uploads/2018/11/Additional-Note-to-theNorm-Against-Offensive-Cyber-Operations-by-Non-state-Actors-Norm-Package-Singapore.pdf. 15 Ibid. GLOBAL COMMISSION ON THE STABILITY OF CYBERSPACE NOVEMBER 2018 19