Scenario 1 – Cyber operations by State B on government systems and websites of State A State A undertakes major reforms to its domestic company law and tax code that are consistent with its international obligations. In order to implement the new laws – including to allow State A’s tax office and corporate regulator to monitor and enforce new requirements on companies – State A requires all registered companies to disclose certain information via a government website. State B opposes the reforms because it considers they unfairly impact on the interests of companies from State B operating in State A. In an attempt to prevent State A from implementing the reforms, State B, through its Department of Defence, conducts a series of cyber operations that prevent use of the website and disable government systems of State A’s tax office and corporate regulator. As a result, State A is incapable of regulating companies’ compliance with the new laws for a substantial period and has no choice but to indefinitely postpone implementation of the new tax reforms. State A also loses significant tax revenue. International law may assist State A in the following ways: First, it provides rules of legal attribution – contained in the customary international law on state responsibility, much of which is reflected in the International Law Commission's Articles on the Responsibility of States for Internationally Wrongful Acts – meaning that acts of the Department of Defence, as an organ of State B, would be attributable to State B. Second, it defines states’ rights and obligations, including the international law duty not to intervene in the internal affairs of another state (prohibited intervention). State B’s conduct could constitute a prohibited intervention on the basis that it was a coercive interference in matters which State A is entitled as a matter of state sovereignty to decide freely, including its economic system. However, establishing the aforementioned elements of prohibited intervention would depend on the circumstances, including the extent of economic damage and the loss of government control over economic policy. Third, if State B’s conduct violated international law, it would entitle State A to invoke the international legal responsibility of State B, and State A could demand that State B cease the unlawful act/s (if they were continuing) and make full reparation for State A’s injuries. Reparation could include restoring full access to relevant websites and providing compensation for any financially assessable damage. As international law governs the dispute, State A may seek to pursue resolution through legal as well as political avenues including, for example, by seeking a resolution consistent with the Charter of the United Nations, including Chapter VI (Pacific Settlement of Disputes),5 which could include referring the dispute to the International Court of Justice (ICJ) where the necessary preconditions had been met (including admissibility and jurisdiction). 5 For example: Article 33(1) of the UN Charter provides that “The parties to any dispute, the continuance of which is likely to endanger the maintenance of international peace and security, shall, first of all, seek a solution by negotiation, enquiry, mediation, conciliation, arbitration, judicial settlement, resort to regional agencies or arrangements, or other peaceful means of their own choice.” In Security Our Common Future: An Agenda for Disarmament (Office for Disarmament Affairs, 2018) the UN Secretary-General commits to “make available his good offices to contribute to the prevention and peaceful settlement of conflict stemming from malicious activity in cyberspace”. 2 www.dfat.gov.au/cyberaffairs