Czech Republic    States should not conduct or knowingly support cyber activity that would harm medical services or medical facilities, and should take measures to protect medical services from harm.6 the need to comply with existing obligations under international human rights law when considering, developing and applying national cybersecurity policies and legislation.7 the need to incorporate perspectives from all relevant and affected stakeholders at the earliest stage of cyber security policy development to ensuring a holistic consideration of the implications of cybersecurity measures for human rights.8 Ecuador  Guidance on norm 13.b (GGE 2015)9: i) States could establish the national structures, policies, processes and coordination mechanisms necessary to facilitate careful consideration of severe ICT incidents and to determine appropriate responses; ii) then States could develop ICT incident assessment or severity templates to evaluate and assess ICT incidents; iii) transparency about and harmonisation of such templates by regional organisations could ensure commonality in how States consider ICT incidents and improve communication between States; iv) when considering all relevant information in the case of an ICT incident, States should conduct research on possible gendered impacts, and work inclusively with all stakeholders to understand the broader context of an ICT incident, including its impact on the enjoyment of women’s rights.  following guidance is proposed for the implementation of norm 13.c10: i) if a State identifies malicious cyber activity emanating from another State’s region or cyberinfrastructure, a first step could be notifying that State. Computer Emergency Response Teams (CERTs) are crucial to being able to identify such activity; ii) given that ICT incidents can emanate from or involve third States, it is understood that notifying a State does not imply responsibility of that State for the incident; iii) the notified State should acknowledge receipt of the request via the relevant national point of contact; iv) when a State has knowledge that its territory or cyberinfrastructure is being used for an internationally wrongful act that is likely to produce serious adverse consequences in another State, the former State should endeavour to take reasonable, available and practicable measures within its territory and capabilities, consistent with its domestic and international law obligations, to cause the internationally wrongful act to cease, or to mitigate its consequences; v) this norm should not be interpreted as requiring a state to monitor proactively all ICTs within its territory, or to take other preventive steps; vi) a State that becomes aware of harmful ICT activities emanating from its territory but lacks the capacity to respond may choose to seek assistance from other States, including through standard assistance request templates; vii)in such cases, assistance may be sought from other States, or from a private entity, in a manner consistent with national law. Commitment by states to cooperate with other nations and assist them in the event of a crisis is instrumental, particular emphasis should be made on the differentiated impact that an ICT incident on a specific Infrastructure could have in a developing country. https://www.icrc.org/en/document/norms-responsible-state-behavior-cyber-operations-should-buildinternational-law https://freedomonlinecoalition.com/wp-content/uploads/2020/02/FOC-Statement-on-Human-Rights-and-Cyber- Security07.02.pdf. 8 https://freedomonlinecoalition.com/wp-content/uploads/2020/02/FOC-Statement-on-Human-Rights-and-Cyber- Security07.02.pdf. 9 in case of ICT incidents, States should consider all relevant information, including the broader context of the event, the challenges of attribution in the ICT environment and the nature and extent of the consequences. 10 States should not knowingly allow their territory to be used for internationally wrongful act using ICTs. 6 7 2