parties. It is recommended that states hold private actors who enable or facilitate these acts to account.xiv For example, where there has been misuse of personal data in political campaigns, companies should be investigated and brought to account.xv  In addition, the targeting of individuals, including human rights defenders and journalists, using surveillance technology has been shown to lead to “arbitrary detention, sometimes to torture and possibly to extrajudicial killings”.xvi States should address the human rights abuses within their territory and/or jurisdiction which occurs as a result of the practices of the largely unregulated private surveillance industry. Seven recommendations to states, including the imposition of an immediate moratorium on the export, sale, transfer, use or servicing of privately developed surveillance tools until a human rights compliant safeguards regime is in place, are included in the Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression (A/HRC/41/35).xvii  Due diligence is linked to the principle of state sovereignty. When applied to cyber operations, this principle would oblige a state to not knowingly allow its territory or the ICT infrastructure under its control to be used for cyber operations that affect the rights of other states. Because cyber operations can harm and infringe upon the human rights of individuals in other states makes the principle of due diligence imperative from a human rights perspective. Although it might be practically difficult to prove the “knowledge” element of this principle, as states can plausibly deny having actual or constructive knowledge of such activities, this does not render the legal obligation moot (see “Global Partners Digital, Unpacking the GGE’s framework on responsible state behaviour: international law”). Institute for International Cyber Stability  This norm was not included in the section of the UN GGE 2015 report titled “How International Law Applies to the Use of ICTs” but rather in the section on “Norms, Rules and Principles.” As such it is not clear whether all signing States agreed that this norms is based on international law. In order to increase the achievement of the implementation of this norm all States should first provide their position on whether this norms is based in international law. Assuming that some States’ positions will be that it is not based in binding international law then in order to assist in the implementation of this non-binding norm States should codify domestic law that would criminalize any actions. Second, there should be an education campaign for States that need assistance in building the domestic legal framework for this while educating the prosecutors and judges. International sharing of information through a process like the MLATs needs to be instituted for investigations in order to gather the relevant information concerning the cases at issue. And lastly, each State should take reasonable steps to ensure that its own infrastructures are secure. This can be done by passing domestic regulation requiring a certain level of cybersecurity or by developing voluntary standards for cybersecurity such as the NIST standards in the US. Tech Accord  First and foremost, states should develop comprehensive cybercrime laws to ensure that offences emanating from their territory can be prosecuted. Cybersecurity Tech Accord signatories would encourage state to leverage internationally established framework, such as the Budapest Convention on Cybercrime for this purpose.  Secondly, states should invest in capacity building for law enforcement and the judiciary to ensure that cybercriminals can be effectively prosecuted.  Thirdly, states should ensure that they are able to share and receive information surrounding a particular incident. In addition to recommendations outlined in the response to norm d), we encourage governments to ensure that their CERTs are part of international networks, such as the global Forum of Incident Response and Security Teams (FIRST) or similar initiatives.  Finally, states should promote cyber hygiene practices and thereby reduce the vulnerable attack surface. These could range from promoting patching, to adoption of Domain-based Message Authentication, Reporting & Conformance (DMARC), or Mutually Agreed Norms for Routing Security (MANRS). @DFAT DFAT.GOV.AU