A/76/136 All Australian military capabilities are employed in line with approved targeting procedures. Cyber operations are no different. Australian targeting procedures comply with the requirements of IHL and trained legal officers provide decision-makers with advice to ensure that Australia satisfies its obligations under international law and its domestic legal requirements. For example, Australia considers that, if a cyber operation rises to the same threshold as that of a kinetic ‘attack under IHL’, the rules governing such attacks during armed conflict will apply to those kinds of cyber operations. 3. For cyber activities taking place outside of armed conflict, general principles of international law, including the law on state responsibility, apply. It is a longstanding rule of international law that, if a state acts in violation of an international obligation, and that violation is attributable to the state, that state will be responsible for the violation. The customary international law on state responsibility, much of which is reflected in the International Law Commission’s Articles on the Responsibility of States for Internationally Wrongful Acts, apply to state behaviour in cyberspace. To the extent that a state enjoys the right to exercise sovereignty over objects and activities within its territory, it necessarily shoulders corresponding responsibilities to ensure those objects and activities are not used to harm other states. In this context, we note it may not be reasonable to expect (or even possible for) a state to prevent all malicious use of ICT infrastructure located within its territory. However, in Australia’s view, if a state is aware of an internationally wrongful act originating from or routed through its territory, and it has the ability to put an end to the harmful activity, that state should take reasonable steps to do so consistent with international law. If a state is a victim of malicious cyber activity which is attributable to a perpetrator state, the victim state may be able to take countermeasures against the perpetrator state, under certain circumstances. However, countermeasures that amount to a use of force are not permissible. Any use of countermeasures involving cyberspace must be proportionate. It is acknowledged that this raises challenges in identifying and assessing direct and indirect effects of malicious cyber activity, in order to gauge a proportionate response. The purpose of countermeasures is to compel the other party to desist in the ongoing unlawful conduct. ATTACHMENT 2 2019 – SUPPLEMENT TO AUSTRALIA’S POSITION ON THE APPLICATION OF INTERNATIONAL LAW TO STATE CONDUCT IN CYBERSPACE In the International Cyber Engagement Strategy (2017) (Strategy), Australia committed to periodically publish its position on the application of relevant international law to state conduct in cyberspace. The first such publication appeared in Annex A to the Strategy. This document is the second publication and is aimed at further elaborating Australia’s position on applicable international law as expressed in the Strategy. As such, it should be read as a supplement to that document. Application and development of international law The Strategy recognised the well-established position that existing international law – including the UN Charter in its entirety – provides the framework for responsible state behaviour in cyberspace. The international community, including 14/142 21-09670