A/76/136 should be borne in mind that the criteria of attribution under international law do not necessarily correspond to those under domestic law and that additional or specific criteria are generally relevant when establishing State responsibility for individually attributed conduct. Moreover, the adoption of targeted restrictive measures against natural or legal persons, entities or bodies under the EU Cyber Sanctions Regime 110 does not as such imply the attribution of conduct to a State by Germany in a legal sense. 111 b) Measures of response (1) Retorsion A State may engage in measures of retorsion to counter a cyber operation carried out against it. Retorsions are unfriendly acts directed against the interests of another State without amounting to an infraction of obligations owed to that State under international law. Since retorsions are predominantly rooted in the political sphere, they are not subject to such stringent legal limitations as other types of response such as countermeasures. Measures of retorsion may be adopted to counter (merely) unfriendly cyber operations perpetrated by another State. They may likewise be enacted in reaction to an unlawful cyber operation if more intensive types of response (countermeasures, self-defence) are unavailable for legal reasons (for example, in cases in which counter-measures would be disproportionate) or politically unfeasible. Moreover, they may be adopted as a reaction to an unlawful cyber operation in combination with other types of response, such as countermeasures, as part of a State’s comprehensive, multi-pronged response to malicious cyber activities directed against it. (2) Countermeasures The law of countermeasures allows a State to react, under certain circumstances, to cyber-related breaches of obligations owed to it by another State by taking measures which for their part infringe upon legal obligations it owes to the other State. 112 If certain legal conditions are met, such measures do not constitute wrongful acts under the international law of State responsibility. 113 Germany agrees that cyberrelated as well as non-cyber-related breaches of international obligations may be responded to by both cyber and non-cyber countermeasures. 114 As regards the limitations to countermeasures, Germany is of the opinion that, generally, the same conditions apply as in non-cyber-related contexts: In particular, countermeasures may only be adopted against a State which is responsible for an internationally wrongful act in order to induce that State to comply with its obligations arising from its responsibility (in particular cessation of the wrongful act). 115 Also, they must be proportionate and respect fundamental human rights, __________________ 110 111 112 113 114 115 21-09670 Council Regulation (EU) 2019/796 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States, OJ L 129I, 17 May 2019, p. 1–12; Council Decision (CFSP) 2019/797 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States, OJ L 129I, 17 May 2019, p. 13–19, as last amended by Council Decision (CFSP) 2020/1748 of 20 November 2020, OJ L 393, 23 November 2020, p. 19-20. Cf. also Council Decision (CFSP) 2019/797 of 17 May 2019 (note 110), recital 9. Draft Articles on State Responsibility (note 97), part III, chapter II, introductory commentary; Tallinn Manual 2.0 (note 55), rule 20 (with the commentaries). Draft Articles on State Responsibility (note 97), art. 22. Tallinn Manual 2.0 (note 55), rule 20 (with the commentaries). Draft Articles on State Responsibility (note 97), art. 49 para. 1 (with the commentaries); Tallinn Manual 2.0 (note 55), rule 21. 41/142