A/76/136 physical borders which would limit or disregard the territorial scope of its sovereignty. Within its borders, a State has the exclusive right – within the framework of international law – to fully exercise its authority, which includes the protection of cyber activities, persons engaging therein as well as cyber infrastructures in the territory of a State against cyber and non-cyber-related interferences attributable to foreign States. 65 As a corollary to the rights conferred on States by the rule of territorial sovereignty, States are under an ‘obligation not to allow knowingly their territory to be used for acts contrary to the rights of other States’ 66 – this generally applies to such use by State and non-State actors. The ‘due diligence principle’, which is widely recognized in international law, is applicable to the cyber context as well and gains particular relevance here because of the vast interconnectedness of cyber systems and infrastructures. Germany agrees with the view that cyber operations attributable to States which violate the sovereignty of another State are contrary to international law. 67 In this regard, State sovereignty constitutes a legal norm in its own right and may apply directly as a general norm also in cases in which more specific rules applicable to State behaviour, such as the prohibition of intervention or the use of force, are not applicable. Violations of State sovereignty may inter alia involve its territorial dimension; in this regard, the following categories of cases may be relevant (without excluding the possibility of other cases): Germany essentially concurs with the view proffered, inter alia, in the Tallinn Manual 2.0 that cyber operations attributable to a State which lead to physical effects and harm in the territory of another State constitute a violation of that State’s territorial sovereignty. 68 This encompasses physical damage to cyber infrastructure components per se and physical effects of such damage on persons or on other infrastructure, i.e. cyber or analogue infrastructure components connected to the damaged cyber component or infrastructure located in the vicinity of the damaged cyber infrastructure (provided a sufficient causal link can be established). Germany generally also concurs with the view expressed and discussed in the Tallinn Manual 2.0 that certain effects in form of functional impairments with regard to cyber infrastructures located in a State’s territory may constitute a violation of a State’s territorial sovereignty. 69 In Germany’s view, this may also apply to certain substantial non-physical (i.e. software-related) functional impairments. In such situations, an evaluation of all relevant circumstances of the individual case will be necessary. If functional impairments result in substantive secondary or indirect physical effects in the territory of the target State (and a sufficient causal link to the cyber operation can be established), a violation of territorial sovereignty will appear highly probable. 70 In any case, negligible physical effects and functional impairments below a certain impact threshold cannot – taken by themselves – be deemed to constitute a violation of territorial sovereignty. __________________ 65 66 67 68 69 70 21-09670 Ibid., rule 2 with commentary, para. 2. See International Court of Justice (ICJ), Corfu Channel case (United Kingdom of Great Britain and Northern Ireland v. Albania), Judgement of 9 April 1949, I.C.J. Reports 1949, 4, 22; Permanent Court of Arbitration (PCA - administering institution), Island of Palmas Case (or Miangas), United States of America v. The Netherlands, Arbitral Award (M. Huber) of 4 April 1928, (1928) II RIAA 829, 839. Cf. Tallinn Manual 2.0 (note 55), rule 4. Tallinn Manual 2.0 (note 55), rule 4, commentary, para. 11. Cf. ibid., rule 4, commentary, para. 13 (“loss of functionality”). Cf. ibid. 33/142