A/76/136 operational context. This entails that the development of means or the adoption of the method will often coincide with the planning of a concrete operation. Thus, the obligation to take precautions in attack and the requirement of a legal review remain separate requirements, but may overlap in substance. IV. States’ response options a) Attribution Attributing a cyber incident is of critical importance as a part of holding States responsible for wrongful behaviour and for documenting norm violations in cyberspace. It is also a prerequisite for certain types of responsive action. As regards the attribution of certain acts to States under international law, Germany applies the relevant customary law rules on State responsibility also to acts in cyberspace, subject to any lex specialis provisions. Inter alia, cyber operations conducted by State organs are attributable to the State in question. 97 The same applies with regard to persons or entities which are empowered by the law of a State to exercise elements of the governmental authority and act in that capacity in the particular instance. 98 Attribution is not excluded because such organ, person or entity acting in an official capacity exceeds its authority or contravenes instructions – cyber operations conducted ultra vires are likewise attributable to the State in question. 99 This applies a maiore ad minus when only parts of an operation are ultra vires. Generally, the mere (remote) use of cyber infrastructure located in the territory of a State (forum State) by another State (acting State) for the implementation of malicious cyber operations by the latter does not lead to an attribution of the acting State’s conduct to the forum State. However, the forum State may under certain circumstances incur responsibility on separate grounds, for example if its conduct with regard to another State’s use of its cyber infrastructure for malicious purposes qualifies as aid or assistance. 100 This inter alia applies if the forum State actively and knowingly provides the acting State with access to its cyber infrastructure and thereby facilitates malicious cyber operations by the other State. 101 Moreover, cyber operations conducted by non-State actors which act on the instructions of, or under the direction or control of, a State are attributable to that State. 102 The same principles apply as in the physical world: if a State recurs to private actors in order to commit an unlawful deed, the actions by the private actor will regularly be attributable to the State. States should recognize that they are accountable for the actions of proxies acting under their control. 103 The State must have control over a specific cyber operation or set of cyber operations conducted by the non-State actor. While a sufficient degree or intensity of such control is necessary, the State is not required to have detailed insight into or influence over all particulars, __________________ 97 98 99 100 101 102 103 21-09670 Cf. International Law Commission (ILC), Draft Articles on Responsibility of States for Internationally Wrongful Acts, 2001, in: Report of the International Law Commission on the work of its fifty-third session, 23 April–1 June and 2 July–10 August 2001, Official Records of the General Assembly, Fifty-sixth Session, Supplement No. 10, UN Doc. A/56/10, 26 et seq., art. 4; Tallinn Manual 2.0 (note 55), rule 15. Cf. Draft Articles on State Responsibility (note 97), art. 5; Tallinn Manual 2.0 (note 55), rule 15. Cf. Draft Articles on State Responsibility (note 97), art. 7; Tallinn Manual 2.0 (note 55), rules 15, commentary, paras. 6, 12. Cf. Draft Articles on State Responsibility (note 97), art. 16; Tallinn Manual 2.0 (note 55), rule 18 (a). Cf. Draft Articles on State Responsibility (note 97), art. 16, commentary, para. 1; Tallinn Manual 2.0 (note 55), rule 18, commentary, para. 3. Cf. Draft Articles on State Responsibility (note 97), art. 8; Tallinn Manual 2.0 (note 55), rule 17 (a). Cf. UN Group of Governmental Experts, reports of 2013 and 2015 (note 52), paras. 23 and 28 (e) respectively. 39/142