are otherwise internationally wrongful acts that are permitted when undertaken to induce another state to comply with its obligations under international law. They may include, but are not limited to, cyber activities that would otherwise be prohibited by international law. Any countermeasure must: a. be undertaken to induce compliance by the state in breach of international law; b. be directed at the state responsible for the internationally wrongful act; c. not rise to the level of use of force or breach peremptory norms of international law; and d. be necessary and proportionate. 22. Given the collective interest in the observance of international law in cyberspace, and the potential asymmetry between malicious and victim states, New Zealand is open to the proposition that victim states, in limited circumstances, may request assistance from other states in applying proportionate countermeasures to induce compliance by the state acting in breach of international law. In those circumstances, collective countermeasures would be subject to the same limitations set out above. 23. Where malicious cyber activity gives rise to a situation leading to international friction or a dispute endangering the maintenance of peace and security, any UN Member State may bring the situation or dispute to the attention of the UN Security Council and/or General Assembly. 24. A state subjected to malicious cyber activity amounting to an armed attack has further recourse to the inherent right of individual and/or collective self-defence in accordance with Article 51 of the UN Charter. The right to self-defence also arises when an armed attack is imminent, including by cyber means. Any exercise of that right: a. may include, but is not limited to, cyber activities; and b. must be consistent with relevant UN Charter and customary international law obligations, including notification to the United Nations, necessity, and proportionality. International Humanitarian Law 25. In situations of armed conflict, international humanitarian law applies to cyber activities. A cyber activity may constitute an “attack” for the purposes of international humanitarian law where it results in death, injury, or physical damage, including loss of functionality, equivalent to that caused by a kinetic attack. All cyber “attacks” must comply with the principles of military necessity, humanity, proportionality and distinction. International Human Rights Law 26. International human rights law applies to cyber activities. States must comply with their obligations to protect and respect human rights online, including the right to freedom of expression and the right not to be subjected to arbitrary and unlawful interference with privacy. States are obliged to respect and ensure human rights to those individuals within their territory and subject to their jurisdiction. The circumstances in which states exercise jurisdiction, through cyber means, over individuals outside their territory is currently unsettled and would benefit from further discussion in multilateral fora. 1 December 2020