Assembly, among others. 15 However, it is clear that ongoing digitalisation and technological advances are raising new questions and presenting new challenges when it comes to the application of human rights. The increased scope for collecting, storing and processing data creates issues concerning the right to privacy. Similarly, the increased options for people to express their views via online platforms raise questions with regard to the freedom of expression. It is conceivable that in the future a number of these issues will require further regulation at national or international level. At present, however, the government believes that the existing range of human rights instruments provides sufficient scope for effectively safeguarding the protection of human rights in cyberspace. It is also clear that access to the internet is becoming increasingly important to the effective exercise of human rights, not only for human rights defenders and NGOs (which can use social media to draw attention to human rights violations and mobilise support), but for everyone. Rights such as freedom of expression and freedom of association and assembly have gained a new dimension with the advent of social media, as have the right to education and the right to health, given the wealth of information and training courses available online. The right to privacy and the right to family life are another example, thanks to the increased scope for digital communication. At the same time the risk of violations of human rights online has also increased. There is now more scope for surveillance, and disinformation has become more widespread. The growing relevance of the internet to human rights underlines the need for a secure, open and free internet. The government is working at international level to promote this aim. Attribution For a state to be held responsible under international law for a cyber operation and, by extension, for a target state to be able to take a countermeasure in response, 16 it must be possible to attribute the operation to the state in question. Any attribution of cyber operations is always based on a government decision. Special attention is paid to the degree to which the government has information of its own at its disposal or to which it is able to reach an independent conclusion concerning information it has obtained. In the context of cyberspace, three forms of attribution can be distinguished: - - Technical attribution – a factual and technical investigation into the possible perpetrators of a cyber operation and the degree of certainty with which their identity can be established. Political attribution – a policy consideration whereby the decision is made to attribute (publicly or otherwise) a specific cyber operation to an actor without necessarily attaching legal consequences to the decision (such as taking countermeasures). The attribution need not necessarily relate to a state; it may also concern a private actor. Legal attribution – a decision whereby the victim state attributes an act or omission to a specific state with the aim of holding that state legally responsible for the violation of an obligation pursuant to international law. In the case of legal attribution a distinction must be made between operations carried out by or on behalf of a state and operations carried out by non-state actors. An act by a government body in its official capacity (for example the National Cyber Security Centre) is always attributable to the state. An act by a non-state actor is in principle not attributable to a state. However, the situation changes if a state has effective control over the act or accepts it as its own act after the fact. In such a case, the non-state actor (or ‘proxy’) carries out the operation on the instructions of, or under the direction or control of that state. The threshold for establishing effective control is high. A financial contribution to the activities of a non-state actor, for example, is not sufficient. In order to attribute a cyber operation it is not required that a state disclose the underlying evidence. Evidence in the legal sense becomes relevant only if legal proceedings are instituted. A state that takes countermeasures or relies on its inherent right of self-defence (see below) in response to a cyber operation may eventually have to render account for its actions, for example if the matter is brought before the International Court of Justice. In such a situation, it must be possible to provide evidence justifying the countermeasure or the exercise of the right of self-defence. This can include both information obtained through regular channels and intelligence. See e.g. ‘The Right to Privacy in the Digital Age’, General Assembly Res. 68/167, para. 3, UN Doc. A/RES/68/167 (December 2013). 16 For a discussion of countermeasures see page 8 of this appendix. 15 6