It is generally accepted that the due diligence principle applies only if the state whose right or rights have been violated suffers sufficiently serious adverse consequences. The precise threshold depends on the specific circumstances of the case. It is clear, however, that such adverse consequences do not necessarily have to include physical damage. Obligations relating to armed conflict – international humanitarian law International humanitarian law (IHL) applies to actions in the context of armed conflict. This includes cyber operations carried out as part of an armed conflict. The existence of an armed conflict (international or non-international) is thus a requirement for the application of this specialised area of law. As early as 2011, the government observed that applying the rules of international humanitarian law (jus in bello) to hostilities in cyberspace is ‘technically feasible and legally necessary’. 12 A key component of IHL is international law on neutrality. Neutrality requires that states which are not party to an armed conflict refrain from any act from which involvement in the conflict may be inferred or acts that could be deemed in favour of a party to the conflict. In its relations with parties to the armed conflict the neutral state is required to treat all parties equally in order to maintain its neutrality. A state may not, for example, deny access to its IT systems to one party to the conflict but not to the other. In its response to the above-mentioned advisory report by the AIV/CAVV, the government noted that, ‘In an armed conflict involving other parties, the Netherlands can protect its neutrality by impeding the use by such parties of infrastructure and systems (e.g. botnets) on Dutch territory. Constant vigilance, as well as sound intelligence and a permanent scanning capability, are required here.’ 13 IHL also lays down specific rules regarding attacks aimed at persons or objects, which apply equally to cyber operations carried out as part of an armed conflict. 14 When planning and carrying out such operations, states must act in accordance with, for example, the principles of distinction and proportionality, as well as the obligation to take precautionary measures. Human rights Human rights are an important component of international law which are laid down in a number of instruments, such as UN treaties and the European Convention on Human Rights (ECHR). Human rights include the right to life, the prohibition of torture and inhuman or degrading treatment, and the right to a fair trial. States have a duty to respect and protect the human rights of every person within their jurisdiction. This implies not only a ‘negative’ duty – i.e. to refrain from acts in violation of human rights – but also a ‘positive’ duty to ensure that people can genuinely exercise their rights and defend themselves against violations by others. It is for instance not sufficient for the Dutch government to respect the privacy of Dutch citizens. It must also take measures to ensure that, for example, companies respect the privacy of their customers. Most human rights are not absolute. This means that some restriction of rights is permissible under certain circumstances. For example, states may criminalise hate speech or incitement to violence, even though doing so has implications for certain individuals in terms of their freedom of expression. The assessment of whether a given restriction is justified depends on the treaty provision concerned. In most cases, however, the factors to be weighed include whether the restriction serves a legitimate purpose, has a valid legal basis and is necessary and proportionate. In addition, in an emergency situation, the observance of a limited number of human rights may be partly suspended for a limited period. One example is the introduction of a curfew when in a state of war. Human rights are just as valid in cyberspace as they are in the physical domain. There is no difference between online and offline rights. This has been recognised by the United Nations General ‘Cyber Warfare’, Advisory report no 77, AIV/no. 22, CAVV December 2011, p. 25; government response to the AIV/CAVV report ‘Cyber Warfare’, 17 January 2012. 13 ‘Cyber Warfare’, Advisory report no 77, AIV/no. 22, CAVV December 2011, p. 26. 14 Additional Protocol to the Geneva Conventions of 12 August 1949 relating to International Armed Conflicts (Protocol I), Bern, 8 June 1977, article 49; Tallinn Manual 2.0, Rule 92. It is beyond the scope of this letter to consider the technical debate on the difference between a cyber operation and a cyberattack in the context of an armed conflict. 12 5