A/76/136 obligations of a humanitarian character prohibiting reprisals and peremptory norms of international law. 116 Due to the multifold and close interlinkage of cyber infrastructures not only across different States but also across different institutions and segments of society within States, cyber countermeasures are specifically prone to generating unwanted or even unlawful side effects. Against this background, States must be particularly thorough and prudent in examining whether or not the applicable limitation criteria to cyber countermeasures are met. 117 A State may – a maiore ad minus – engage in cyber reconnaissance measures in order to explore options for countermeasures and assess the potential risk of side effects if such measures fulfil the requirements for countermeasures. (3) Measures taken on the basis of necessity The wrongfulness of a State’s cyber operation that contravenes its international obligations may be precluded by exception if that State acted out of necessity. 118 This entails that a State may – under certain narrow circumstances – act against malicious cyber operations by resorting, for its part, to active counter-operations even in certain situations in which the prerequisites for countermeasures or self-defence are not met. The draft articles on State responsibility, which reflect customary law in this regard, inter alia require that the act must be ‘the only way for the State to safeguard an essential interest against a grave and imminent peril’. 119 Whether an ‘interest’ is ‘essential’ depends on the circumstances. 120 Germany holds the view that, in the cyber context, the affectedness of an ‘essential interest’ may inter alia be explained by reference to the type of infrastructure actually or potentially targeted by a malicious cyber operation and an analysis of that infrastructure’s relevance for the State as a whole. For example, the protection of certain critical infrastructures 121 may constitute an ‘essential interest’. 122 It might likewise be determined by reference to the type of harm actually or potentially caused as a consequence of a foreign State’s cyber operation. For example, the protection of its citizens against serious physical harm will be an ‘essential interest’ of each State – regardless of whether a critical infrastructure is targeted or not. Nevertheless, given the exceptional character of the necessity argument, an ‘essential interest’ must not be assumed prematurely. A case-by-case assessment is necessary to determine whether a peril is ‘grave’. The more important an ‘essential interest’ is for the basic functioning of a State, the __________________ 116 117 118 119 120 121 122 42/142 Draft Articles on State Responsibility (note 97), arts. 51, 50 para. 1 (b), (c), and (d); cf. Tallinn Manual 2.0 (note 55), rules 23, 22. Tallinn Manual 2.0 (note 55), rule 23, commentary, para. 6. Cf. International Court of Justice (ICJ), Gabčíkovo-Nagymaros Project (Hungary v. Slovakia), Judgement of 25 September 1997, I.C.J. Reports 1997, 7, para. 51; Draft Articles on State Responsibility (note 97), art. 25; Tallinn Manual 2.0 (note 55), rule 26 with commentaries. Draft Articles on State Responsibility (note 97), art. 25 para. 1 (a). The Draft articles on State Responsibility further require that the act in question must ‘not seriously impair an essential interest of the State or States towards which the obligation exists, or of the international community as a whole’ and state that ‘necessity may [in any case] not be invoked by a State as a ground for precluding wrongfulness if: (a) the international obligation in question excludes the possibility of invoking necessity; or (b) the State has contributed to the situation of necessity’, see art. 25 para. 1 (b) and 2. Draft Articles on State Responsibility (note 97), art. 25, commentary, para. 15. On the concept of ‘critical infrastructures’ see above, I.a). Tallinn Manual 2.0 (note 55), rule 26, commentary, para. 2, correctly noting, however, that the ‘designation [of an infrastructure as critical by a State] as such does not necessarily deprive other infrastructure of its essentiality’ and that ‘a State’s unilateral description of infrastructure as critical [is not] determinative of the issue.’ 21-09670