A/76/136 lower the threshold of the ‘gravity’ criterion should be. Germany agrees that a ‘grave peril’ does not presuppose the occurrence of physical injury but may also be caused by large-scale functional impairments. 123 A State, when confronted with a cyber threat, does not yet need to have assessed the total and final damage potential in order to invoke necessity. 124 Necessity may be invoked when the origin of a cyber measure has not (yet) been clearly established; 125 however, States should always make efforts to clarify attribution and (State) responsibility in order to be able to substantiate their grounds for action. (4) Self-defence The right to self-defence according to art. 51 UN Charter is triggered if an armed attack occurs. Malicious cyber operations can constitute an armed attack whenever they are comparable to traditional kinetic armed attack in scale and effect. Germany concurs with the view expressed in rule 71 of the Tallinn Manual 2.0. Furthermore, Germany acknowledges the view expressed in the ICJ’s Nicaragua judgment, namely that an armed attack constitutes the gravest form of use of force. 126 Assessing whether the scale and effects of the cyber operation are grave enough to consider it an armed attack is a political decision taken in the framework of international law. Physical destruction of property, injury and death (including as an indirect effect) and serious territorial incursions are relevant factors. The decision is not made based only on technical information, but also after assessing the strategic context and the effect of the cyber operation beyond cyberspace. This decision is not left to the discretion of the State victim of such a malicious cyber operation, but needs to be comprehensibly reported to the international community, i.e. the UN Security Council, according to art. 51 UN Charter. The response to malicious cyber operations constituting an armed attack is not limited to cyber counter-operations. Once the right to self-defence is triggered, the State under attack can resort to all necessary and proportionate means in order to end the attack. Self-defence does not require using the same means as the attack which provided the trigger for its exercise. Acts of non-State actors can also constitute armed attacks. Germany has expressed this view both with regard to the attacks by Al Qaeda 127 and the attacks of ISIS. 128 In Germany’s view, art. 51 UN Charter requires the attack against which a State can resort to self-defence to be ‘imminent’. The same applies with regard to selfdefence against malicious cyber operations. Strikes against a prospective attacker who has not yet initiated an attack do not qualify as lawful self-defence. __________________ 123 124 125 126 127 128 21-09670 Tallinn Manual 2.0 (note 55), rule 26, commentary, para. 4. Cf. Draft Articles on State Responsibility (note 97), art. 25, commentary, para. 16: ‘[…] a measure of uncertainty about the future does not necessarily disqualify a State from invoking necessity, if the peril is clearly established on the basis of the evidence reasonably available at the time.’ Tallinn Manual 2.0 (note 55), rule 26, commentary, para. 11. Reasonableness standards apply to ex ante determinations depending on the context; see also Tallinn Manual 2.0 (note 4), Chapter 4, Introduction to Section 1, para. 9-11. ICJ, Military and Paramilitary Activities in and against Nicaragua (note 72), para. 191. See Letter dated 29 November 2001 from the Permanent Representative of Germany to the United Nations addressed to the President of the Security Council, UN Doc. S/2001/1127. See Letter dated 10 December 2015 from the Chargé d’affaires a.i. of the Permanent Mission of Germany to the United Nations addressed to the President of the Security Council, UN Doc. S/2015/946. 43/142