56 Annex B in a number of contexts, most notably international environmental law, where it is the basis for requiring States to stop pollution in their territory that serves as a source for transboundary harm to other States’ territories. 47. Like sovereignty, there are competing views on whether due diligence is a requirement of international law in cyberspace. The 2015 UN GGE report listed it among the “voluntary” norms of responsible State behavior rather than listing it under applicable international law principles.123 The Netherlands and France’s Ministry of Defense have characterized it as a legal rule in cyberspace.124 In doing so, however, the Netherlands noted that “not all countries agree that the due diligence principle constitutes an obligation in its own right under international law” and the United States is widely thought to be among those contesting its status as such.125 The ninth question thus sought to obtain Member State views on the status of due diligence with respect to a State’s obligations under international law in cyberspace. 48. Chile, Ecuador, Guatemala, Guyana, and Peru all took the position that the due diligence principle is a part of the international law that States must apply in cyberspace.126 As Chile explained, “[f ]rom a cyber-operations stand2015 UNGGE, supra note 1, at 13, 26-28. French Ministry of Defense Views, supra note 101, at 10 (“Under the due diligence obligation, States should ensure that their sovereign domain in cyberspace is not used to commit internationally unlawful acts. A State’s failure to comply with this obligation is not a ground for an exception to the prohibition of the use of force, contrary to the opinion of the majority of the Tallinn Manual Group of Experts.”); The Netherlands Views, supra note 101, Appendix, at 4 (“the due diligence principle requires that states take action in respect of cyber activities: - carried out by persons in their territory or where use is made of items or networks that are in their territory or which they otherwise control; - that violate a right of another state; and - whose existence they are, or should be, aware of”). Although it did not describe due diligence as a specific rule of international law, Estonia has catalogued its contents as a requirement for State behavior. Kersti Kaljulaid, President of Estonia, President of the Republic at the opening of CyCon 2019 (May 29, 2019), at https://www.president.ee/en/ official-duties/speeches/15241-president-of-the- republic-at-the-opening-of-cycon-2019/ index.html (“Estonian Views”) (“states have to make reasonable efforts to ensure that their territory is not used to adversely affect the rights of other states. They should strive to develop means to offer support when requested by the injured state in order to identify, attribute or investigate malicious cyber operations. This expectation depends on national capacity as well as availability, and accessibility of information.”). 125 The Netherlands Views, supra note 101, Appendix, at 4. 126 Chile Response, supra note 1, at 6-7; Ecuador Response, supra note 1, at 2; Guatemala 123 124 Inter-American Juridical Committee Fifth Report point, a state must exercise due diligence to prevent its sovereign territory, including the cyber infrastructure under its control, from being used to carry out cyber operations that affect another state’s rights or could have adverse consequences for them.”127 Guatemala adopted a similar stance, while noting that since “cyberspace” is such a broad term, performing due diligence can be extremely complicated.128 Still, to the extent due diligence “derives from the principle of sovereignty,” Guatemala opined that “each State should exert the control necessary to halt all harmful activities within its territory and be obliged to take preventive measures, establish a CERT, adopt information security policies, and raise awareness about information security.”129 49. Bolivia offered a more equivocal response. Without opining one way or another on the legal status of due diligence, it did opine that a State may not be held responsible for a cyberattack when it lacks technological infrastructure to control a non-State actor.130 This view could be consistent with having due diligence as an international legal rule for cyber operations as due diligence generally has required States to “know” about the activities in question, which may not be possible for States lacking the requisite technical infrastructure.131 On the other hand, the inability to “control” cyber activities of which it has knowledge might suggest Bolivia does not accede to the due diligence doctrine in cyberspace. Without further clarification of Bolivia’s response, it is difficult to reach a conclusion one way or another. Similarly, prior public U.S. statements have not addressed the international legal status of due diligence directly. It is notable, however, that the United States has tended to describe any obligations to respond to requests for assistance in non-binding terms.132 Response, supra note 1, at 4; Guyana Response, supra note 1, at 5; Peru Response, supra note 1, at 7. 127 Chile Response, supra note 1, at 6-7. Ecuador simply stated: “due diligence is applicable to what happens with technological resources within national territory.” Ecuador Response, supra note 1, at 2. 128 Guatemala Response, supra note 1, at 4. 129 Id. at 2, 4. 130 Bolivia Response, supra note 1, at 3-7. 131 See Tallinn 2.0, supra note 20, at 40. 132 2014 US GGE Submission, supra note 1, at 739 (“A State should cooperate, in a manner consistent with domestic law and International obligations, with requests for assistance from other States in investigating cybercrimes, collecting electronic evidence, and mitigating malicious cyber activity from its territory.”). International Law and State Cyber Operations 57