24 Annex A Fifth Report UN Charter? Can a cyber operation qualify as a use of force or armed attack without causing the violent effects that have been used to mark such thresholds in past kinetic conflicts? Additional explanations about the questionnaire may be found within the enclosed CJI report entitled “International Law and state cyber Operations: Improving Transparency”, document CJI/doc. 578/19. 4. Outside of armed conflicts, when would a State be responsible for the cyber operations of a non-State actor? What levels of control or involvement must a State have with respect to the non-State actor’s operations to trigger the international legal responsibility of that State? Responses should be sent via Email before June 28, 2019 to the Technical Secretariat of the CJI, the Department of International Law, through Luis Toro Utillano at ltoro@oas.org. We may also be reached by phone at (202) 370-0632 or by fax, at (202) 458-3293. 5. Are the standards of State responsibility the same or different in the context of an armed conflict as that term is defined in Articles 2 and 3 common to the 1949 Geneva Conventions? The Department of International Law of the Secretariat for Legal Affairs of the General Secretariat of the Organization of American States avails itself of this opportunity to convey to the Permanent Missions to the OAS renewed assurances of its highest consideration. 6. Under international humanitarian law, can a cyber operation qualify as an “attack” for the rules governing the conduct of hostilities if it does not cause death, injury or direct 7. physical harm to the targeted computer system or the infrastructure it supports? Could a cyber operation that produces only a loss of functionality, for example, qualify as an attack? If so, in which cases? Washington, D. C., March 19, 2019 8. Is a cyber operation that only targets data governed by the international humanitarian law obligation to direct attacks only against military objectives and not against civilian objects? 9. Is sovereignty a discrete rule of international law that prohibits States from engaging in specific cyber operations? If so, does that prohibition cover cyber operations that fall below the use of force threshold and which do not otherwise violate the duty of non- intervention? 10. Does due diligence qualify as a rule of international law that States must follow in exercising sovereignty over the information and communication technologies in their territory or under the control of their nationals? 11. Are there other rules of international law that your government believes are important to highlight in assessing the regulation of cyber operations by States or actors for which a State is internationally responsible? Inter-American Juridical Committee International Law and State Cyber Operations 25