to run public services, such as finance, education, and social security. Moreover, foreign election interference may also infringe the principle of non-intervention. This may take the form of cyber operations directly interfering with mail ballots or voter databases, or electoral disinformation campaigns seeking to mislead the electorate about the vote itself, candidates, electoral polls or results. Other types of disinformation, such as those affecting a State’s health policies, may also amount to a prohibited intervention. Posts inciting individuals or other States to wage wars of aggression or to disrupt or subvert the internal order of another State may likewise breach the principle of non-intervention. Due diligence 26. In international law, ‘due diligence’ refers to a flexible standard of reasonable care against which State conduct can be assessed.51 This standard is found in different rules and regimes of international law, both general and specific.52 These rules usually require States to take action with a view to preventing, stopping or redressing different harms to certain protected persons or objects, irrespective of the author or source of the harmful act.53 27. Under customary international law, States have a general obligation ‘not to allow knowingly its territory to be used for acts contrary to the rights of other States’.54 This duty is a corollary of State sovereignty and requires States to protect the rights of other States in their territory.55 It may be breached when a State knows or should have known that an act contrary to the rights of another State originates or transits through its territory, and yet fails to take reasonable action to stop or prevent it, and the harm materializes.56 This means that States must strive to prevent State or non-State actors, including cybercriminals, from conducting cyber operations against the rights of other States. 28. Costa Rica believes that this obligation applies online as it does offline. It covers acts that contravene the sovereign rights of another State, such as ransomware57 and cyber electoral interference,58 whether or not these are perpetrated by a State or a non-State actor. Though this does not entail a general monitoring obligation, States must exercise a reasonable degree of vigilance over their networks. They must also put in place certain basic protective measures in line with their capabilities and other obligations under international law. Examples of diligent behavior in the cyber context may include the enactment of cybercrime legislation, the notification of cyber incidents to the victim State, and the establishment of a Computer Emergency Response Team and National Points of Contact.59 51 International Law Association (ILA), Study Group on Due Diligence, 2nd Report (2016), at 2. Ibid, at 2-4. 53 Ibid. 54 Corfu Channel Case (United Kingdom v Albania), Judgment, 9 April 1949, ICJ Reports (1949) 4, at 22. 55 Island of Palmas case (n 32), at 839. 56 Article 14(3), ILC Articles (n 8). 57 The Oxford Process, ‘The Oxford Statement on International Law Protections in Cyberspace: The Regulation of Ransomware Operations’, ELAC, 4 October 2021, para. 4. 58 The Oxford Process, ‘The Oxford Statement on International Law Protections Against Foreign Electoral Interference Through Digital Means’, ELAC, 28 October 2020. 59 GGE 2021 Report (n 1), paras 27, 65-66, 68, 76. 52 8