Switzerland's position paper on the application of international law in cyberspace attributable to the state concerned. 18 If a cyber incident is carried out by a non-state actor, it can only be attributed to a state under certain conditions. In such cases, state responsibility only arises if the non-state actor acts on the instructions of a state, or under the direction or control of state organs.19 If this requirement is met, the conduct constitutes an act by the state and is attributable to that state. The injured state is also permitted to take countermeasures (see section 6.2). If the required interstate dimension is lacking however, international law does not in principle permit countermeasures against another state. The decision to attribute conduct is at the discretion of the injured state a nd there is no obligation under international law to disclose the information leading to such a decision. Allegations of the organisation or implementation of an unlawful act against another state should however be substantiated. 20 6.2. Countermeasures A state may respond in different ways to unwelcome cyber activities carried out by another state. Retorsion allows states to respond to such activities regardless of whether international law has been violated or not. It refers to unfriendly but lawful measures in response to unwelcome acts by another state. Typical examples of retorsion include refraining from signing a trade agreement that would benefit both parties, recalling an ambassador, or breaking off diplomatic relations as a last resort. In cases where an act violates international law and can be legally attributed to a state, the injured state(s) may also take countermeasures in the form of reprisals, provided that the applicable rules governing state responsibility are observed. 21 Although reprisals are contrary to international law, they are justified in response to a prior breach of international law. However, such a countermeasure must not violate certain fundamental substantive obligations such as the prohibition on the use of force, fundamental human rights, most norms of international humanitarian law, peremptory norms (jus cogens) and the obligation to respect diplomatic and consular inviolability. 22 Military force, i.e. measures leading to loss of life and limb, are therefore prohibited. Countermeasures must impose a (legal) disadvantage aimed at prompting the state concerned to cease its conduct that is in breach of international law and/or to make reparations. In principle, the responsible state can only impose countermeasures if it has first called for the violation(s) to cease and has announced what measures it is planning to take. Exceptions may be made for cyber operations requiring an immediate response in order for the injured state to enforce its rights and prevent further damage. Countermeasures must always be proportional, whatever the circumstances. A countermeasure in response to a cyber incident does not necessarily have to take place in the cyber domain. In accordance with the rules governing state responsibility, other measures that aim to enforce the responsible state's compliance with its international obligations are also 18 19 20 21 22 Art. 4 and Art. 5 ILC Draft Articles on the Responsibility of States for Internationally Wrongful Acts, August 2001. Art. 8 ILC Draft Articles on the Responsibility of States for Internationally Wrongful Acts, August 2001. UN GGE 2015 Report, para. 28 f. ILC Draft Articles on the Responsibility of States for Internationally Wrongful Acts, August 2001. Unles s prohibited by international law , countermeasures are subject to strict conditions. Art. 50 ILC Draft Articles on the Responsibility of States for Internationally Wrongful Acts, August 2001. 6/11