President Kaljulaid at CyCon 2019: Cyber attacks should not be easy weapon | News | ERR 11/10/2022, 14:25 in cyberspace. Sovereignty entails not only rights, but also obligations. States are responsible for their internationally wrongful cyber operations, just as they would be responsible for any other activity based on international treaties or customary international law. This is the case whether or not such acts are carried out by state organs, or by non-state actors, supported or controlled by the state. States cannot waive their responsibility by carrying out malicious cyber operations via nonstate actors. If a cyber operation violates international law, this needs to be called out. Third, states must keep strengthening their own resilience to cyber threats and disruptions, both individually and collectively. Therefore, states have to make reasonable efforts to ensure that their territory is not used to adversely affect the rights of other states. They should strive to develop means to offer support when requested by the injured state in order to identify, attribute or investigate malicious cyber operations. This expectation depends on national capacity as well as availability, and accessibility of information. As I said here last year, we have to also consider the capacities of different states to be able to control such operations that exploit their infrastructure or systems. Therefore, meeting this expectation should encompass taking all feasible measures, rather than achieving concrete results. https://news.err.ee/946827/president-kaljulaid-at-cycon-2019-cyber-attacks-should-not-be-easy-weapon Page 4 of 9