A/76/136 of international law), as well as the political decision to convey – publicly or privately – those attribution assessments. If a State is a victim of malicious cyber activity, which is attributable to a perpetrator State, the victim-State may be able to take countermeasures under certain circumstances. Countermeasures are measures, which would otherwise be unlawful, taken to secure cessation of, or reparation for, the other State’s unlawful conduct. Countermeasures may be cyber in nature or taken through alternative means, such as temporarily not performing certain bilateral treaty obligations owed to a State. Countermeasures in cyberspace cannot amount to a use of force and must be proportionate. States are able to respond to other States’ malicious activity with acts of retorsion, which are unfriendly acts that are not inconsistent with any of the State’s international obligations. If a State is the victim of harmful conduct in cyberspace, that State could be entitled to remedies in the form of restitution, compensation or satisfaction. In the cyber context, this may mean that the victim-State could, for example, seek replacement of damaged hardware or compensation for the foreseeable physical and financial losses resulting from the damage to servers, as well as assurances or guarantees of non-repetition. 28 May 2021 [Annex: cyber case studies] Annex Australia Non Paper Case studies on the application of international law in cyberspace The international community recognises that existing international law – and in particular the UN Charter in its entirety – is applicable to state conduct in cyberspace and is essential to maintaining peace and stability and promoting an open, secure, peaceful and accessible ICT environment. This is reflected in the 2013 and 2015 reports of the UN Group of Governmental Experts on the use of Information Communications Technologies in the Context of International Security (UNGGE), 1 as adopted by the UN General Assembly. 2 Australia’s position on how international law governs state conduct in cyberspace is presented in the International Cyber Engagement Strategy (2017), Annex A, 3 as supplemented by the 2019 International Law Supplement. 4 These case studies apply international law to standalone hypothetical scenarios, demonstrating that existing treaties and customary international law provide a comprehensive and robust framework to address the threats posed by state-generated or sponsored malicious cyber activity. In particular, international law provides victim states with a “tool kit” to identify breaches of international legal obligations, attribute __________________ 1 2 3 4 8/142 Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (24 June 2013) UN Doc A/68/98 para 19; Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (22 July 2015) UN Doc A/70/174 para. 24. UNGA Resolution 68/243 (9 January 2014) UN Doc A/RES/68/243; UNGA Resolution 70/237 (30 December 2015) UN Doc A/RES/70/237. Available at https://dfat.gov.au/international-relations/themes/cyber-affairs/aices/chapters/ annexes.html#Annex-A and also enclosed at Attachment 1 Available at https://dfat.gov.au/international-relations/themes/cyber-affairs/aices/chapters/ 2019_international_law_supplement.html and also enclosed at Attachment 2 21-09670