A/76/136 been complicit in the commission of those acts. Therefore, State C could not make a legal attribution of the wrongful conduct to State A. Second, as a result, State A could not be considered directly responsible for any unlawful act committed by State B against State C. Accordingly, State C could not pursue dispute resolution through legal avenues (including the ICJ, as outlined in Scenario 1) against State A in relation to State B’s wrongdoing; although it could do so against State B. Additionally, assuming State A could not have been aware of the activity taking place from its territory, it did not act contrary to the norm of responsible state behaviour in cyberspace to not knowingly allow its territory to be used for internationally wrongful acts using ICTs, 6 or in violation of any applicable international obligations. Third, as State A is not directly responsible for any unlawful act committed by State B against State C, State C could not take any countermeasures – acts that would ordinarily be unlawful – against State A in response to State B’s conduct. Were it to do so, State A would itself be entitled to respond through countermeasures and seek remedies. Note: this scenario details how international law would assist State A (whose territory/infrastructure was used without its knowledge by State B to conduct malicious activity against State C). Separately, and provided all requirements were met (see Scenario 1), State C could invoke the international legal responsibility of State B and pursue a legal and/or political resolution and take countermeasures and/or acts of retorsion against it. Scenario 3 – State B conducts a major offensive cyber operation that constitutes a serious threat to State A’s national security Amid growing tensions between State A and State B, 7 the armed forces of State B conduct a major offensive cyber operation against State A, destroying servers located in State A used by State A’s military headquarters. This renders State A unable to communicate with naval vessels operating in international waters off the coast of State B. It will take several months to replace the destroyed servers, at substantial cost. International law may assist State A in the following ways: First, it provides rules of legal attribution, meaning that under the customary international law on state responsibility (as outlined in Scenario 1), the acts of the armed forces, as an organ of State B, would be attributable to State B. Second, it defines states’ rights and obligations, meaning that State B’s cyber operation may constitute an unlawful use of force contrary to Article 2(4) of the UN Charter against State A (unless such actions were taken in self-defence or authorised under a Chapter VII resolution of the UN Security Council). This would turn on whether the operation caused damage to State A’s infrastructure and objects (its military servers) and subsequent impact on the functioning of its military communications systems that was akin in scale and effects to a traditional kinetic operation that would rise to the level of a use of force. Third, assuming State B’s conduct violated international law, it would entitle State A to invoke the international legal responsibility of State B and demand that __________________ 6 7 21-09670 Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (22 July 2015) UN Doc A/70/174 para. 13(c) (see, also, para. 13(h)). For the purposes of this scenario, there is not a state of armed conflict between State A and State B immediately prior to State B’s offensive cyber operation. 11/142