General international law does not confine countermeasures to those with the same
means as the preceding internationally wrongful act in response to which they are
taken. Japan considers that this is the same for the countermeasures against
internationally wrongful acts in cyberspace.
The Government of Japan is of the view that a State may invoke necessity under
international law when the requirements shown in Article 25 of the ILC’s Articles on
State Responsibility are satisfied.
(4) Due diligence
States have a due diligence obligation regarding cyber operations under international
law. Norm 13(c) and (f) and the second half of paragraph 28(e) of the 2015 GGE report
are related to this obligation.
In the Corfu Channel case (1949), the ICJ referred to the existence of "every State’s
obligation not to allow knowingly its territory to be used for acts contrary to the rights of
other States".11 In relation to cyber operations, the due diligence obligation in this sense
has significance.
Furthermore, with regard to the concept of the due diligence obligation, the Alabama
Arbitral Award (1872) held that “ due diligence ” ought to be exercised by neutral
governments in exact proportion to the risks to which either of the belligerents may be
exposed, from a failure to fulfil the obligations of neutrality on their part,12 and, in the
Genocide Convention (Bosnia and Herzegovina v. Serbia and Montenegro) case (2007),
the ICJ seems to consider the nature of the obligation to prevent genocide under the
Genocide Convention to be the due diligence obligation and referred to an obligation of
the contracting States to exercise the capacity to influence the actions of persons likely to
commit genocide to prevent genocide so far as possible.13
The outer limit of the due diligence obligation of territorial States with respect to cyber
operations is not necessarily clear. By reference to these judgements related to the concept
of the due diligence obligation, it seems necessary to consider on a case-by-case-basis the
scope of the obligation taking into account such factors as the seriousness of the cyber
operations in question and the capacity of the territorial States to influence a person or
group of persons conducting the attacks.
In light of the above, at the least, for example, when a State has received a credible
notification from another State of the possibility that a person or group of persons located
in its territory and receiving from it financial and other forms of support may be involved
in a cyber operation that may cause serious adverse consequences, such as damage to a
target State's critical infrastructure, the due diligence obligation owed by the informed
11
Corfu Channel case, Judgment of April 9th, 1949: I.C.J. Reports 1949, P.22.
Alabama claims of the United States of America against Great Britain, RIAA, Vol XXIX, p.129
13
Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and
Herzegovina v. Serbia and Montenegro), Judgment, I.C.J. Reports 2007, p. 221, paragraph 430.
12
5