Scenario 2 – State A’s territory/infrastructure used by State B to conduct malicious cyber activities against State C State B’s Department of Defence conducts malicious cyber activities against State C that are routed through servers located on State A’s territory, without its knowledge. The malicious cyber activities conducted by State B are contrary to the rights of State C (although they do not constitute an unlawful use of force). State A’s relationship with State C could be damaged. International law may assist State A in the following ways: First, it provides rules of legal attribution, under which the unlawful acts of State B could not be attributed to State A. The rules of attribution (as outlined in Scenario 1) provide a clear legal framework for connecting the conduct of an individual or an entity to a state; this connection would not be established in the present case between State B’s Department of Defence and State A. Rather, the acts of the Department of Defence would be attributable to State B as an organ of that state exercising executive functions. Attribution would also be made out against State B if it used a proxy acting on its instructions, or under its direction or control, to carry out the relevant acts. Additionally, State A would not be considered responsible for aiding and assisting State B because its lack of knowledge of the wrongful acts and its lack of intent to aid or assist the wrongful acts would mean that it could not have been complicit in the commission of those acts. Therefore, State C could not make a legal attribution of the wrongful conduct to State A. Second, as a result, State A could not be considered directly responsible for any unlawful act committed by State B against State C. Accordingly, State C could not pursue dispute resolution through legal avenues (including the ICJ, as outlined in Scenario 1) against State A in relation to State B’s wrongdoing; although it could do so against State B. Additionally, assuming State A could not have been aware of the activity taking place from its territory, it did not act contrary to the norm of responsible state behaviour in cyberspace to not knowingly allow its territory to be used for internationally wrongful acts using ICTs,6 or in violation of any applicable international obligations. Third, as State A is not directly responsible for any unlawful act committed by State B against State C, State C could not take any countermeasures – acts that would ordinarily be unlawful – against State A in response to State B’s conduct. Were it to do so, State A would itself be entitled to respond through countermeasures and seek remedies. Note: this scenario details how international law would assist State A (whose territory/infrastructure was used without its knowledge by State B to conduct malicious activity against State C). Separately, and provided all requirements were met (see Scenario 1), State C could invoke the international legal responsibility of State B and pursue a legal and/or political resolution and take countermeasures and/or acts of retorsion against it. 6 Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (22 July 2015) UN Doc A/70/174 para. 13(c) (see, also, para. 13(h)). 4 www.dfat.gov.au/cyberaffairs