According to international law, the right of self-defence may also apply to cyberattacks
reaching the threshold of an armed attack inflicted by non-state actors. The right of collective
self-defence applies to cyberspace as well. This is supported by a declaration adopted by the
representatives
of states
attending
the
meeting
of the
North
Atlantic Council
during the
summit of the North Atlantic Treaty Organization in Wales in 2014. The declaration stipulates
among others that acyberattack can reach a threshold that threatens national and EuroAtlantic prosperity, security, and stability. Its impact could be as harmful to modern societies
as a conventional attack. It was, therefore, affirmed that cyber defence is part of NATO‘s core
task of collective defence.’
6. A state is responsible for actions in cyberspace that violate international law
Norms of customary international law concerning the assignment of responsibility to
a state are reflected to a large extent in the articles covering the states’ responsibility for
internationally wrongful
acts
as adopted
in 2001
by the
International
Law
Commission*®
(hereinafter referred to as “Articles on the Responsibility of States”).
The document reiterates that “Every internationally wrongful act of a State entails the
international
responsibility of that State.”
(Article 1). A state is responsible
for conduct
consisting of both an action or omission that is attributable to the state under international
law and constitutes a breach of an international obligation of the state (Article 2). Articles 4—
11 describe the rules governing the attribution of responsibility to a state. According to these
rules, the State is responsible among others for the conduct of its organs, persons or entities
which, even though they are not organs, are empowered
by law to exercise governmental
authority, as well as persons or groups of persons acting on the instructions of, or under the
direction or control of that state.
The above norms also apply to conduct of states in cyberspace. The state may therefore
be responsible for internationally wrongful acts of, for instance of hacker groups or individual
hackers, if the conditions expressed in the Articles on the Responsibility of States are satisfied.
At the same time, it should be remembered
that the specific nature of cyberspace severely
hampers the attribution of internationally wrongful acts to states or other actors.
7. International human rights law applies to cyberspace
High anonymity, control of data flow, and a largely non-territorial nature of cyberspace
pose a challenge for protecting human
rights online. Nonetheless, international human
rights
law applies to conduct in cyberspace. Rights that people have offline must also be protected
online.’’” States have an obligation not to violate human rights and to protect such rights when
they are violated
by non-state
actors or other
states. The
above-mentioned
examples
of
15 Declaration of the NATO Summit in Wales, 2014, paragraph 72.
16 The text annexed to UN General Assembly Resolution No. 56/83 of 12 December 2001.
17 UN Human Rights Council
Internet” of 29 June 2012.
Resolution
“The promotion,
protection and enjoyment of human
rights on the