Fourth, if State B’s conduct violated international law, it would entitle State A to take countermeasures – acts which would ordinarily be unlawful – in response to State B’s wrongdoing. Countermeasures could be cyber in nature or taken through alternative means – such as implementing otherwise unlawful tariffs on trade in important goods/services from State B. However, State A would need to ensure that such countermeasures:  were directed against State B  did not constitute a threat or use of force, violate fundamental human rights, humanitarian obligations prohibiting reprisals, or peremptory international legal norms  were reversible (as far as possible)  were proportionate to the injury suffered by State A, and  were intended to induce State B to comply with its international legal obligations. Fifth, if the cyber operation constituted an “armed attack”, as recognised under Article 51 of the UN Charter, State A would be entitled to use force pursuant to its inherent right of selfdefence against State B. The use of force in self-defence may be cyber in nature or conducted through kinetic means. However, the right to self-defence would require that State A only use force where it is necessary to repel the actual or imminent armed attack and that such force be a proportionate response in scope, scale and duration. The measures taken by State A would need to be immediately reported to the UN Security Council. International law would not preclude State A from taking acts of retorsion, which are unfriendly acts that are not inconsistent with the international obligations of State A, including, for example, declaring diplomats from State B in State A persona non grata. 6 www.dfat.gov.au/cyberaffairs