Cyberspace, Non-State Actors and the Obligation to Prevent Transboundary Harm

That states are subject to an obligation to prevent their cyber infrastructure from being used in a manner injurious to the international legal rights of other states is well established in customary international law. This obligation imposes a dual duty upon states. The first duty is an obligation of result insofar as it requires states to implement the laws and institutions necessary to prevent and punish malicious cyber conduct emanating from their territory, although international law confers upon states a wide margin of appreciation in deciding the design and content of such measures. The second duty is an obligation of conduct in the sense that where a threat emanates from their cyber infrastructure and states have (actual or constructive) knowledge of that threat they must act reasonably in utilising their capacity and resources to suppress it. What is reasonable in the circumstances will depend upon various factors operating at the time such as the resources available to the state and the risks involved in the particular activity. Taken together, these duties construct an international legal obligation which offers states a certain degree of protection from malicious transboundary cyber conduct committed by non-state actors. However, the conclusion of an international treaty or several international treaties dealing with specific cyber threats will be crucial to achieving a secure cyberspace.