Obligations of Non-participating States When Hackers on Their Territory Engage in Armed Conflicts

One of the most striking aspects of cyberspace is the diffusion of power to the individual. Even a single person can, from the comfort of their own home, cause considerable harm to States on the other side of the globe. Since the Russian invasion of Ukraine, both belligerent States have successfully deployed novel techniques for the mobilization of individuals in cyberspace. The absence of geographical boundaries in cyberspace triggers important questions regarding the international legal implications for States whose territories are being used for such operations. To assess how the legal framework stands the test of reality, this article examines the possible international legal obligations of non-participating States hosting individuals conducting malicious cyber operations against Russia orchestrated by the IT Army of Ukraine. After a legal characterization of the activities of the IT Army, this article scrutinizes the legal norms conferring obligations on territorial States and accounts for the prevailing ambiguities surrounding their application. The principle of due diligence entails an obligation for States to not allow their territories to be used for cyber operations affecting the rights of, and producing serious adverse consequences for, other States. Special challenges surround the assessment in the context of an armed conflict; the status of a State as an aggressor entails important nuances to the prima facie rights of the State. Based on an analysis of how the legal framework applies to the activities of the IT Army of Ukraine, the article concludes that for non-participating States, the legality of refraining from exercising due diligence will often be contingent on contentious legal questions regarding countermeasures and self-defence.