국제사이버법상 상당한 주의 의무에 관한 국가실행

The failure of the fifth UN GGE indicates clear divergences among the participating States on how international law applies to cyberspace. In this vein, the UNGA establishing the sixth GGE mandates an official compendium of voluntary national contributions of participating States whereby current state practice on the subject concerned would be exchanged and shared for common understandings. By way of analysis thereof, this article particularly explores States’ view and assessment on the principle of due diligence. It discusses the ongoing controversy on the legal status of the principle; while some States argue that it has acquired the status of customary international law, other States including the U.S. and the U.K. dissent such view based on the lack of opinio juris as well as state practice widely recognized. The article, however, points out that while the latter simply relies on the GGE Report under which the principle of due diligence has been classified as voluntary and non-binding norms, the former refers to the ICJ’s Corfu Channel as its legal basis, that is, every State has a general obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States. The article also opines that, compared to the past GGE discussion, the position of the U.S. towards the due diligence principle seems to be slightly changed as the voluntary national contribution of the U.S. itself confirms its practical necessity. Particularly, the Colonial Pipeline ransomware attack occurred in May 2021 might be a turning point; U.S. President Joe Biden explicitly opined that, despite the lack of evidence proving any involvement of the Russian government, Russia has some responsibility to deal with the cyberattack in light of the fact that the attack was emanated from the territory thereof. The article points out that such logic embedded within the President’s statement nothing but admits the principle of due diligence. It should be noted that States recognizing the principle as a general obligation of international law do emphasize the legal or technical difficulty in establishing state responsibility since ‘anonymity’ derived from the intrinsic nature of cyberattack indeed prevents an injured State from proving attribution of the attack and invoking the law of state responsibility. In this light, the article argues that the due diligence principle should be applicable to cyberspace as a matter of international law, not a non-binding norm, and the international community should strive to clarify the scope, practical applications, and other substantial contents of the due diligence principle.