With a long history in international law, the concept of due diligence has recently gained traction in the cyber context, as a promising avenue to hold states accountable for harmful cyber operations originating from, or transiting through, their territory, in the absence of attribution. Nonetheless, confusion surrounds the nature, content and scope of due diligence. It remains unclear whether it is a general principle of international law, a self-standing obligation or a standard of conduct, and whether there is a specific rule requiring diligent behaviour in cyberspace. This has created an ‘all-or-nothing’ discourse: either states have agreed to a rule or principle of ‘cyber due diligence’, or no obligation to behave diligently would exist in cyberspace. We propose to shift the debate from label to substance, asking whether states have duties to protect other states and individuals from cyber harms. By revisiting traditional cases, as well as surveying recent state practice, we contend that – whether or not there is consensus on ‘cyber due diligence’ – a patchwork of different protective obligations already applies, by default, in cyberspace. At their core is a flexible standard of diligent behaviour requiring states to take reasonable steps to prevent, halt and/or redress a range of online harms.

中文翻译：

---

“网络尽职调查”：国际法中保护义务的拼凑

凭借在国际法中的悠久历史，尽职调查的概念最近在网络环境中获得了关注，作为一种有希望的途径，可以让国家对源自或通过其领土的有害网络操作负责，而无需归因。尽管如此，尽职调查的性质、内容和范围仍令人困惑。尚不清楚这是国际法的一般原则、独立的义务还是行为标准，以及是否存在要求在网络空间中勤勉行为的具体规则。这就产生了一种“全有或全无”的话语：要么国家已经同意“网络尽职调查”的规则或原则，要么在网络空间中不存在勤勉行事的义务。我们建议将辩论从标签转向实质，询问国家是否有义务保护其他国家和个人免受网络伤害。通过重新审视传统案例以及调查最近的国家实践，我们认为——无论是否就“网络尽职调查”达成共识——不同保护义务的拼凑已经默认适用于网络空间。其核心是一个灵活的勤勉行为标准，要求各州采取合理措施来预防、制止和/或纠正一系列在线危害。