Transformation Through Training • Issue No: 10 • September 2017 • 33 “The action of a State entails individual responsibility for a crime of aggression only if the conduct of the State is a sufficiently serious violation of the prohibitioncontainedinArticle2,paragraph 4, of the Charter of the United Nations. In this regard, the competent court may have to consider […] whether the conduct of the State constitutes a violation of Article 2, paragraph 4, of the Charter and whether such conduct constitutes a sufficiently serious violation of an international obligation to qualify as aggression entailing individual criminal responsibility. The Charter and the Judgment of the Nurnberg Tribunal are the main sources of authority with regard to individual criminal responsibility for acts of aggression.”57 The Nurnberg Tribunal clearly recognized the roles of States and individuals in stating that: “Crimes against international law are committed by men, not by abstract entities, and only by punishing individuals who commit such crimes can the provisions of international law be enforced.”58 It has to be underlined that breaches of international law by individuals acting in their capacity as state organs incline the responsibility of the state for such breaches and the attribution of the act of an individual to a state for the purposes of state responsibility is a matter of international law, not domestic law of the state. There might also be cases where a state becomes responsible for acts of private persons, in particular when the state concerned fails to exercise due diligence to prevent individuals being citizens of that state (or present within its territory. ) from committing internationally wrongful acts. While with regard to administrative officials and members of the armed forces states (normally) possess disciplinary powers and mechanisms to either prevent or enforce breaches, the exercise of due diligence with regards to private persons will be subject to certain limitations, i.e. to mainly prevent possible wrongful acts within means and capabilities as well as to prosecute offenders, should a violation occur, and compel them to compensate for the damages. Failure to prosecute would equal failure to exercise due diligence and might result in international responsibility of the state. 59 The paradigm would shift if private individuals, despite not being state officials, are prompted, encouraged or instigated to conduct internationally wrongful acts de facto on behalf of the state. In such a case, which has to be assessed on a factual basis, individuals might be considered as so closely associated with the state’s organ, that the act committed by a private individual would be regarded as committed by the state.To certain extent this might pertain to activities of corporations, which although having separate legal personality may be considered as agents of the state, in particular when they are under a governmental contract or have been outsourced to perform certain governmental functions. The state concerned might then be liable for the actions of private actors conducted by the order of state authorities, in accordance with instructions of the state bodies, under the direction or control of the State (criterion of effective control as in the case of de facto commanders)60 . Similarly, a state may be held accountable for actions of private persons forming an insurgent group in another state, provided that – as ruled in the Nicaragua Case – the insurgents remain under effective control of that state61 . As provided for in Chapter IV of the Draft Articles, a state may be held accountable for internationally wrongful acts of another state, when acting “[…] with knowledge of the circumstances of the internationally wrongful act […]”: 1) Aids or assists in the commission of such act (Art. 16); 2) Exercises direction and control over the commission of such act; 3) Coerces another state to commit such act. It is irrelevant, whether an internationally wrongful act has been committed in a physical domain or in cyberspace; if the act is attributable to the state under international law and constitutes a breach of an international obligation of the state, it entails the responsibility of the state even if the act itself or its consequences emanate only in cyberspace62 . A state can be held liable for cyber operations which violate any kind of international obligation of that state, e.g. conducting a cyber operation from a naval vessel passing through territorial waters of another state, thus in breach of the innocent passage regime as regulated by Art. 20 of the United Nations Convention on the Law of the Sea. As proposed above, providing an insurgent group with cyber tools necessary to conduct a cyber operation intended to inflict damage or cause casualties in the state struggling with insurgency, might amount to an unlawful intervention, which is apparently an internationally wrongful act. Equally, instigating a hacker group to conduct cyber operations against another state, which would result in damage, harm or significant degradation of the functioning of critical infrastructure in the victim state, if attributable (in any of the manners proposed by Chapter II of the Draft Articles) to a state, would constitute an internationally wrongful act. If such a hacker group is provided with guidance as to the objects, nodes or elements of infrastructure to be targeted and complies with the guidance, such a situation might satisfy the effective control test63 . Failure to prevent misuse of national cyber infrastructure made available to another state and subsequently utilised to conduct cyberattacks against a third state could be construed as non-compliance with the requirement of due diligence and result in responsibility of the state owning the cyber infrastructure. As it will be pointed out in the following (and final) section of this article, states and non-state actors may utilise third-states’ cyber infrastructure to hide or disguise their engagement in cyber operation and thus complicate identification of the actual perpetrator and proper attribution of the act. If the state, the cyber infrastructure of which is utilised to convey such a cyber operation is unaware of the fact, such state could not be considered internationally responsible. However, should the state be made aware of the misuse of its cyber infrastructure and fail to undertake respective preventive measures, it might