Due diligence in early practice, the International Law Commission agenda and cyberspace

On the margins of the 2026 International Law Commission (ILC) session, UNIDIR is organizing a side event on due diligence in cyberspace to bridge discussions and encourage engagement between cyber diplomats and the international legal community.

Due diligence is a well-established concept in international law, whereby States should not knowingly allow the use of their territory for activities contrary to the rights of other States. In international cybersecurity, States have recognized it as an important element of the agreed voluntary normative framework of responsible State use of information and communications technologies (ICTs), with some arguing it constitutes a binding rule in cyberspace. At the same time, the ILC has addressed due diligence in various contexts, most notably in relation to transboundary environmental harm, and in 2025 it added “due diligence in international law” to its programme of work as a distinct topic.

As early as in 1928, the Island of Palmas arbitration linked due diligence to States’ obligation to act with reasonable care and established it as a corollary to territorial sovereignty. In the 1941 Trail Smelter case, the arbitral tribunal framed due diligence within the general obligation not to cause transboundary harm, proclaiming that no State has the right to use its territory, or permit its use, to cause significant injury to another State or persons located in another State’s territory.

Perhaps the most famous formulation of due diligence in international law comes from the International Court of Justice (ICJ) and its Corfu Channel judgment:

States have an “obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States.”

In doing so, the Court suggested there are two prerequisites: