By contrast, assume that a private firm in the first State is engaging in harmful cyber operations against a competitor in the second State. In such a case, it would be inappropriate for the second State to launch countermeasures against the firm unless the firm’s action can be attributed to the first State (Rules 15 and 17) or that State has wrongfully failed to control the activities of the firm and therefore breached its due diligence obligation to control its territory once it became aware of the operations
