Non-State actors are not entitled to engage in the responses that States may conduct under the law of State responsibility when facing hostile cyber operations by or attributable to other States. In particular, cyber responses by non-State actors cannot qualify as countermeasures (Rule 24), although as explained in Rules 15 and 17, non-State actors may be empowered by States to act on their behalf.
