Normative Reassessment of Due Diligence Obligations in State Responsibility for Cyber Operations under International Law

Abstract

This study aims to conduct a normative reassessment of the due diligence principle in state responsibility for cyber operations under international law, focusing on the gap between its legal formulation and practical implementation. Employing a qualitative approach with a case study design, this research examines cybersecurity governance in Indonesia while situating it within broader international dynamics. Data were collected through semi-structured interviews with key stakeholders, including legal scholars, cybersecurity practitioners, and policymakers, complemented by document analysis and limited observation of policy discourse. The findings reveal four interrelated patterns: conceptual ambiguity of due diligence, institutional and capacity constraints, fragmentation of regulatory frameworks, and the growing complexity of technological developments. These findings indicate that the principle remains insufficiently operationalized, as the absence of clear standards, limited institutional readiness, and regulatory inconsistencies weaken its effectiveness in preventing transboundary cyber harm. The study contributes to international legal scholarship by providing a contextual and practice-oriented understanding of due diligence as an evolving norm shaped by legal, institutional, and technological factors. From a policy perspective, the results highlight the need for clearer operational guidelines, strengthened institutional capacity, and enhanced regulatory harmonization at both national and international levels. Future research is recommended to adopt comparative approaches and further explore the interaction between technological developments and the evolution of international legal norms in cyberspace.