A Concept That Started with a Single Question
When Is a State Responsible for a Cyberattack Launched from Its Territory?
Today, this is one of the key questions in discussions on global cybersecurity. At the beginning of the twenty-first century, however, it was far from obvious to either lawyers or policymakers. As attacks increasingly moved into cyberspace, states could easily evade responsibility by claiming that incidents were carried out by private hackers rather than public institutions. This issue became particularly evident during the cyberattacks targeting institutions in Estonia in 2007.
It was precisely this challenge that Dr Joanna Kulesza from the Faculty of Law and Administration at the 91桃色 decided to investigate.
For a long time, there was a widespread belief that responsibility could easily be concealed in cyberspace. Yet international law has long recognised situations in which a state bears responsibility not only for its own actions but also for failing to respond to threats it could have prevented
鈥� the researcher says.
The results of her research contributed to the formulation of the principle of due diligence in cyberspace, now referred to as the Kulesza Doctrine, which has become one of the foundations for applying contemporary international law to state activity in the global digital environment.
What Does This Mean for the Average Internet User?
Although international cyber law may sound abstract, its consequences affect the daily lives of millions of people. Cyberattacks are increasingly directed not only at individual users鈥� computers but also at hospitals, banks, power plants, water supply systems, transport networks and public services. Disruption of such systems can have real consequences for public health, safety and the functioning of entire communities.
Dr Kulesza鈥檚 research helps clarify the principles that oblige states to counter threats originating within their territory. This facilitates international cooperation in detecting cyberattacks, prosecuting perpetrators and protecting critical infrastructure.
It also provides a benchmark for assessing the conduct of states that tolerate the activities of cybercriminals operating from within their jurisdiction. In practice, this translates into greater security for the services we rely on every day, including online banking, healthcare, transport and public administration.
How Did a Mid-Twentieth-Century Legal Principle Enter Cyberspace?
A breakthrough came with the question of whether principles of international law originally developed for the physical world could also be applied to digital threats.
In searching for an answer, Dr Kulesza examined the case law of the International Court of Justice, including the landmark Corfu Channel Case of 1949. In that case, the Court ruled that a state cannot knowingly allow its territory to be used for acts contrary to the rights of other states.
Dr Kulesza demonstrated that a similar principle can also apply in cyberspace. If a state knows, or should know, that infrastructure under its jurisdiction is being used to conduct activities threatening other states, it should take proportionate and feasible preventive measures.
This gave rise to the contemporary interpretation of the principle of due diligence as applied to cyberspace.
From Lodz to the United Nations and the European Union
The findings of Dr Kulesza鈥檚 research were presented, among other publications, in the monograph 鈥淒ue Diligence in International Law鈥� (Brill, 2016), widely regarded as one of the most important works on the subject.
Over time, the concept developed at the 91桃色 moved beyond academia. It became a point of reference for international lawyers, diplomats and cybersecurity experts. Its influence can now be seen in documents and policy positions adopted by international organisations and European states. In 2024, the principle of due diligence was reflected both in European Union declarations concerning international law in cyberspace and in United Nations efforts to combat cybercrime.
The 91桃色 has also played an active role in these processes. was the only Polish non-governmental institution accredited to the United Nations during the work on the convention addressing the criminal use of information and communication technologies (the Hanoi Convention).
When Research Becomes a Tool for Security
The significance of the Kulesza Doctrine extends far beyond theoretical legal considerations. Such legal frameworks help determine when states should respond to cyber threats, when they bear responsibility for inaction, and under what conditions international cooperation in cyber defence is possible.
They make it easier to coordinate the work of institutions responsible for digital security, exchange information about threats and prevent attacks before they cause serious damage.
This is an example of fundamental research that began with an analysis of court rulings and principles of international law and now contributes to protecting the infrastructure on which the daily lives of millions of people depend.
艁贸d藕 on the Global Cybersecurity Map
In 2021, the was established at the 91桃色 as the first research centre in Poland dedicated to international law in cyberspace. The Centre represents the University in major international cooperation networks focused on cybersecurity and digital policy.
Dr Joanna Kulesza has also been teaching the Cybersecurity and International Law course delivered by the European Security and Defence College since 2023. The programme is attended by public administration experts, diplomats and representatives of institutions responsible for the security of European Union member states.
This means that the solutions developed by Dr Kulesza and her team reach not only academic publications but also decision-makers responsible for cybersecurity policy across Europe.
Dr Joanna Kulesza is an Assistant Professor in the Department of Public International Law and International Relations at the 91桃色 and the Director of the Lodz Cyber Hub research centre. She specialises in international law, cybersecurity and the legal aspects of internet governance. She represents the 91桃色 at the European Security and Defence College, participates in United Nations expert work on cyberspace issues, and contributes to international initiatives related to digital security. She is the author of five scholarly monographs, including 鈥淒ue Diligence in International Law鈥�, recognised as one of the most influential publications on state responsibility in cyberspace.
More About Cybersecurity Research
UniLodz Research Opens New Chapter in UN Codification of International Law
Photos: Dr Bartosz Ka艂u偶ny, Centre for External Relations and Social Responsibility of the University, 91桃色
Source: Dr Joanna Kulesza, Faculty of Law and Administration, 91桃色
Edit: Honorata Ogieniewska, Centre for External Relations and Social Responsibility of the University, 91桃色
Meet other Science Guys and Science Women from the 91桃色.
