When must states protect people from abuses committed by third parties?That obligation (termed the “obligation to protect”) is everywhere in modern human rights law. Consider a few examples of how decisionmakers prescribe, invoke, or apply it:
► Under the Convention on the Rights of the Child, states must take measures to protect children from “physical or mental violence…while in the care of parent(s).”
► Non-refoulement prohibits states from returning people home if there is a risk of third-party harm. A state that deports someone despite that risk typically does not participate in the abuse. Rather, the deporting state fails to satisfy an obligation to protect.
► The International Court of Justice (bottom right) has interpreted the Genocide Convention to require states to protect people from acts of genocide committed by or in another state.
► The concept of responsibility to protect posits: (1) that each state must protect its population from certain atrocities, including atrocities committed by third parties; and (2) if one state fails to satisfy that obligation, it shifts to the international community.
► The International Law Commission (below left) has proposed a rule rendering states responsible where they delegate authority to an international organization that then violates rights. (photo credit) Under the proposal, a delegating state would be responsible even if the abuse were attributable only to the international organization.
In each of those examples, the state must protect someone from third-party abuse.
The entity committing the abuse may be a private actor, another state, or an IO. The critical point is that the duty-holding state may be responsible simply for standing by—for not satisfying an affirmative obligation to protect. The state need not participate in the abuse to be 
responsible.
Though the obligation to protect is prevalent, no generalized framework exists for appraising when states have it or what it requires.
responsible.Though the obligation to protect is prevalent, no generalized framework exists for appraising when states have it or what it requires.
Instead, decisionmakers prescribe and apply the obligation ad hoc — under different sources of law and for discrete groups of victims (e.g., children), harms (e.g., physical violence), or abusers (e.g., private individuals). As a result, states' practice is splintered and, at times, inconsistent or confused. My article State Bystander Responsibility, published earlier this year in the European Journal of International Law, seeks to remedy that problem by presenting a generalized framework on when states are and should be responsible for failing to protect people from third-party harm.
The framework explains the practice where it is uniform, and helps guide decisions where the practice is inconsistent or confused:
First, whether a state has the obligation depends on its relationship with the (actual or potential) abuser.
First, whether a state has the obligation depends on its relationship with the (actual or potential) abuser.
A duty-holding state must restrain third parties from committing abuse. Of course, the interest in protecting potential victims favors establishing that obligation. But varied considerations favor limiting when and how states assert their authority over third parties. The obligation thus requires a normative judgment: Given its particular relationship with the third party, are the state’s restraints desirable or overly intrusive? The practice provides considerable guidance on that question. A state generally must restrain third parties to whom it delegates governmental functions or who operate in its territory (or in territory under its control). By contrast, a state generally need not restrain third parties in other states. Broad assertions to the contrary do not 
reflect legally operative obligations. Consider, for instance, the responsibility to protect contention that all states must restrain any particular state which commits atrocities. Such an assertion is essentially unenforceable and in practice unenforced against particular bystander states.
reflect legally operative obligations. Consider, for instance, the responsibility to protect contention that all states must restrain any particular state which commits atrocities. Such an assertion is essentially unenforceable and in practice unenforced against particular bystander states.Nevertheless, the general rule that states lack extraterritorial obligations to protect is subject to an important exception: A state may have that obligation where it substantially enables a third party to violate rights. In that event, the duty-holding state may or may not participate in the abuse under the traditional rules on attribution. But having enabled the abuser, the state must protect against its harm. A few examples:
► Serbia had to restrain the Bosnian Serbs in the ICJ's Genocide Case. (prior IntLawGrrls post)
► Russia had to restrain Georgian and Moldovan separatists that it supported.
► Turkey had to restrain the Turkish Cypriot administration that it propped up.
► And arguably at least, deporting states enable entities in the home country to violate rights, thus triggering obligations of non-refoulement. 
Second, obligations to protect depend on the kind of harm caused. States must protect only against conduct that:
Second, obligations to protect depend on the kind of harm caused. States must protect only against conduct that:
(1) causes serious physical or psychological harm; or
(2) affects someone because she belongs to a vulnerable group.
Treaty bodies sometimes assert that states also must protect against other conduct, especially where the abuser is a private actor. That assertion is inconsistent with substantial other practice. Indeed, the treaty bodies themselves apply the obligation more narrowly—and almost exclusively to conduct falling in the above two categories. Thus, states must restrain an employer who beats its employees (category 1) or discriminates on the basis of sex (category 2). But they need not restrain an employer from terminating an employee who is a bad worker or no longer needed. Yes, the termination affects the employee’s right to work. It does not trigger an obligation to protect because the state need not restrain the employer to protect its employees from termination. Rather, the state must try to fulfill the employees’ right to work by, for instance, offering them educational programs.
Finally, a state that has the obligation — because of its relationship with the third party and the severity of the harm — must take reasonable measures to restrain the third party. Reasonableness depends on context, but several factors inform whether particular measures are reasonable:
Finally, a state that has the obligation — because of its relationship with the third party and the severity of the harm — must take reasonable measures to restrain the third party. Reasonableness depends on context, but several factors inform whether particular measures are reasonable:
(1) the nature of the abuser (i.e., whether a private actor, another state, or an international organization);
(2) the nature of the harm;
(3) whether the practice specifically identifies the measures the state must take (e.g., requires criminal action) or leaves that determination to each state’s discretion;
(4) the scale of the problem; and
(5) the state’s capacity to take more effective measures. A duty-holding state is responsible if it takes either no measures or measures that are unreasonably lax to restrain the third party.
