Attribution, Omission and Proof: Rethinking State Responsibility for State-Sponsored Cyber Operations

Source abstract

<p><span>Debates on state responsibility for cyber operations frequently question the adequacy of existing rules of attribution and advocate a more permissive standard, often through the substitution of the effective control test with the broader overall control test. This article challenges the assumption that the attribution framework is the principal source of the accountability gap in cyberspace. It argues that the rules reflected in the International Law Commission’s Articles on Responsibility of States for Internationally Wrongful Acts provide a coherent and technologically neutral framework for determining state responsibility. The principal difficulty lies not in the legal standards of attribution themselves, but in the evidentiary, substantive and remedial obstacles that limit their effective application to cyber operations. The article identifies three interrelated challenges. The first is that the absence of sufficiently developed and generally accepted evidentiary standards complicates the establishment of state involvement in cyber operations. Secondly, there are uncertainty regarding the existence and scope of a general obligation of cyber due diligence, particularly in circumstances where harmful conduct cannot be attributed directly to a state. Thirdly, the practical limitations of implementing the legal consequences of state responsibility undermine the availability of effective remedies. To examine these challenges, the article analyses the effective control jurisprudence of <i>Nicaragua</i> and <i>Bosnian Genocide</i>, the due-diligence principle articulated in <i>Corfu Channel</i>, and the application of the rules governing sovereignty, non-intervention and the prohibition of the use of force to cyber operations. It further considers the principles governing cessation, reparation and guarantees of non-repetition. The article concludes that strengthening accountability for cyber operations requires the clarification and consistent application of existing international law rather than a fundamental revision of the attribution framework. It proposes the development of a graduated evidentiary approach that accounts for the seriousness of the allegation and the legal consequences sought; a context-sensitive understanding of preventive obligations based on a state’s knowledge, capacity and applicable existing legal duties; and greater emphasis on cessation and guarantees of non-repetition as remedies responsive to the continuing and potentially recurrent nature of cyber harm. This article provides a practical framework for holding countries accountable for malicious cyber activities without disrupting existing international legal standards<b>.</b> Instead of just focusing on proving who launched a cyberattack, the study looks at the bigger picture of state responsibility.</span></p>