Skip to main content
Disciplines
Automotive Business IT + Informatics Construction + Real Estate Electrical Engineering + Electronics Energy + Sustainability Insurance + Risk Finance + Banking Management + Leadership Marketing + Sales Mechanical Engineering + Materials
Events
DE
EN
Books
Journals
Topic Page
Marketing
Start single access now
Access for companies
EXTENDED SEARCH
Log in
Top
Published in:
High-Tech Migration Control in the EU and Beyond: The Legal Challenges of “Enhanced Interoperability” Read chapter Read first chapter

2019 | OriginalPaper | Chapter

Attribution to State of Cyber Operations Conducted by Non-State Actors

Author : François Delerue

Published in: Use and Misuse of New Technologies

Publisher: Springer International Publishing

Log in

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

State-sponsored cyber operations constitute a real challenge for the law of State responsibility. One of the main issues is the impossibility in most cases, at least to date, to identify clearly the perpetrators of cyber operations, either individuals or State agents, and to determine whether their conducts are attributable to States or other subjects of international law. Most cyber operations generally alleged to be state-sponsored have not been clearly attributed to a State yet. International law cannot bring a solution to the technical problem of attribution. However, attribution cannot be limited to its technical aspects. Generally, attribution of cyber conducts has three different dimensions: firstly, the attribution to the machine from which the cyber operation was launched or had transited; secondly, the attribution to the person who conducted the cyber operations; and thirdly, the attribution to an aggregate entity, notably a State. The present Chapter focuses on attribution from an international law perspective, that is to say attribution of a conduct to a State or another subject of international law. More specifically, it focuses on the specific question of attribution of cyber operations conducted by non-state actors under the instructions, direction or control of the State.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

inform now
previous chapter Who Is to Blame for Autonomous Weapons Systems’ Misdoings?
next chapter The Use of Unarmed Drones in UN Peacekeeping Operations: Issues of Attribution
Footnotes
1
Tsagourias (2012), p. 233; Tait (2016).
 
2
Landau and Clark (2010), p. 37; Clark et al. (2014), p. 58; Roscini (2015a), p. 240; republished with minor changes in: Roscini (2015b).
 
3
Brenner (2007), pp. 380 and 405.
 
4
ICJ, Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Merits, 27 June 1986, ICJ Reports 1986, pp. 38–39, para. 57.
 
5
ICJ, Corfu Channel (United Kingdom of Great Britain and Northern Ireland v. Albania), Judgment on the Merits, 9 April 1949, ICJ Reports 1949, p. 18; De Frouville (2010), p. 261.
 
6
De Frouville (2010), pp. 261–264.; see also Klabbers (2013), p. 128; ILC (2001), p. 47, commentary to Article 8, para. 1. For instance, in the Tehran Hostage case, the Court did not use the fact that the group of militant students, who occupied the US embassy in Tehran and US consulates in Shiraz and Tabriz, were Iranian citizens in order to attribute their conduct to Iran: ICJ, United States Diplomatic and Consular Staff in Tehran (United States of America v. Iran), Judgment, 24 May 1980, ICJ Reports 1980, pp. 30–31, paras. 58–60. The Court, however, noted that this “does not mean that Iran is, in consequence, free of any responsibility in regard to those attacks” (ibid., para. 61).
 
7
See for instance: De Frouville (2010), pp. 265–271; Palchetti (2010) and Cassese (2007).
 
8
ICJ, Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro), Judgment, 26 February 2007, ICJ Reports 2007, p. 207, para. 397.
 
9
Ibid., paras. 385–389.
 
10
Ibid., paras. 390–395.
 
11
Ibid., paras. 396–412.
 
12
Milanovic (2006), pp. 577, 583; Talmon (2009), p. 502.
 
13
See, however, the contrary view expressed in Cassese (2007), p. 650.
 
14
The Court followed the same reasoning in two steps, first the “strict control test” and second the “effective control test” in both Armed Activities (Judgment) cit.; and Bosnian genocide (Judgment) cit.
 
15
Cassese (2007), pp. 642–655.
 
16
“UCLA” stands for “Unilaterally Controlled Latino Assets” and refers to “persons of the nationality of unidentified Latin American countries, paid by, and acting on the direct instructions of, United States military or intelligence personnel”. This acronym borrowed from the CIA’s vocabulary was used by the ICJ in the Nicaragua case, Nicaragua (Merits) cit., para. 75.
 
17
Ibid.
 
18
Ibid., para 86.
 
19
Ibid., paras. 109–110, 115.
 
20
Milanovic (2006), p. 577; Talmon (2009), p. 502.
 
21
Talmon (2009), p. 502; Álvarez Ortega (2015), p. 11.
 
22
Nicaragua (Merits) cit., para. 115.
 
23
Ibid., para. 116. The Court found, however, the United States responsible for their own conduct in relation to the Contras, constituting violations of the principle of non-intervention and of the sovereignty of Nicaragua. Ibid., pp. 146–147, holdings paras. 3 and 5.
 
24
Nicaragua (Merits) cit., paras. 109–110, 115.
 
25
Cassese (2007), p. 653.
 
26
ICJ, Application of the Republic of Nicaragua, Application instituting proceedings, case concerning military and paramilitary activities in and against Nicaragua (Nicaragua v. United States of America) (filed in the registry of the International Court of Justice on 9 April 1984), p. 16, para. 26.
 
27
Nicaragua (Merits) cit., para. 228.
 
28
Klabbers (2013), p. 129.
 
29
Armed Activities (Judgment) cit.; Bosnian genocide (Judgment) cit.
 
30
ICTY, Trial Chamber, Prosecutor v Dusko Tadić (Trial Judgement), Judgment of 7 May 1997, IT-94-1-T; ICTY, Appeals Chamber, Prosecutor vs Dusko Tadić (Judgment), Judgment of 15 July 1999, IT-94-1-A.
 
31
ICTY, Tadić (Appeals Chamber), cit.; for the purpose of this Section we focus on the Appeal Chamber decision, the question of attribution has also been dealt with in the first instance of the case: ICTY, Tadić (Trial Judgement) cit.
 
32
ICTY, Appeals Chamber, Prosecutor v. Zlatko Aleksovski, IT-95-14/1-A, Judgment of 24 March 2000 57, para. 145; ICTY, Appeals Chamber, Prosecutor v. Zenjnil Delalić Zdravko Musić also known as ‘PAVO’ and Hazim Delić Esad Landzo also known as ‘ZENGA’ (Čelebići Camp) (Appeal Judgement), Judgment of 20 February 2001, Case No. IT-96-21-A 8, para. 20; ICTY, Trial Chamber, The Prosecutor v Dario Kordić & Mario Čerkez (Judgment), IT-95-14/2-T, Judgment of 26 February 2001, 32, para. 112. See also Shaw (2014), p. 575; Klabbers (2013), p. 129.
 
33
ICTY, Tadić (Appeals Chamber) cit., pp. 43–42, para. 104; (“What is at issue is not the distinction between the two classes of responsibility. What is at issue is a preliminary question: that of the conditions on which under international law an individual may be held to act as a de facto organ of a State. Logically these conditions must be the same both in the case: (i) where the court’s task is to ascertain whether an act performed by an individual may be attributed to a State, thereby generating the international responsibility of that State; and (ii) where the court must instead determine whether individuals are acting as de facto State officials, thereby rendering the conflict international and thus setting the necessary precondition for the ‘grave breaches’ regime to apply. In both cases, what is at issue is not the distinction between State responsibility and individual criminal responsibility. Rather, the question is that of establishing the criteria for the legal imputability to a State of acts performed by individuals not having the status of State officials. In the one case these acts, if they prove to be attributable to a State, will give rise to the international responsibility of that State; in the other case, they will ensure that the armed conflict must be classified as international”).
 
34
It was for instance the case in the analysis made by the ICJ: Bosnian genocide (Judgment) cit., para. 405.
 
35
Statute of the International Tribunal for the Prosecution of Persons Responsible for Serious Violations of International Humanitarian Law Committed in the Territory of the Former Yugoslavia since 1991 (adopted by UNSC Res 827 (1993) of 25 May 1993 amended by UNSC Res 1166 (1998) of 13 May 1998, Res 1329 (2000) of 30 November 2000, Res 1411 (2002) of 17 May 2002 and Res 1431 (2002) of 14 August 2002), Article 2 “Grave breaches of the Geneva Conventions of 1949”: “The International Tribunal shall have the power to prosecute persons committing or ordering to be committed grave breaches of the Geneva Conventions of 12 August 1949, namely the following acts against persons or property protected under the provisions of the relevant Geneva Convention: (a) wilful killing; (b) torture or inhuman treatment, including biological experiments; (c) wilfully causing great suffering or serious injury to body or health; (d) extensive destruction and appropriation of property, not justified by military necessity and carried out unlawfully and wantonly; (e) compelling a prisoner of war or a civilian to serve in the forces of a hostile power; (f) wilfully depriving a prisoner of war or a civilian of the rights of fair and regular trial; (g) unlawful deportation or transfer or unlawful confinement of a civilian; (h) taking civilians as hostages”.
 
36
ICTY, Tadić (Appeals Chamber) cit., para 80(i).
 
37
Ibid., para. 86.
 
38
Ibid., para. 84.
 
39
Ibid., para. 87.
 
40
Ibid., para. 98.
 
41
Ibid., para 99 ff.; see also Cassese (2007), pp. 653–655; Milanovic (2006), pp. 579–580.
 
42
ICTY, Tadić (Appeals Chamber) cit., para 115.
 
43
Ibid., para 116.
 
44
Ibid., para 124.
 
45
ICTY, Trial Chamber, Prosecutor v Dusko Tadić (Trial Judgement), Judgment of 7 May 1997, IT-94-1-T ‘Separate and Dissenting Opinion of Judge Mcdonald Regarding the Applicability of Article 2 of the Statute’, p. 288; De Hoogh (2002), p. 290; Milanovic (2006), p. 581; Talmon (2009), p. 507.
 
46
Mexico-United States General Claims Commission, Charles S. Stephens and Bowman Stephens (U.S.A.) v. United Mexican States, Judgment of 15 July 1927, RIAA 4, pp. 266–267; cited in ICTY, Tadić (Appeals Chamber) cit., p. 51, para 125.
 
47
Iran-US CTR, Yeager v. The Islamic Republic of Iran, Judgment of 2 November 1987, Iran-US CTR p. 17, p. 92; cited in: ICTY, Tadić (Appeals Chamber) cit., pp. 52–53, paras. 126–127.
 
48
Loizidou v. Turkey (Application No. 15318/89), ECtHR[GC], Judgment of 18 December 1996, cited in: ICTY, Tadić (Appeals Chamber) cit., p. 54, para. 128.
 
49
ICTY, Tadić (Appeals Chamber) cit., p. 54, para. 129.
 
50
Milanovic (2006), pp. 585–587. Antonio Cassese, who acted as a judge in the Tadić case, answered the critics of Marko Milanović in an article: Cassese (2007), p. 658, footnote 17. Antonio Cassese also argued that the approach developed in the Tadić case has been adopted in subsequent international cases and practice: ibid., pp. 659–661, especially footnotes 18–19.
 
51
See generally the analysis in Mahiou (2009), pp. 433–435.
 
52
ICTY, Tadić (Appeals Chamber) cit., para 117.
 
53
Ibid., para. 117; for a comprehensive analysis see Cassese (2007), pp. 655–663.
 
54
ICTY, Tadić (Appeals Chamber) cit., paras. 118–119.
 
55
Ibid., para. 141.
 
56
Cassese (2007), p. 657.
 
57
ICTY, Tadić (Appeals Chamber) cit., para. 120.
 
58
Ibid., paras. 131 and 137. See generally Cassese (2007), p. 657; Talmon (2009), pp. 506–507.
 
59
ICTY, Kordić & Čerkez (Trial Judgment) cit., para 115; ICTY, Trial Chamber, Prosecutor V. Mladen Naletilić, aka “Tuta” and Vinko Martinović, aka “Štela”, IT-98-34-T, Judgment of 31 March 2003, para. 198; ICTY, Appeals Chamber, The Prosecutor v Dario Kordić & Mario Čerkez, IT-95-14/2-A, Judgment of 17 December 2004, para. 361.
 
60
ICTY, Tadić (Appeals Chamber) cit., paras. 131 and 137; ICTY, Čelebići (Appeal Judgement) cit., para 15. See also Talmon (2009), p. 506.
 
61
ICTY, Tadić (Appeals Chamber) cit., para. 162.
 
62
ICTY, Tadić (Trial Judgement) cit., para. 607.
 
63
Bosnian genocide (Judgment) cit., para. 397.
 
64
ICTY, Trial Chamber, Prosecutor v Dusko Tadić (Trial Judgement), Judgment of 7 May 1997, IT-94-1-T ‘Separate and Dissenting Opinion of Judge Mcdonald Regarding the Applicability of Article 2 of the Statute’, p. 288; see also De Hoogh (2002), p. 290; Milanovic (2006), p. 581; Griebel and Plücken (2008), pp. 612–613; Talmon (2009), p. 507.
 
65
Bosnian genocide (Judgment) cit., para. 406; ILC (2001), p. 48, commentary to Article 8, para. 5.
 
66
Kreß (2001), p. 131; Talmon (2009), pp. 506–507.
 
67
The literature on cyber operations and international law has also mislead by this confusion: Schmitt (2013), p. 32, commentary to Rule 6, para. 10; Woltag (2014), pp. 89–91.
 
68
Articles on Responsibility of States for Internationally Wrongful Acts (adopted by the International Law Commission at its 53rd session in 2001, annexed to General Assembly resolution 56/83 of 12 December 2001, and corrected by document A/56/49(Vol I)/Corr4), Article 8.
 
69
Francioni (2011), p. 103; Milanovic (2009), pp. 309–310.
 
70
De Frouville (2010), p. 271; see however Cassese (2007), pp. 663–665.
 
71
Milanovic (2006), p. 583.
 
72
ILC (2001), p. 49, commentary to Article 8, para. 9.
 
73
Ibid., p. 48, commentary to Article 8, para. 7.
 
74
Ibid., p. 47, commentary to Article 8, para. 1.
 
75
Armed Activities (Judgment) cit.; Bosnian genocide (Judgment) cit.
 
76
Armed Activities (Judgment) cit., para. 160.
 
77
Ibid., para. 161.
 
78
Bosnian genocide (Judgment) cit., paras. 406–407; Abass (2007), p. 890; Griebel and Plücken (2008), pp. 606–611.
 
79
On the question of attribution in the Bosnian Genocide case, see generally: Griebel and Plücken (2008) and Milanovic (2009).
 
80
Bosnian genocide (Judgment) cit., paras. 297 and 376.
 
81
Ibid., para. 384.
 
82
Ibid., paras. 385–389.
 
83
Nicaragua (Merits) cit., paras. 109–110.
 
84
Bosnian genocide (Judgment) cit., paras. 390–395.
 
85
Ibid., para. 397; the analysis of the question of attribution on the basis of direction or control is dealt with at paras. 396–412.
 
86
Ibid., para. 397; see the critical analysis of the reasoning of the Court on Article 8 of the Articles on State Responsibility in: Griebel and Plücken (2008). Marco Milanović criticized the interpretation made by these authors in Milanovic (2009).
 
87
Bosnian genocide (Judgment) cit., para. 405.
 
88
Ibid., para. 406.
 
89
Ibid., para. 407.
 
90
Ibid., para. 412.
 
91
ILC (2001), pp. 47–49, commentary to Article 8.
 
92
Shackelford (2009), p. 27; Schmitt (2013), pp. 29–34, commentary to Rule 6, paras. 1–14; Woltag (2014), pp. 87–94; Roscini (2010), p. 100.
 
93
Shackelford (2009), p. 203; Woltag (2014), p. 91.
 
94
Roscini (2010), pp. 100–101; Woltag (2014), pp. 90–93.
 
95
Tikk and Kaska (2010).
 
96
Harju County Court (Estonia), Dmitri Galuškevitš, No. 1-07-15185, Judgment of 13 December 2007; Lindau (2012) and Ottis (2008).
 
97
RIA Novosti (2007).
 
98
Clover (2009).
 
99
Radio Free Europe/Radio Liberty (2009).
 
100
BBC (2008).
 
101
Tikk et al. (2010).
 
102
See generally Lehnardt (2007), Tonkin (2011), Francioni and Ronzitti (2011), Bakker and Sossai (2012) and Tougas (2012).
 
103
Francioni (2011), p. 102.
 
Literature
Abass, Ademola. 2007. Proving State Responsibility for Genocide: The ICJ in Bosnia v. Serbia and the International Commission of Inquiry for Darfur. Fordham International Law Journal 31: 871–910.
Álvarez Ortega, Elena-Laura. 2015. The Attribution of International Responsibility to a State for Conduct of Private Individuals Within the Territory of Another State. InDret, 1–40
Bakker, Christine, and Mirko Sossai, eds. 2012. Multilevel Regulation of Military and Security Contractors: The Interplay Between International, European and Domestic Norms. Oxford: Hart.
Brenner, Susan W. 2007. “At Light Speed”: Attribution and Response to Cybercrime/Terrorism/Warfare. The Journal of Criminal Law and Criminology 97: 379–475.
Cassese, Antonio. 2007. The Nicaragua and Tadić Tests Revisited in Light of the ICJ Judgment on Genocide in Bosnia. European Journal of International Law 18: 649–668.CrossRef
Clark, David, Thomas Berson, and Herbert S. Lin, eds. 2014. At the Nexus of Cybersecurity and Public Policy: Some Basic Concepts and Issues. Washington, DC: National Academies Press.
De Frouville, Olivier. 2010. Attribution of Conduct to the State: Private Individuals. In The Law of International Responsibility, ed. Alain Pellet et al., 257–280. Oxford: Oxford University Press.
De Hoogh, André. 2002. Articles 4 and 8 of the 2001 ILC Articles on State Responsibility, the Tadić Case and Attribution of Acts of Bosnian Serb Authorities to the Federal Republic of Yugoslavia. British Yearbook of International Law 72: 255–292.CrossRef
Francioni, Francesco. 2011. The Role of the Home State in Ensuring Compliance with Human Rights by Private Military Contractors. In War by Contract: Human Rights, Humanitarian Law, and Private Contractors, ed. Francesco Francioni and Natalino Ronzitti, 93–110. Oxford: Oxford University Press.CrossRef
Francioni, Francesco, and Natalino Ronzitti, eds. 2011. War by Contract: Human Rights, Humanitarian Law, and Private Contractors. Oxford: Oxford University Press.
Griebel, Jörn, and Milan Plücken. 2008. New Developments Regarding the Rules of Attribution? The International Court of Justice’s Decision in Bosnia v. Serbia. Leiden Journal of International Law 21: 601–622.CrossRef
International Law Commission (ILC). 2001. Commentary to the Articles on State Responsibility. ILC Yearbook (Part II) 2: 31–143.
Klabbers, Jan. 2013. International Law. Cambridge: Cambridge University Press.CrossRef
Kreß, Claus. 2001. L’organe de facto en droit international public: Réflexions sur l’imputation à l’etat de l’acte d’un particulier à la lumière du développements récents. Revue Générale de Droit International Public 105: 93–144.
Landau, Susan, and David D. Clark. 2010. Untangling Attribution. In Proceedings of a Workshop on Deterring Cyber Attacks: Informing Strategies and Developing Options for U.S. Policy, 25–40. Washington, DC: National Academies Press; Committee on Deterring Cyberattacks: Informing Strategies and Developing Options.
Lehnardt, Chia. 2007. Private Military Companies and State Responsibility. In From Mercenaries to Market: The Rise and Regulation of Private Military Companies, ed. Simon Chesterman and Chia Lehnardt, 129–157. Oxford: Oxford University Press.
Lindau, Katri. 2012. Cyber Security in Estonia: Lessons from the Year 2007 Cyberattack. Tallinn University.
Mahiou, Ahmed. 2009. Le droit international ou la dialectique de la rigueur et de la flexibilité: cours général de droit international. Le Recueil des Cours de l’Académie de Droit International de La Haye 337: 9–516.
Milanovic, Marko. 2006. State Responsibility for Genocide. European Journal of International Law 17: 553–604.CrossRef
———. 2009. State Responsibility for Acts of Non-State Actors: A Comment on Griebel and Plücken. Leiden Journal of International Law 22: 307–324.CrossRef
Ottis, Rain. 2008. Analysis of the 2007 Cyber Attacks Against Estonia from the Information Warfare Perspective. In Proceedings of the 7th European Conference on Information Warfare and Security, Plymouth, 163–168.
Roscini, Marco. 2010. World Wide Warfare - Jus ad bellum and the Use of Cyber Force. Max Planck Yearbook of United Nations Law 14: 85–130.CrossRef
———. 2015a. Evidentiary Issues in International Disputes Related to State Responsibility for Cyber Operations. Texas International Law Journal 50: 233–273.
———. 2015b. Evidentiary Issues in International Disputes Related to State Responsibility for Cyber Operations. In Cyber War: Law and Ethics for Virtual Conflicts, ed. Claire Finkelstein, Jens David Ohlin, and Kevin Govern, 215–248. Oxford: Oxford University Press.
Schmitt, Michael N., ed. 2013. The Tallinn Manual on the International Law Applicable to Cyber Warfare. Cambridge: Cambridge University Press.
Shackelford, Scott. 2009. From Nuclear War to Net War: Analogizing Cyber Attacks in International Law. British Journal of International Law 27: 192–251.
Shaw, Malcolm N. 2014. International Law. 7th ed. Cambridge: Cambridge University Press.
Talmon, Stefan. 2009. The Responsibility of Outside Powers for Acts of Secessionist Entities. International & Comparative Law Quarterly 58: 493–517.CrossRef
Tikk, Eneken, and Kadri Kaska. 2010. Legal Cooperation to Investigate Cyber Incidents: Estonian Case Study and Lessons. In 9th European Conference on Information Warfare and Security, Thessaloniki, Greece, 288–294.
Tonkin, Hannah. 2011. State Control Over Private Military and Security Companies in Armed Conflict. Cambridge: Cambridge University Press.CrossRef
Tougas, Marie-Louise. 2012. Droit international, sociétés militaires privées et conflit armé: Entre incertitudes et responsabilités. Bruxelles: Bruylant.
Tsagourias, Nicholas. 2012. Cyber Attacks, Self-defence and the Problem of Attribution. Journal of Conflict and Security Law 17: 229–244.CrossRef
Woltag, Johann-Christof. 2014. Cyber Warfare: Military Cross-Border Computer Network Operations Under International Law. Cambridge: Intersentia.CrossRef
Metadata
Title
Attribution to State of Cyber Operations Conducted by Non-State Actors
Author
François Delerue
Copyright Year
2019
Book
Use and Misuse of New Technologies

Print ISBN: 978-3-030-05647-6

Electronic ISBN: 978-3-030-05648-3

Copyright Year: 2019

DOI
https://doi.org/10.1007/978-3-030-05648-3_12