Attribution

Definition
Attribution of cyber activities is context-dependent – there are no universal ready-made ‘burdens, standards, and methods of proof’.

However, in case a State is considering a response to an internationally wrongful act, as opposed to, for instance, providing evidence in a case before the ICJ, the standard of attribution is that of ‘reasonableness’, i.e. ‘States must act as reasonable States would in the same or similar circumstances when considering responses to them.’ Specific rules may apply to some responses, so according to a majority of the experts drafting the Tallinn Manual 2.0, when State A responds with countermeasures after misattributing an internationally wrongful act to State B, it commits an internationally wrongful act of its own, even though it correctly applied the ‘reasonableness’ standard of attribution.

A State generally takes attribution for the conduct of its organs; the conduct of non-State actors or third States’ organs can be attributed to it only under specific circumstances.

Bibliography and further reading

 * MN Schmitt (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (CUP 2017)
 * Etc.