Editing Scenario 05: State investigates and responds to cyber operations against private actors in its territory

Jump to navigation Jump to search

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 54: Line 54:
 
'''[L6]''' The only remaining mode of attribution is that under option 1, which reflects Article 8 of the ILC’s Draft Articles on State Responsibility (i.e., the existence of instructions, direction, or control). The three standards of "instructions", "direction", or "control" can be satisfied by different conduct, but their common feature is the need to establish a form of subordination between the non-State actor and the potentially responsible State.<ref>Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JCSL 405, 426–27 (noting that all three standards under Article 8 share the need for “a subordinate relationship between the State and the private actor”) (emphasis removed).</ref>
 
'''[L6]''' The only remaining mode of attribution is that under option 1, which reflects Article 8 of the ILC’s Draft Articles on State Responsibility (i.e., the existence of instructions, direction, or control). The three standards of "instructions", "direction", or "control" can be satisfied by different conduct, but their common feature is the need to establish a form of subordination between the non-State actor and the potentially responsible State.<ref>Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JCSL 405, 426–27 (noting that all three standards under Article 8 share the need for “a subordinate relationship between the State and the private actor”) (emphasis removed).</ref>
   
*The arguably most stringent factor of "instructions" would require "State B Digital Army" to be factually subordinate to State B, most commonly as an auxiliary, at the specific moment when the State decides to commit the acts in question. In this regard, the mere fact that State B and the "State B Digital Army" may have shared political goals and aims does not suffice for the purposes of attribution of the latter’s conduct to the former.<ref>Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JCSL 405, 415 (“the fact of a goal shared by the State and the private actor is insufficient without further evidence establishing the subordination between the two”).</ref>
+
The arguably most stringent factor of "instructions" would require "State B Digital Army" to be factually subordinate to State B, most commonly as an auxiliary, at the specific moment when the State decides to commit the acts in question. In this regard, the mere fact that State B and the "State B Digital Army" may have shared political goals and aims does not suffice for the purposes of attribution of the latter’s conduct to the former.<ref>Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JCSL 405, 415 (“the fact of a goal shared by the State and the private actor is insufficient without further evidence establishing the subordination between the two”).</ref>
  +
*The second standard would be met if an organ of State B "provided the direction pursuant to which the perpetrators of the wrongful act acted".<ref>''[https://www.icj-cij.org/files/case-related/91/091-20070226-JUD-01-00-EN.pdf Case Concerning Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro)]'' (Judgement) [2007] ICJ Rep 43, para 406.</ref> This would imply a continuing relationship of subordination between State B and "State B Digital Army", going the beyond the mere issuance of instructions without follow-up.
 
  +
The second standard would be met if an organ of State B "provided the direction pursuant to which the perpetrators of the wrongful act acted".<ref>''[https://www.icj-cij.org/files/case-related/91/091-20070226-JUD-01-00-EN.pdf Case Concerning Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro)]'' (Judgement) [2007] ICJ Rep 43, para 406.</ref> This would imply a continuing relationship of subordination between State B and "State B Digital Army", going the beyond the mere issuance of instructions without follow-up.
*Finally, the standard of "control" similarly refers to a continuing process of exercising authority by State B over an activity such as a cyber operation – to meet this standard, State B would have to go beyond merely supporting "State B Digital Army" and would have to go on to determine the execution and course of the specific cyber operation in question.
 
  +
  +
Finally, the standard of "control" similarly refers to a continuing process of exercising authority by State B over an activity such as a cyber operation – to meet this standard, State B would have to go beyond merely supporting "State B Digital Army" and would have to go on to determine the execution and course of the specific cyber operation in question.
   
 
'''[L7]''' The mere fact that some of the activities were conducted from both government and private cyber infrastructure in State B is not sufficient.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 15, para 13-14.</ref> What would need to be established is some form of subordination between the non-State actor and the potentially responsible State. As the scenario does not offer any indication of such subordination, it can be concluded that the available facts do not support the attributability of the conduct of "State B Digital Army" to State B.
 
'''[L7]''' The mere fact that some of the activities were conducted from both government and private cyber infrastructure in State B is not sufficient.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 15, para 13-14.</ref> What would need to be established is some form of subordination between the non-State actor and the potentially responsible State. As the scenario does not offer any indication of such subordination, it can be concluded that the available facts do not support the attributability of the conduct of "State B Digital Army" to State B.

Please note that all contributions to International cyber law: interactive toolkit are considered to be released under the Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) (see International cyber law: interactive toolkit:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

Cancel Editing help (opens in new window)