Attribution

From International cyber law: interactive toolkit
Jump to navigation Jump to search

As a rule, the conduct of State organs is attributable to the State in question;[1] by contrast, the conduct of non-State actors or third States’ organs can only be attributed to the State under specific circumstances.[2]

State organs and persons and entities in exercise of governmental authority[edit | edit source]

State organs and persons and entities in exercise of governmental authority
The following types of conduct of State organs and persons and entities in exercise of governmental authority are attributable to a State:
  1. The conduct of any of the organs of that State, "whether the organ exercises legislative, executive, judicial or any other functions, whatever position it holds in the organization of the State, and whatever its character as an organ of the central Government or of a territorial unit of the State";[3]
  2. The conduct of an organ of another State placed at the disposal of the State in question, if "the organ is acting in the exercise of elements of the governmental authority" of the latter State;[4]
  3. The conduct of "a person or entity which is not an organ of the State […] but which is empowered by the law of that State to exercise elements of the governmental authority, […] provided the person or entity is acting in that capacity in the particular instance."[5]

Such conduct is attributable to the State even if the organ, person or entity acting in that capacity "exceeds its authority or contravenes instructions" (acts ultra vires).[6]

Non-State actors[edit | edit source]

Non-State actors
Activities of non-State actors (groups and individuals) are generally not attributable to States. However, exceptionally such conduct is attributable to a State, in particular in situations when the actor is:
  1. "in fact acting on the instructions of, or under the direction or control of, that State in carrying out the conduct";[7]
  2. "in fact exercising elements of the governmental authority in the absence or default of the official authorities and in circumstances such as to call for the exercise of those elements of authority";[8]
  3. "an insurrectional movement which becomes the new Government of a State";[9] or
  4. "a movement, insurrectional or other, which succeeds in establishing a new State in part of the territory of a pre-existing State or in a territory under its administration".[10]

Alternatively,

  1. the conduct of a non-State actor is attributable to a State "if and to the extent that the State acknowledges and adopts the conduct in question as its own".[11]

Evidentiary standards[edit | edit source]

Evidentiary standards
Evidentiary standards applicable to the attribution of cyber activities are context-dependent. The law of State responsibility as such does not contain generally applicable burdens, standards, or methods of proof,[12] and these matters are instead ordinarily determined by the relevant forum.[13]

However, in case a State is considering a response to an internationally wrongful act, the standard of attribution is that of "reasonableness", i.e. "States must act as reasonable States would in the same or similar circumstances when considering responses to them."[14] This depends, among other factors, on the "reliability, quantum, directness, nature (e.g., technical data, human intelligence), and specificity of the relevant available information when considered in light of the attendant circumstances and the importance of the right involved."[15] Nevertheless, there is no obligation to publicly provide the evidence.[16]

Specific rules may apply to some responses, so when State A responds with countermeasures after misattributing an internationally wrongful act to State B, it commits an internationally wrongful act of its own, even though it correctly applied the "reasonableness" standard of attribution.[17]

Appendixes[edit | edit source]

See also[edit | edit source]

Notes and references[edit | edit source]

  1. ILC Articles on State Responsibility, Art 4.
  2. ILC Articles on State Responsibility, Art 8.
  3. ILC Articles on State Responsibility, Art 4(1).
  4. ILC Articles on State Responsibility, Art 6.
  5. ILC Articles on State Responsibility, Art 5.
  6. ILC Articles on State Responsibility, Art 7; Tallinn Manual 2.0, commentary to rule 15, paras. 6-7 and 12.
  7. ILC Articles on State Responsibility, Art 8; see also Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JC&SL 405.
  8. ILC Articles on State Responsibility, Art 9.
  9. ILC Articles on State Responsibility, Art 10(1).
  10. ILC Articles on State Responsibility, Art 10(2).
  11. ILC Articles on State Responsibility, Art 11.
  12. ILC Articles on State Responsibility, commentary to chapter III, para 4 ("Questions of evidence and proof of such a breach fall entirely outside the scope of the articles."); ibid, commentary to Art 19, para 8 ("Just as the articles do not deal with questions of the jurisdiction of courts or tribunals, so they do not deal with issues of evidence or the burden of proof.").
  13. Tallinn Manual 2.0, Chapter 4 Section 1, para 8.
  14. Tallinn Manual 2.0, Chapter 4 Section 1, para 10; Cf. Yeager v Islamic Republic of Iran (1987) 17 Iran-US CTR 92, 101–02 (‘[I]n order to attribute an act to the State, it is necessary to identify with reasonable certainty the actors and their association with the State.’).
  15. Tallinn Manual 2.0, Chapter 4 Section 1, para 10.
  16. According to the UK Attorney General, "[t]here is no legal obligation requiring a state to publicly disclose the underlying information on which its decision to attribute hostile activity is based, or to publicly attribute hostile cyber activity that it has suffered in all circumstances." (UK Attorney General, Jeremy Wright QC MP, 'Cyber and International Law in the 21st Century'; see also Tallinn Manual 2.0, Chapter 4 Section 1 chapeau, paragraph 13.
  17. Tallinn Manual 2.0, Chapter 4 Section 1, para 12; see also ILC Articles on State Responsibility, Art 49, para 3 (“A State taking countermeasures acts at its peril, if its view of the question of wrongfulness turns out not to be well founded.”)

Bibliography and further reading[edit | edit source]