Attribution: Difference between revisions
Line 42: | Line 42: | ||
|[[File:Maki-veterinary-15.svg|left|frameless|200x200px]]Evidentiary standards applicable to the attribution of cyber activities are context-dependent. The law of State responsibility as such does not contain generally applicable burdens, standards, or methods of proof,<ref>ILC [http://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf Articles on State Responsibility], commentary to chapter III, para 4 ("Questions of evidence and proof of such a breach fall entirely outside the scope of the articles."); ibid, commentary to Art 19, para 8 ("Just as the articles do not deal with questions of the jurisdiction of courts or tribunals, so they do not deal with issues of evidence or the burden of proof.").</ref> and these matters are instead ordinarily determined by the relevant forum.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1, para 8.</ref> |
|[[File:Maki-veterinary-15.svg|left|frameless|200x200px]]Evidentiary standards applicable to the attribution of cyber activities are context-dependent. The law of State responsibility as such does not contain generally applicable burdens, standards, or methods of proof,<ref>ILC [http://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf Articles on State Responsibility], commentary to chapter III, para 4 ("Questions of evidence and proof of such a breach fall entirely outside the scope of the articles."); ibid, commentary to Art 19, para 8 ("Just as the articles do not deal with questions of the jurisdiction of courts or tribunals, so they do not deal with issues of evidence or the burden of proof.").</ref> and these matters are instead ordinarily determined by the relevant forum.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1, para 8.</ref> |
||
However, in case a State is considering a response to an internationally wrongful act, the standard of attribution is that of "reasonableness", i.e. "States must act as reasonable States would in the same or similar circumstances when considering responses to them."<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1, para 10; Cf. ''Yeager v Islamic Republic of Iran'' (1987) 17 Iran-US CTR 92, 101–02 (‘[I]n order to attribute an act to the State, it is necessary to identify with reasonable certainty the actors and their association with the State.’).</ref> This depends, among other factors, on the "reliability, quantum, directness, nature (e.g., technical data, human intelligence), and specificity of the relevant available information when considered in light of the attendant circumstances and the importance of the right involved."<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1, para 10.</ref>Nevertheless, there is no obligation to publicly provide the evidence.<ref>According to the UK Attorney General, "[t]here is no legal obligation requiring a state to publicly disclose the underlying information on which its decision to attribute hostile activity is based, or to publicly attribute hostile cyber activity that it has suffered in all circumstances." (UK Attorney General, Jeremy Wright QC MP, '[https://www.gov.uk/government/speeches/cyber-and-international-law-in-the-21st-century Cyber and International Law in the 21st Century]'; see also [https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1 chapeau, paragraph 13.</ref> |
However, in case a State is considering a response to an internationally wrongful act, the standard of attribution is that of "reasonableness", i.e. "States must act as reasonable States would in the same or similar circumstances when considering responses to them."<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1, para 10; Cf. ''Yeager v Islamic Republic of Iran'' (1987) 17 Iran-US CTR 92, 101–02 (‘[I]n order to attribute an act to the State, it is necessary to identify with reasonable certainty the actors and their association with the State.’).</ref> This depends, among other factors, on the "reliability, quantum, directness, nature (e.g., technical data, human intelligence), and specificity of the relevant available information when considered in light of the attendant circumstances and the importance of the right involved."<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1, para 10.</ref> Nevertheless, there is no obligation to publicly provide the evidence.<ref>According to the UK Attorney General, "[t]here is no legal obligation requiring a state to publicly disclose the underlying information on which its decision to attribute hostile activity is based, or to publicly attribute hostile cyber activity that it has suffered in all circumstances." (UK Attorney General, Jeremy Wright QC MP, '[https://www.gov.uk/government/speeches/cyber-and-international-law-in-the-21st-century Cyber and International Law in the 21st Century]'; see also [https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1 chapeau, paragraph 13.</ref> |
||
Specific rules may apply to some responses, so when State A responds with countermeasures after misattributing an internationally wrongful act to State B, it commits an internationally wrongful act of its own, even though it correctly applied the "reasonableness" standard of attribution.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1, para 12; see also ILC Articles on State Responsibility, Art 49, para 3 (“A State taking countermeasures acts at its peril, if its view of the question of wrongfulness turns out not to be well founded.”)</ref> |
Specific rules may apply to some responses, so when State A responds with countermeasures after misattributing an internationally wrongful act to State B, it commits an internationally wrongful act of its own, even though it correctly applied the "reasonableness" standard of attribution.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Chapter 4 Section 1, para 12; see also ILC Articles on State Responsibility, Art 49, para 3 (“A State taking countermeasures acts at its peril, if its view of the question of wrongfulness turns out not to be well founded.”)</ref> |
Revision as of 12:59, 4 January 2019
As a rule, the conduct of State organs is attributable to the State in question;[1] by contrast, the conduct of non-State actors or third States’ organs can only be attributed to the State under specific circumstances.[2]
State organs and persons and entities in exercise of governmental authority
State organs and persons and entities in exercise of governmental authority |
---|
The following types of conduct of State organs and persons and entities in exercise of governmental authority are attributable to a State:
Such conduct is attributable to the State even if the organ, person or entity acting in that capacity "exceeds its authority or contravenes instructions" (acts ultra vires).[6] |
Non-State actors
Non-State actors |
---|
Activities of non-State actors (groups and individuals) are generally not attributable to States. However, exceptionally such conduct is attributable to a State, in particular in situations when the actor is:
Alternatively,
|
Evidentiary standards
Evidentiary standards |
---|
Evidentiary standards applicable to the attribution of cyber activities are context-dependent. The law of State responsibility as such does not contain generally applicable burdens, standards, or methods of proof,[12] and these matters are instead ordinarily determined by the relevant forum.[13]
However, in case a State is considering a response to an internationally wrongful act, the standard of attribution is that of "reasonableness", i.e. "States must act as reasonable States would in the same or similar circumstances when considering responses to them."[14] This depends, among other factors, on the "reliability, quantum, directness, nature (e.g., technical data, human intelligence), and specificity of the relevant available information when considered in light of the attendant circumstances and the importance of the right involved."[15] Nevertheless, there is no obligation to publicly provide the evidence.[16] Specific rules may apply to some responses, so when State A responds with countermeasures after misattributing an internationally wrongful act to State B, it commits an internationally wrongful act of its own, even though it correctly applied the "reasonableness" standard of attribution.[17] |
Appendixes
See also
Notes and references
- ↑ ILC Articles on State Responsibility, Art 4.
- ↑ ILC Articles on State Responsibility, Art 8.
- ↑ ILC Articles on State Responsibility, Art 4(1).
- ↑ ILC Articles on State Responsibility, Art 6.
- ↑ ILC Articles on State Responsibility, Art 5.
- ↑ ILC Articles on State Responsibility, Art 7; Tallinn Manual 2.0, commentary to rule 15, paras. 6-7 and 12.
- ↑ ILC Articles on State Responsibility, Art 8; see also Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JC&SL 405.
- ↑ ILC Articles on State Responsibility, Art 9.
- ↑ ILC Articles on State Responsibility, Art 10(1).
- ↑ ILC Articles on State Responsibility, Art 10(2).
- ↑ ILC Articles on State Responsibility, Art 11.
- ↑ ILC Articles on State Responsibility, commentary to chapter III, para 4 ("Questions of evidence and proof of such a breach fall entirely outside the scope of the articles."); ibid, commentary to Art 19, para 8 ("Just as the articles do not deal with questions of the jurisdiction of courts or tribunals, so they do not deal with issues of evidence or the burden of proof.").
- ↑ Tallinn Manual 2.0, Chapter 4 Section 1, para 8.
- ↑ Tallinn Manual 2.0, Chapter 4 Section 1, para 10; Cf. Yeager v Islamic Republic of Iran (1987) 17 Iran-US CTR 92, 101–02 (‘[I]n order to attribute an act to the State, it is necessary to identify with reasonable certainty the actors and their association with the State.’).
- ↑ Tallinn Manual 2.0, Chapter 4 Section 1, para 10.
- ↑ According to the UK Attorney General, "[t]here is no legal obligation requiring a state to publicly disclose the underlying information on which its decision to attribute hostile activity is based, or to publicly attribute hostile cyber activity that it has suffered in all circumstances." (UK Attorney General, Jeremy Wright QC MP, 'Cyber and International Law in the 21st Century'; see also Tallinn Manual 2.0, Chapter 4 Section 1 chapeau, paragraph 13.
- ↑ Tallinn Manual 2.0, Chapter 4 Section 1, para 12; see also ILC Articles on State Responsibility, Art 49, para 3 (“A State taking countermeasures acts at its peril, if its view of the question of wrongfulness turns out not to be well founded.”)