I. Introduction
The attribution to States of cyber operationsFootnote 1 presents unique technical and legal challenges that international law has so far inadequately addressed. As a result, for all its virtues, cyberspace remains a domain in which the actions of unscrupulous States and opportunistic hackers can threaten peace and security internationally. In the absence of an effective State responsibility regime, a strong commitment to existing international law and respect for the rule of law can wane. But as Toomas Hendrik Ilves, former President of Estonia, stated in his foreword to the Tallinn Manual 2.0, it is misleading to dismiss international law as ‘window-dressing on realpolitik’.Footnote 2 This article contends that adopting a due diligence standard of attribution in cyberspace would be an effective means of ensuring that cyber operations are appropriately governed by the international law framework of State responsibility. While the attention of some has moved to ‘second generation’ cyberspace issues, such as the operation and enforcement of obligations,Footnote 3 attribution continues to be an unresolved precondition of legal responsibility.Footnote 4 Furthermore, those who have dealt with attribution in cyberspace have often done so in a perfunctory way.
This article seeks to offer a comprehensive account of the due diligence principle and its relevance to State responsibility in the cyber context. The general applicability of due diligence to the cyber domain is not disputed. On the contrary, it has been widely accepted that States must not allow their territory to be used for cyber operations which produce serious adverse consequences for other States.Footnote 5 However, it is generally assumed that when a State fails to act with due diligence, it is merely responsible for a procedural failing. This is the view adopted by the International Group of Experts (IGE) who prepared the Tallinn Manual 2.0, the most recent and notable attempt at an ‘objective restatement of the lex lata’ pertaining to cyber operations.Footnote 6 Specifically, the Experts were ‘careful to distinguish application of the due diligence principle from the international wrongfulness of the particular cyber operation that has been mounted from … the State's territory’.Footnote 7 They did so because they considered that the question of attribution was dealt with exhaustively by the Articles on the Responsibility of States for Internationally Wrongful Acts (Articles on State Responsibility).Footnote 8 In the lexicon of the International Law Commission (ILC), the IGE treated the due diligence principle as a primary rule of international law, which gave content to an international obligation.Footnote 9 This article departs from the conclusion of the Tallinn Manual 2.0 in this regard. Instead, it is argued that due diligence should operate as a secondary rule of international law, setting out a general condition for State responsibility in the context of cyberspace.Footnote 10
A due diligence failure occurs when a State has knowledge of a cyber operation being carried out from within its territory, contrary to the rights of another State, and fails to take reasonable measures to prevent it.Footnote 11 In such cases, the unlawful cyber operation should be attributable to the State, which would then incur responsibility for any resulting violation of international law. The purpose of formulating due diligence as a secondary rule in this way is the promotion of peace and security in the international system.Footnote 12 Making the attribution of cyber operations to States less difficult increases the potential accountability of States for nefarious cyber activities that they might tolerate within their territory, or carry out themselves. Were due diligence to operate as a primary rule of international law, as contemplated by the IGE, this could not be as effectively achieved. In particular, the regime of countermeasures provided for in international law could not be fully relied upon by States seeking to resolve cyber-related disputes.Footnote 13 The remainder of Part I identifies the limitations of applying the existing attribution framework to cyber operations and addresses alternative scholarly responses to this problem. The following three parts then consider in more detail the content (Part II), the rationale (Part III), and the source (Part IV) of the due diligence principle as a standard of attribution in cyberspace.
A. Bridging the ‘Gap’: Shortcomings of the Existing Attribution Framework
The law of State responsibility has a clear framework in customary international law, codified by the ILC in their Articles on State Responsibility.Footnote 14 Conduct will be attributed to a State if there is a sufficient nexus between the actor who carried out the conduct, and the State. That nexus is satisfied when the actor is a State organ,Footnote 15 a person exercising government authority,Footnote 16 or is under the direction or control of the State.Footnote 17 However, this framework is frustrated in the context of cyber operations. In particular, there is a ‘three-level problem of attribution in cyberspace’ which inhibits back-tracing the harmful effects of a cyber operation to a responsible State.Footnote 18
First, there is the challenge of identifying which computer or computers were used to carry out a cyber operation.Footnote 19 Computer identification is only possible because a computer's IP address is unique, and in some cases this can be traced to reveal its precise location.Footnote 20 However, it is possible for an actor to mask their IP address when carrying out harmful cyber operations.Footnote 21 Moreover, actors can use network modification techniques to ‘spoof’ their identify, feigning the IP address of a computer in a location different to that where it actually is.Footnote 22 The internet, as has been observed, is ‘one big masquerade ball’, where actors ‘hide behind aliases … [and] can surreptitiously enslave other computers’.Footnote 23
Second, even if the computer used to carry out a cyber operation can be identified, this is of limited utility for the purposes of attribution. As attribution is predicated on the nexus between an actor and a State, attribution cannot be made out unless the person who was operating the computer can also be identified.Footnote 24 Naturally, the ‘location of a computer rarely allows for definite conclusions regarding the identity of the individual operating the machine’.Footnote 25 This difficulty has been termed the ‘human machine gap’.Footnote 26 It is for this reason that the mere fact that a cyber operation is carried out on a State's territory, or from a State's governmental cyber infrastructure, is insufficient to attribute the operation to that State.Footnote 27
Third, even if an actor responsible for a cyber operation were identified, attribution would only occur in those cases where there was a sufficient legal nexus between that actor and the State. Problems of attribution at this third level of analysisFootnote 28 are not peculiar to the cyber context. Similar difficulties arise whenever it is asserted that the State is responsible for the conduct of an individual actor, and the Articles on State Responsibility are designed to address them. It is, therefore, the unique challenges presented by the first two levels of analysis—locating and identifying the computer and actor responsible for a harmful cyber operation—which cause the shortcomings of the existing State responsibility framework in the cyber context.
A further complicating factor for the attribution of conduct in cyberspace is the presence of active and sophisticated non-State actors.Footnote 29 These actors largely sit outside the scope of the framework of the Articles on State Responsibility, and so enjoy a relative degree of impunity for the harmful consequences of their conduct. Additionally, they will often act ‘in varying degrees of support for particular [S]tates and their policy objectives’.Footnote 30 Therefore, great caution is needed when drawing inferences from surrounding political and contextual circumstances concerning the source of a particular cyber operation.Footnote 31 This is especially the case given that States are presumed to act in accordance with their international legal obligations.Footnote 32 What might, at first glance, appear to be a State-sponsored cyber operation could in fact be the work of a patriotic (but non-State) hacker.Footnote 33 In this way, an adequate legal response to the challenges of attribution in cyberspace must address two problems: first, when States carry out harmful cyber operations for strategic purposes they should be held responsible for their conduct despite the difficulties outlined above; and second, when non-State actors carry out harmful cyber operations, targeted States should, in appropriate circumstances, be able to have recourse to international law mechanisms for remedy and dispute resolution.
State-based efforts to address this problem have been met with limited success. The chief vehicle for the codification, by States, of international law pertaining to cyberspace was the work of the United Nations’ Group of Governmental Experts (GGE) on Developments in the Field of Information and Telecommunications in the Context of International Security. The GGE produced three reports between 2010 and 2015, which represented the unanimous views of State-participants in the GGE process.Footnote 34 The two most recent reports articulated non-binding norms, ‘derived from existing international law’,Footnote 35 which should apply to and govern State conduct in cyberspace.Footnote 36 Thus, the early work of the GGE held promise for the future crystallization of cyber-specific customary international law principles, or at best a comprehensive multilateral cyber treaty. A new GGE formed and was due to report to the United Nations General Assembly in 2017. However, the group was unable to reach consensus during its final session.Footnote 37 The group fragmented over controversial areas of international law, including the self-defence doctrine, countermeasures, and international humanitarian law.Footnote 38 While the previous GGE reports remain valid and applicable, the future of the GGE's work is uncertain.Footnote 39 Bilateral or regional efforts might now be required to propel the emergence of new or novel legal rules to adequately address the difficulties of attribution in cyberspace.
B. Evidence-Based Alternatives for Addressing Cyber Attribution
Before proceeding, it should be noted that some scholars have suggested alternative means of addressing the unique difficulties presented by anonymity in the cyber context. In particular, it has been argued that rules of evidence are the most suitable vehicle through which attribution issues can be resolved. Proponents of these arguments observe that the shortcomings of attribution are of a ‘technical and policy nature’, pertaining to questions of fact, not law.Footnote 40 They submit that the Articles on State Responsibility offer a cogent legal framework for attribution provided there is sufficient evidence to identify the actor responsible for a cyber operation.Footnote 41 This reasoning has given rise to two distinct evidence-based ‘solutions’ to cyber attribution. First, it has been suggested that once it is clear that a cyber operation emanates from within a State's territory, there should be a ‘presumption of [that State's] responsibility’ for the operation, rebuttable by contrary evidence.Footnote 42 This amounts to a reversal of the burden of proof which ordinarily operates at international law.Footnote 43 Arguments of this kind have, however, been strongly criticized. Given the possibility of routing cyber operations through transit States,Footnote 44 reversing the burden of proof might ‘lead to wrong and even absurd results … and to the denouncing of wholly uninvolved and innocent States’.Footnote 45 For instance, the Stuxnet attack against Iran in 2010 emanated from computers in Denmark and Malaysia, two States who were ‘clearly unaware’ of the operation.Footnote 46
Second, some have advocated for a relaxed standard of proof to accommodate the exigencies of the cyber context.Footnote 47 This argument can also be rejected. Standards of proof exist ‘not to disadvantage’ States harmed by cyber operations, ‘but to protect … against false attribution’.Footnote 48 As such, there is no reason ‘why the standard of proof should be lower simply because it is more difficult to reach’.Footnote 49 Furthermore, international courts have adopted increasingly consistent standards of proof when dealing with the same internationally wrongful acts.Footnote 50 On this basis, it is unlikely that a lower standard of proof would be adopted in the case of a cyber attack amounting to a use of force than would be adopted in the case of a kinetic attack violating the same principle. In contrast to evidential standards, the laws of State responsibility are flexible and responsive to different practical contexts.Footnote 51 As such, they offer the best vehicle for addressing the limitations of attribution in the cyberspace.
II. Content of the Due Diligence Principle
Due diligence reflects a general principle of international law best articulated by the International Court of Justice (ICJ) in its Corfu Channel judgment: ‘it is every State's obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States’.Footnote 52 Since Corfu Channel, due diligence has been particularized in various specialized regimes of international law.Footnote 53 This does not, however, preclude application of the principle in new or novel contexts. On the contrary, as due diligence is a general principle, ‘the presumption is that it applies unless State practice or opinio juris excludes it’.Footnote 54 The Tallinn Manual 2.0 contains a detailed and helpful analysis of how due diligence should be applied in cyberspace.Footnote 55 It is worthwhile briefly mapping out the principle's content, given that a natural concern with accepting a due diligence standard of attribution is that it would lead to indeterminate liability for States. As the following analysis will demonstrate, a State will only breach its obligation of due diligence in narrowly defined circumstances. In a sense, each element of the principle acts as a reasonable limitation on potential State responsibility. Specifically, a State will only fail to exercise due diligence when it has (1) knowledge of a cyber operation being carried out from within its territory, which is (2) contrary to the rights of another State, and it (3) fails to take feasible measures to prevent it.
The first element, knowledge, can be satisfied by both actual and constructive knowledge.Footnote 56 Whilst it might be difficult to ascertain evidence of a State's actual knowledge of a given cyber operation, a constructive knowledge standard ensures that the due diligence approach is not rendered all but redundant.Footnote 57 Pursuant to this standard, a State is taken to have knowledge of all things ‘a similarly situated and equipped State in the normal course of events would have discovered’.Footnote 58 For instance, State knowledge is more likely to be ascribed for publicly known or easily detected uses of malware.Footnote 59 Furthermore, a State is more likely to have knowledge of the use of its governmental cyber infrastructure than it is of the use of private infrastructure in its territory.Footnote 60 If assuming knowledge is unreasonable in the circumstances, a State's due diligence obligation will not be engaged.
The second element, that the cyber operation be contrary to the rights of another State, is the least settled at international law.Footnote 61 It is sufficient to say for the purposes of this article that only cyber operations of a certain level of gravity will engage a State's obligation of due diligence. Specifically, the principle deals with cyber operations that amount to an internationally wrongful act,Footnote 62 and which result in serious adverse consequences for the target State.Footnote 63 This appropriately limits potential liability under the due diligence standard by excluding from its scope the vast number of minor cyber operations that are not regulated by international law.Footnote 64
The third element, concerning feasible measures, provides that States are only required to intervene in a cyber operation when they have the capacity to do so, and when doing so is reasonable in the circumstances. This element offers the greatest protection to States against the imposition of indeterminate liability.Footnote 65 The ‘feasibility’ of measures for a State will vary based on the technical, intellectual and financial resources at its disposal.Footnote 66 As such, States will not violate international law for failing to prevent highly complex cyber operations that they lack the ability to control.Footnote 67 Furthermore, even in instances where States have the capacity to prevent harmful cyber operations carried out in their territory, they are under no obligation to do so when it would be unreasonable in the circumstances.Footnote 68 For instance, a State would very rarely, if ever, be required under a due diligence standard to act in a way that resulted in the self-denial of essential networks or important cyber infrastructure.Footnote 69
In this way, the due diligence principle can operate as a standard of attribution in a clearly proscribed set of circumstances. While a fear of expanding State responsibility is understandable, it should be tempered by the limited scope of the doctrine. States will only ever be responsible for cyber operations with serious adverse consequences, which they have the capacity to identify and respond to. In such instances, if a State knowingly fails to curtail the harm inflicted upon a neighbouring State, why should international responsibility not follow?
III. Rationale of the Due Diligence Principle
A. Peace, Security and the Rule of Law
An important rationale for adopting the due diligence principle as a standard of attribution is the contribution this would make to the maintenance of international peace and security. Despite early pronouncements that the internet would remain independent of the ‘tyrannies’ of elected government and sovereignty,Footnote 70 it is now generally accepted that cyberspace is governed by international law.Footnote 71 Were this not the case, cyber operations would occur in ‘lacunae or “law-free zones” carrying the implication that lack of normative regulation may lead to any or unrestricted behaviour’.Footnote 72 The threat that an unregulated cyberspace could pose to the maintenance of international peace is clear. Cyber operations have the capacity to harm the security, economy and infrastructure of States on an equivalent scale to kinetic attacks. The main State participants in cyberspace are some of the world's most influential powers, including the United States, China and Russia. As these States are each equipped with a nuclear arsenal, the potential threat to the global community that might follow from escalating cyber conflict is apparent.Footnote 73 Furthermore, as noted earlier, the general accessibility of the cyber domain ‘leaves the potential for mass destruction within the grasp of far less sophisticated [non-State] actors’.Footnote 74
Even putting peace and security to one side, there are principled reasons why the application of international law is important in all spheres of State conduct. As then US Department of State Legal Advisor Harold Koh stated in 2012:
International law … frees us and empowers us to do things we could never do without law's legitimacy. If we succeed in promoting a culture of compliance, we will reap the benefits. And if we earn a reputation for compliance, the actions we do take will earn enhanced legitimacy worldwide for their adherence to the rule of law.Footnote 75
Cultivating a culture of compliance with international law in the cyber realm is of intrinsic value to States, because it stands to legitimize their actions and demonstrate their status as good global citizens. This being said, the effective operation of international law in cyberspace is not a given. Considerable State-basedFootnote 76 and scholarlyFootnote 77 efforts to apply international law principles to the cyber context have not yielded encouraging practical outcomes. Despite the occurrence of more than ten serious publicly reported peacetime cyber operations in the past decade,Footnote 78 no cyber dispute has yet been brought before an international court or tribunal. Perhaps more notably, no State has sought reparation from another State for harm caused by cyber operations, nor has any State responded to a cyber operation explicitly justifying their conduct as a countermeasure, or an act of self-defence or necessity.
The most likely explanation for this is that the challenges of attribution in the cyber context deter States from having recourse to traditional international systems of dispute resolution. This, in turn, limits the capacity of international law to mitigate conflict and facilitate peace and security between States and non-State actors. It also undermines the legitimacy and adherence to the rule of law that follows from a culture of compliance with international law. In fact, without an operative State responsibility framework, cyberspace is not so far from the lawless lacuna some hoped it would become. For this reason, a standard of attribution that more actively engages cyber operations with the existing international law paradigm is necessary.
B. Giving Effect to the Countermeasures Regime in Cyberspace
A further (and related) rationale for a due diligence standard of attribution in cyberspace is that its current status as a primary rule of international law precludes meaningful engagement with the regime of countermeasures. It was assumed by the IGE of the Tallinn Manual 2.0 that States targeted by the hostile cyber operations of other States could respond in kind with countermeasures.Footnote 79 It was further assumed that countermeasures would be similarly available to targeted States when another State failed to exercise due diligence.Footnote 80 However, where due diligence operates as a primary obligation of reasonable efforts, States harmed as a result of another's due diligence failure can only have recourse to a limited range of countermeasures by way of response. In particular, they cannot respond with measures of an equivalent scale or severity as the cyber operation they have fallen victim to. It is in this regard that the distinction between the status of due diligence as a primary rule and secondary rule becomes important. As stated, this article argues that the principle should operate as a secondary rule, pursuant to which States can incur direct responsibility. Only if this thesis is accepted will due diligence give holistic effect to the informal dispute resolution mechanisms envisaged by international law.Footnote 81
Countermeasures are actions taken by a State that would otherwise violate international law, but which are permissible insofar as they respond to a breach of an international legal obligation owed to it by another State.Footnote 82 Given the difficulties of establishing State responsibility in the cyber context, the principle of due diligence has received particular attention in discussions of the self-help conduct that countermeasures enable.Footnote 83 As countermeasures permit States to carry out otherwise internationally wrongful conduct, they are subject to considerable limitations. Two of these limitations will be expanded on here: first, countermeasures must be directed towards inducing a State to comply with its international obligations (the purpose requirement);Footnote 84 and second, countermeasures must be proportionate to the gravity of the internationally wrongful conduct it is responding to (the proportionality requirement).Footnote 85 Were the due diligence principle to operate merely as a primary rule, the purpose and proportionality requirements would render ineffective the countermeasures available to harmed States.
The purpose requirement reflects the overarching objective of the countermeasure regime; that is, to induce States to cease internationally wrongful conduct.Footnote 86 As a corollary, countermeasures cannot be taken against non-State actors.Footnote 87 Furthermore, not only must they be taken ‘in response to’ another State's prior wrongful conduct,Footnote 88 but the countermeasure must be intimately related to the obligation breached. This requires careful examination of the legal character of the rights involved.Footnote 89 For instance, consider the countermeasures available to a State (State B) harmed by a cyber operation that another State (State A) failed to address in contravention of the due diligence principle. Further, presume that the due diligence principle operates as merely a primary rule of international law. Due diligence imposes an obligation of conduct, not of result.Footnote 90 Accordingly, State A's violation of international law might be the result of its failing to reasonably monitor its cyber infrastructure, or by failing to take reasonable steps to terminate the cyber operation. The only lawful countermeasures available to State B are those directed towards inducing State A to conduct itself more diligently. Importantly, State B would be unable to directly terminate the cyber operation itself. To do so would infringe the purpose requirement. It would be directed towards achieving a particular result (ending the cyber operation), which is not the touchstone of the international obligation breached (exercising diligent conduct). Proponents of the utility of due diligence in the cyber context have repeatedly misunderstood or overlooked this nuance.Footnote 91
Now consider the same countermeasures scenario where due diligence operates as a secondary rule. State A's due diligence failure results in its international responsibility for the cyber operation harming State B. The relevant internationally wrongful conduct is not a failure of diligence in this case, but a direct violation of State B's sovereignty.Footnote 92 In this instance, State B could lawfully terminate the cyber operation itself, because in doing so it would ‘directly achieve compliance’ by State A with its obligation not to interfere with State B's sovereignty.Footnote 93 This is important because cyber operations can cause significant and irreversible harm. As such, an expedient and direct response by a targeted State will often be the most efficacious way to end or deescalate potential hostilities. If such a response to a harmful cyber operation is not directed to achieving compliance with international law, it will be inconsistent with the purpose requirement.
The proportionality requirement further demonstrates the virtues of due diligence as an attribution standard. Pursuant to this requirement, countermeasures must be ‘commensurate with the injury suffered, taking into account the gravity of the internationally wrongful act’.Footnote 94 Proportionality is concerned with ‘the relationship between the internationally wrongful act and the countermeasure’.Footnote 95 This means that less grave violations of international law will result in more limited recourse to countermeasures by harmed States. As such, States injured by cyber operations who take countermeasures based on another State's due diligence failure (in the primary rule sense) must exercise great caution. The proportionality of their countermeasure will be assessed against the procedural failure to take reasonable preventive measures, not against the severity or the consequences of the cyber operation itself.Footnote 96 This could curtail the effective operation of the countermeasures regime in cyberspace if it has a chilling effect on the willingness of harmed States to respond to cyber operations. Again, this is a concern overcome if the due diligence principle operates as secondary rule. Were this the case, the proportionality of a countermeasure would be measured against a direct violation of international law, as the cyber operation would itself be the internationally wrongful act. Accordingly, the harmed State could respond more appropriately to protect their interests.
The countermeasures regime is not the only means of international dispute resolution relevant to the cyber context, but it is a particularly important one. This is because, as noted already, States have been reluctant to bring disputes involving cyber operations before international courts or tribunals for adjudication. Furthermore, the two other notable self-help measures available to States harmed by cyber operations, self-defence and necessity, are only available in a far more limited range of circumstances. A State's inherent right of self-defence is engaged whenever they are targeted by a cyber operation that constitutes an armed attack.Footnote 97 While much ink has been spilled debating the precise content of ‘armed attack’ in the cyber context,Footnote 98 it is sufficient to note here that a cyber operation justifying self-defence would have to be of the scale and have an effect of the ‘most grave forms of the use of force’.Footnote 99 The plea of necessity is similarly available to States when responding to certain harmful cyber operations. Necessity, it must be accepted, has some notable practical benefits given the difficulties of attribution in the cyber context;Footnote 100 actions taken based on the plea need not be a response to an internationally wrongful act,Footnote 101 and may be taken directly against non-State actors (or in cases where the originator of the precipitating attack is altogether unknown).Footnote 102 However, like self-defence, necessity is only available in exceptional circumstances. Specifically, the plea will only preclude the otherwise wrongful conduct of a State if it is the only way to safeguard an ‘essential interest’ against a ‘grave and imminent peril’.Footnote 103
Importantly, preoccupation with cyber operations that would justify responsive action based on self-defence or necessity is ‘counter-experiential’.Footnote 104 Few (if any) known cyber operations have crossed the armed attack threshold, or have been deemed sufficiently exceptional to justify a plea of necessity.Footnote 105 By contrast, cyber operations below that level are commonplace, and have been labelled ‘the most pressing and potentially dangerous’ threat to national and international security in recent times.Footnote 106 For this reason, the effective functioning of the countermeasures regime is essential to promoting international peace and security. It is the most appropriately designed mechanism for dealing with low-gravity cyber operations. Furthermore, it will be engaged most effectively if the due diligence principle is accepted as an attribution standard, rather than merely as a primary obligation of conduct.
IV. Source of the Due Diligence Principle
The previous two parts have addressed the content of the due diligence principle, and the normative and legal rationales for its adoption. This part addresses the current status of the principle in international law. It does not go so far as to posit that the principle, as outlined, constitutes custom. Rather, it suggests that due diligence as a standard of attribution is reconcilable with existing regimes of international law, and that it could and should emerge as a customary norm in future. It proceeds in two parts: first, addressing the Articles on State Responsibility; and second, canvassing State practice and opinio juris that supports the emergence of the principle.
A. Articles on State Responsibility
Since their completion in 2001, the Articles on State Responsibility have widely been accepted as an authoritative codification of well-established customary rules of international law relating to State responsibility.Footnote 107 Because of their pervasiveness, they are the starting point, and often the end point, of any discussion on the means of attribution. Articles 4–11 set out the laws of attribution, and do not provide for a standard of due diligence. Consistently with the prevailing understanding of the principle in international law, due diligence was contemplated by the ILC as a primary rule of international law.Footnote 108 As such, the future development of the due diligence principle as a secondary rule faces the challenge of having been considered, but ultimately overlooked, by the ILC when drafting their State responsibility framework. Thus, before discussing State practice and opinio juris, it is worth considering the extent to which the development of such a principle can be accommodated by the Articles on State Responsibility.
1. The ILC's drafting process
The final formulation of the Articles’ text was considerably shaped by the need for expediency and compromise. Due diligence played a ‘significant role’ in the earlier drafting efforts of the ILC.Footnote 109 However, controversy developed over whether an internationally wrongful act necessarily required the presence of an additional element of fault.Footnote 110 As such, in an attempt to find common ground, due diligence was shifted to the level of a primary rule,Footnote 111 and eventually, primary rules were altogether removed from the scope of the ILC's work.Footnote 112 The attribution standards that were included in the Articles were shaped by the historical context in which they were drafted. Specifically, they implicitly contemplate ‘proxy wars fought by non-[s]tate actors’ using ‘conventional weapons’ provided to them by States.Footnote 113 This is evidenced by the fact that the most relaxed attribution standard codified, that of ‘direction or control’,Footnote 114 derives its content from the ICJ's Nicaragua decision.Footnote 115 A key issue in that case was whether the United States should be held responsible for the ‘planning, direction and support’ it offered to the contras, an organized group who were fighting against the Nicaraguan government at the time.Footnote 116 In the cyber context however, non-State actors are less dependent on the support of State actors, and cyber weapons are far easier than conventional weapons to acquire and deploy. This is not to say, of course, that the Articles on State Responsibility are superfluous to the cyber context. However, the rejection of due diligence as an attribution standard in the Articles should be seen as a reflection of ‘the exigencies of codification’, rather than any principled opposition to the doctrine operating as a secondary rule of international law.Footnote 117
2. Text, object and purpose
Furthermore, the notion of flexibility is inherent in the nature of the Articles on State Responsibility. They are not a treaty. While it has been extensively cited by international courts and tribunals, the provisions contained within it merely reflect customary international law on State responsibility as it existed at the time of their drafting.Footnote 118 It is trite to recite that customary international law is created when general State practice is accompanied by the requisite opinio juris. However, the constituent elements of custom demonstrate its malleability. For as long as States are conducting their affairs in new contexts and novel ways, international law will continue to develop accordingly.Footnote 119 Although the Articles on State Responsibility were designed to set out general rules applicable to all fields of international law,Footnote 120 their comprehensive scope and authoritative tone may have triggered more deference than is warranted; it would be absurd to maintain that the laws of attribution were exhaustively settled in 2001.Footnote 121 On the contrary, for instance, the content of the ‘direction or control’ standard contained in Article 8 appeared to be in flux at least until the ICJ's 2007 Bosnian Genocide decision.Footnote 122 Moreover, the attention paid by international law to non-State actors following the September 11 attacks is in stark contrast to the Articles’ State-centric approach to attribution.Footnote 123 It is not difficult to comprehend how the idiosyncratic characteristics of cyberspace might also challenge the assumptions underpinning the State responsibility framework, and in doing so prompt the development of new customary rules.
The flexibility of the Articles on State Responsibility is also acknowledged explicitly in its text. In particular, Article 55 provides that the ordinary rules of State responsibility ‘do not apply where and to the extent that … responsibility of a [s]tate [is] governed by special rules of international law’.Footnote 124 This is a codification of the lex specialis maxim, a generally accepted technique for reconciling conflicting norms that deal with the same subject matter at international law.Footnote 125 Importantly, an entire regime of law is not required to displace operation of the ordinary rules of attribution. One aspect of general law ‘may be modified, leaving other aspects still applicable’.Footnote 126 This would be the effect of introducing a previously unrecognized standard of attribution, like due diligence, but leaving applicable other attribution standards codified in the Articles.Footnote 127 In substance, applicability of the lex specialis doctrine turns on whether a new legal standard of attribution in the cyber context constitutes a ‘special rule’ within the meaning of Article 55. This inquiry prompts two related questions: are the existing attribution rules, established long before the formation of cyberspace, general enough to accommodate the peculiarities of cyber operations; and further, is the uniqueness of the cyber context ‘special’ enough to warrant the formulation of tailored rules of State responsibility?Footnote 128 This article has already addressed some of the novel challenges posed to existing attribution frameworks in cyberspace.Footnote 129 Of particular note is the evidential uncertainty that follows from a domain that is readily accessible to non-State actors, and in which technical anonymity continues to permeate.Footnote 130 It is unnecessary here to determine conclusively whether a due diligence standard of attribution could constitute a ‘special rule’ of international law within the meaning of Article 55. It is sufficient to note that the Articles on State Responsibility explicitly contemplate the formulation of additional rules to account for new contexts.
3. Attribution in the International Court of Justice
Finally, international courts have repeatedly engaged with novel arguments concerning the State responsibility framework. While judicial decisions are a ‘subsidiary’ source of international law,Footnote 131 pronouncements on issues of substance by the ICJ are generally considered to be of ‘great weight’.Footnote 132 As such, the Court's willingness to accept new standards of attribution in appropriate circumstances is particularly instructive. It has done so on at least two occasions, in its Corfu Channel and Armed Activities decisions.
While Corfu Channel preceded the completion of the Articles on State Responsibility, it nonetheless provided the seminal articulation of the due diligence principle as a primary rule of international law.Footnote 133 The dispute concerned Albania's responsibility for damage caused to two British warships by mine explosions in Albanian territorial waters.Footnote 134 Although Albania was not responsible for laying the mines,Footnote 135 its failure to warn incoming warships of imminent danger constituted a due diligence violation.Footnote 136 Submissions during the course of proceedings directed the ICJ to consider alternative attribution standards. In particular, the United Kingdom invoked the notions of ‘complicity’ and ‘connivance’ in attempting to impute Albania with responsibility for the creation of the minefield.Footnote 137 Complicity and connivance were formulated to more closely resemble a standard of attribution than a primary rule.Footnote 138 This submission was ultimately disregarded by the Court because of evidential uncertainty,Footnote 139 but the ICJ did not reject the formulation as a matter of principle.
In the Armed Activities case, the ICJ again took the opportunity to consider novel submissions concerning attribution. In this instance, the Court seemed to endorse a ‘toleration’ or ‘acquiescence’ standard for attributing uses of force to States. Specifically, it observed that two paragraphs of the Friendly Relations Declaration, which prohibited ‘tolerat[ing]’ or ‘acquiescing in’ acts constituting the use of force or civil strife, were ‘declaratory of customary international law’.Footnote 140 This standard was then employed by the Court when assessing whether Congolese authorities had committed a use of force in supporting anti-Ugandan insurgents.Footnote 141 The ICJ concluded that, on the available evidence, it could not consider the Congo to have tolerated or acquiesced in the insurgent's activities.Footnote 142 In the alternative, it observed that Uganda had carried out an illegal use of force against the Congo on 7 August 1998, and any subsequent military action by Congolese authorities was justified as action taken in self-defence.Footnote 143 In either case, the ICJ seems to have prima facie accepted the operation of a toleration or acquiescence standard for attributing uses of force.Footnote 144
While the Court limited the toleration or acquiescence standard of attribution to uses of force in Armed Activities, it need not have done so. The Friendly Relations Declaration similarly requires States to act with vigilance to avoid intervention in another State's domestic affairs, territorial integrity, or sovereignty.Footnote 145 Furthermore, because Armed Activities was decided in 2005, four years after the completion of the Articles on State Responsibility, the decision lends support to the view that the Articles are inherently flexible. Given changes to the nature of interstate conflict as contemplated by the ILC during the drafting process, it is comprehensible that the cyber context might demand the application of new legal rules. If this is the case, a due diligence standard of attribution in cyberspace would not be antithetical to the Articles on State Responsibility. On the contrary, it would be entirely consistent with its text and historical treatment by international courts.
B. State Practice and Opinio Juris
A due diligence attribution standard will develop in the cyber context if it is supported by generally uniform State practice and accompanying opinio juris.Footnote 146 While available evidence of such a customary rule does not meet this threshold, it has manifested to some degree in at least two ways. First, there has been an increasingly accepted recourse by States to self-defence in response to the conduct of terrorist organizations. While this does not directly implicate cyber operations, on one view, it does demonstrate a willingness to regulate non-State actors by altering the State responsibility framework. Second, through a number of multilateral agreements and resolutions, States have supported a due diligence standard of attribution as a means of addressing the unique vulnerabilities and threats arising in cyberspace.
1. Self-defence against non-State actors
States have an inherent right to resort to force in self-defence when they are the victim of an armed attack.Footnote 147 Traditionally, this right was only thought to arise when the actor responsible for the armed attack was another State.Footnote 148 However, this assumption has been challenged by the invocation of the self-defence doctrine by States to justify their hostile responses to terrorist activities. The most commonly cited example of this trend is the United States’ use of force against Afghanistan following September 11.Footnote 149 While the US was ostensibly responding to the conduct of Al-Qaeda, no distinction was made between the terrorist organization and the Taliban regime governing Afghanistan.Footnote 150 This example of State practice is particularly significant because it was followed by two Security Council resolutions affirming the legality of the United States’ conduct.Footnote 151 However, it has also been reinforced by subsequent instances of States similarly responding to terrorist activity on the basis of self-defence. In 2002, Russia declared a right of self-defence against Georgia in response to the conduct of Chechen rebels.Footnote 152 In 2006, Israel relied on self-defence against Lebanon to counteract the conduct of Hezbollah.Footnote 153 Since 2014, the United States has justified its actions in Iraq and Syria as self-defence against the Islamic State.Footnote 154 And finally, a series of surgical strikes in 2016 by India against military launch pads used by terrorists in Pakistan have been justified on the basis of self-defence.Footnote 155
The consistency of this practice, repeatedly endorsed by the United Nations,Footnote 156 has led some to suggest that the traditional understanding of the self-defence doctrine should no longer be maintained. Instead, support has emerged for a so-called ‘unwilling or unable’ doctrine.Footnote 157 While not always made explicit, the ‘doctrine is split into two conceptually different subsets’.Footnote 158 The first, more prevalent view, is that there is now a discrete right of self-defence against terrorist organizations that arises when a territorial State is unwilling or unable to curb the organization's conduct.Footnote 159 This view, however, does not explain why tacit States must simply accept encroachments on their sovereignty as self-defence measures against non-State actors.Footnote 160 Furthermore, it considerably departs from the State-centric conceptualization of the use of force doctrine in Articles 2(4) and 51 of the Charter of the United Nations.
The alternative view, more akin to the approach taken in this article, is that a State's unwillingness or inability to repress terrorist activity within its territory results in the attribution of that activity to the territorial State.Footnote 161 As a result, because its direct responsibility has been engaged, responsive self-defence measures can lawfully be taken against the territorial State. This view should be preferred because it preserves the traditional conception of the self-defence doctrine, as applicable only in cases of an armed attack ‘by one State against another State’.Footnote 162 Additionally, it is generally consistent with State practice. That is, States invoking self-defence have made concerted efforts to identify a nexus between a territorial State and the terrorist organization; this nexus is just one which falls below the ‘direction or control’ standard of attribution contained in the Articles on State Responsibility.Footnote 163 It is a nexus that can be seen as equivalent, in substance, to a due diligence standard of attribution. Such an attribution standard would not lead to unreasonable or excessive interference with a territorial State's sovereignty in this context because self-defence measures remain, as ever, strictly constrained by the requirements of necessity and proportionality.Footnote 164
The acceptance of a due diligence standard of attribution in the terrorism context is important for the development of an equivalent standard in cyberspace. This is because the rationale for the acceptance of a tailored principle of State responsibility is identical in each case. Terrorist groups operate on a sub-national level, without a defined or consistent territory.Footnote 165 They utilize unconventional ‘weapons’ in their operations, and are not necessarily reliant on State support or training for their survival. Non-State actors in the cyber context similarly defy territorial conceptions of international relations, and the general accessibility of cyberspace has already been noted. Most importantly, the significant impact of both terrorist organizations and non-State hacker groups on international security was not contemplated in the Articles on State Responsibility. As such, in both contexts, the need for recourse to self-defence against non-State actors is particularly compelling.Footnote 166 Such recourse only becomes practically possible, however, upon acceptance of a suitable due diligence standard of attribution.
2. Due diligence in cyberspace
State practice and opinio juris supporting a due diligence standard of attribution in cyberspace has arisen in three different ways. First, and most notably, a large number of States have assumed international obligations in the cyber context pursuant to the Convention on Cybercrime (Cybercrime Convention).Footnote 167 While treaties are a source of law in their own right,Footnote 168 they can also be a powerful expression by ratifying States of the legal obligations applicable in a particular field.Footnote 169 The Cybercrime Convention creates an obligation on States to domestically criminalize data interference and system interference,Footnote 170 and to enforce sanctions for non-compliance.Footnote 171 A duty to domestically criminalize nefarious cyber operations necessarily complements a more general duty of diligence.Footnote 172 As the ICJ observed in Pulp Mills, a due diligence obligation ‘entails not only the adoption of appropriate rules and measures, but also a certain level of vigilance in their enforcement’.Footnote 173 The Cybercrime Convention has been ratified by 55 States and signed, without ratification, by a further four States.Footnote 174 The Convention's obligations have also been echoed by the United Nations General Assembly, which has called on States to ‘ensure their laws … eliminate safe havens for those who criminally misuse information technologies’.Footnote 175
Second, a series of ‘soft law’ instruments have been produced, which endorse the taking of due diligence measures to prevent harmful cyber operations. Foremost among these are the United Nations’ GGE reports, discussed above.Footnote 176 The 2013 GGE report prohibits the use, by States, of ‘proxies to commit internationally wrongful acts’ in cyberspace.Footnote 177 It further requires States to ‘ensure that their territories are not used by non-[s]tate actors’ for unlawful cyber purposes.Footnote 178 The 2015 GGE report acknowledges ‘the challenges of attribution’ in cyberspace.Footnote 179 Relatedly, it provides that States must not ‘conduct’,Footnote 180 ‘support’,Footnote 181 or ‘knowingly allow’Footnote 182 their territory to be used for unlawful cyber operations. Notwithstanding the uncertain future of the GGE, both these reports substantively affirm a responsibility of due diligence for States in cyberspace. The norms and principles set out in each report are non-binding.Footnote 183 However, they are of weight as a codification effort achieved by government agents, in their official capacity, representing an ‘equitable geographic distribution’ of States.Footnote 184 Furthermore, each report has been unanimously adopted and affirmed by the United Nations General Assembly.Footnote 185 The sentiment of the 2013 and 2015 GGE reports is echoed by the works of the North Atlantic Treaty Organization (NATO). For instance, in terms more prescriptive than those adopted by the GGE, the NATO Cyber Defense Policy recognizes the ‘responsibility’ of States to protect their national networks, and in doing so to facilitate the ‘detection’ and ‘prevention’ of international cyber security threats.Footnote 186 Finally, the Tallinn Manual 2.0 cannot be altogether ignored as a reflection of the practice and opinio juris of States.Footnote 187 It was drafted with the ‘unofficial’ assistance of over 50 States and international organizations, and the text was settled by the consensus of legal, academic, and technical experts.Footnote 188 It was intended as a ‘reflection of the law as it existed’ at the time of drafting,Footnote 189 and it extensively codifies a due diligence obligation.Footnote 190
The third, and final, manifestation of State practice and opinio juris is the response of States to publicly known cyber incidents. Historically, even widely reported cyber operations have proved a limited source of evidence to support the formation of customary norms. For obvious reasons, States who have carried out hostile cyber operations rarely comment on their occurrence. States have also been reticent to officially comment on cyber operations they have been targeted by, even when they believe to have identified the perpetrator.Footnote 191 For instance, despite the extensive damage caused to the Natanz nuclear facility by the high-profile Stuxnet virus,Footnote 192 Iran resisted claims it had fallen victim to a cyber attack.Footnote 193 State responses of this kind are likely motivated by a desire to save face, and avoid alerting other States or non-State actors to particular cyber vulnerabilities. In recent years, however, there has been a gradual departure from this trend. In 2014, US President Barack Obama blamed North Korea for the hacking of Sony, and declared an intention to respond.Footnote 194 Shortly thereafter, North Korea experienced widespread unexplainable internet outages, which were assumed to be caused by a United States cyber operation.Footnote 195 In 2016, following the hack of the DNC's servers, three private cybersecurity firms concluded the responsibility of two Russian hacker groups with government connections.Footnote 196 A protracted official investigation confirmed the involvement of the Russian government in the hack, following which the United States responded with a number of lawful diplomatic sanctions.Footnote 197 While the Sony and DNC hacks are somewhat unique in this regard, they signal a greater willingness of States to openly attribute and respond to hostile cyber operations. The uncertainty and anonymity of the cyber sphere still hinders the extraction of particularly prescient State practice or opinio juris from these cases. In time though, similar events might provide explicit support for the emergence of a due diligence standard of attribution in cyberspace.
3. An emerging customary norm
While extensive and uniform practice is required to deduce the existence of new legal rules, the conduct of States ‘whose interests are specially affected’ is of notable weight.Footnote 198 In this regard, despite the accessibility of the domain, there are relatively few parties actively engaging in hostile cyber operations.Footnote 199 Nearly all publicly known cyber operations that have occurred since the Estonia attacks in 2007 have involved, either as the alleged perpetrator or victim, the United States, Russia or China.Footnote 200 As such, the participation of these States in norm building efforts is of particular importance. Importantly, all three were among the States who produced the 2013 and 2015 GGE reports. The United States has additionally ratified the Cybercrime Convention, and is bound by NATO's Cyber Defense Policy.
The development of new customary norms in cyberspace is further facilitated by the uniqueness of the domain. While the applicability of international law to the cyber context is now settled, the urgency of coping with new technologies enables customary law to come into existence very rapidly.Footnote 201 In the same way that novel principles concerning sovereignty in outer space developed ‘instantly’ after the first satellites were launched,Footnote 202 a due diligence standard of attribution might quickly develop with respect to cyberspace. On balance, instances of supportive State practice lack the quantum and uniformity to establish a crystallized or emerging customary norm. If, however, the United States’ response to the Sony and DNC hacks signals a newfound willingness to allege State responsibility following cyber operations, a due diligence standards of attribution might soon follow.
V. Conclusion
‘At a time when the actions of unscrupulous [s]tates and violent extremist groups continue to threaten peace and security internationally, it is even more important that such actions are countered with a strong commitment to existing international law’.Footnote 203 However, the anonymity and accessibility of the cyber domain has thus far frustrated the effective operation of the existing State responsibility framework. This article has contended that due diligence offers a suitable standard of attribution that can rectify its limitations. The principle overcomes concerns of indeterminate liability because of its clearly and carefully defined scope: States assume responsibility only for unlawful conduct carried out from within their territory that they have knowledge of and the capacity to respond to. While due diligence has traditionally been thought of as a primary rule of international law, its utility in the cyber context is dependent on its characterization as a general condition of responsibility. Its status as such is supported, to some degree, by a series of multilateral agreements and resolutions, reflecting the views of the most prolific users of cyberspace. Given the rapid rate at which norms can emerge in new technological domains, due diligence might well crystallize into a customary attribution standard in the future. If and when it does so, international law will no longer be dismissed as ‘window-dressing’ on the realpolitik of cyberspace.
