Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors

Abstract

Cyber operations pose a set of novel challenges to the generally conservative body of the law of State responsibility. Central among them is the problem of attribution, which lies at the intersection of technology and law. This article reflects the recent developments in the States' technological capacity to identify the sources of cyber attacks from the perspective of international law. It revisits Article 8 of the International Law Commission's Articles on State Responsibility in order to 'decode' its contents vis-à-vis its drafting history and with an eye on its future application to the conduct in cyberspace. The article argues that there are three autonomous standards of attribution built into that provision: instructions, direction, and control. It then demonstrates the utility and limitations of each of them against the backdrop of actual and hypothetical cyber operations. The article concludes with suggestions for further development of the law in this area, focussing on the missing potential of the law to regulate instigation of wrongful cyber conduct and on the prohibitively strict test of control applicable de lege lata.

Warring from the virtual to the real: Assessing the public’s threshold for war over cyber security

“…The United States’ 2011 International Strategy for Cyberspace affirms that the US has “the right to use all necessary means – diplomatic, informational, military, and economic – as appropriate and consistent with international law” in response to a cyberattack (Hughes, 2016; Obama, 2011). This applies irrespective of whether the perpetrator is a state or a “patriotic hacker” acting on behalf of a state but without its direction since states are implicated if “the person or group of persons is in fact acting on the instructions of, or under the control of, that State in carrying out the conduct” (Mačák, 2016: 3).…”

Human rights in the age of platforms

“…A state might be responsible for the acts of an intermediary if it either controls the intermediary itself or controls the activities of the intermediary (Hathaway et al 2017, 547 Mačák (2016) notes that although "direction" and "control" are often addressed as one element (411-412), the explicit change from "and" to "or" indicates that the ILC intended these to operate separately (414). Thus, "direction" could encompass situations in which a state has an ongoing relationship with a private actor, such that a suggestion or innuendo by the state would be understood as a command (418).…”

“…The control test, in contrast, has been interpreted fairly narrowly (Hathaway et al 2017, 552), and would likely require either "effective" or at least "overall" control (Wittich 2002, 894). Mačák (2016) argues however that international law may be moving toward a more permissive interpretation of "control," either in general or on a case by case basis (423-425).…”

Regulating Private Harms Online: Content Regulation under Human Rights Law

“…A state might be responsible for the acts of an intermediary if it either controls the intermediary itself or controls the activities of the intermediary (Hathaway et al 2017, 547 States might also be responsible for the acts of intermediaries under Article 8 if the intermediary is acting under the state's direction or control. Mačák (2016) notes that although "direction" and "control" are often addressed as one element (411-412), the explicit change from "and" to "or"…”