Attribution

Legal attribution is one of the constitutive elements of an international wrongful act, and consists of the attachment “of a given action or omission to a State”.ILC Articles on State Responsibility, commentary to Article 2, para 12. 
Many States, including Australia,Australian Government, Australia's position on how international law applies to State conduct in cyberspace (2020) Estonia, Official compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States, UNODA, A/76/136 (August 2021) 28. France,Ministry of Defense of France, International Law Applied to Operations in Cyberspace (9 September 2019) 10. Germany,Federal Government of Germany, ‘On the Application of International Law in Cyberspace’, Position Paper (March 2021) 11. ItalyItalian Ministry for Foreign Affairs and International Cooperation, 'Italian position paper on "International law and cyberspace"' (2021) 5. and Switzerland Federal Department of Foreign Affairs, ‘Switzerland's position paper on the application of international law in cyberspace’ (May 2021) 6. have affirmed that there is no legal obligation to make or publicize decisions on attribution, but rather the act of attributing a cyber operation under international law is a national prerogative at the discretion of each State.
As a rule, the conduct of State organs is attributable to the State in question;ILC Articles on State Responsibility, Art 4. by contrast, the conduct of non-State actors or third States’ organs can only be attributed to the State under specific circumstances.ILC Articles on State Responsibility, Art 8.
== State organs and persons and entities in exercise of governmental authority ==
State organs and persons and entities in exercise of governmental authority
The following types of conduct of State organs and persons and entities in exercise of governmental authority are attributable to a State:
# The conduct of any of the organs of that State, "whether the organ exercises legislative, executive, judicial or any other functions, whatever position it holds in the organization of the State, and whatever its character as an organ of the central Government or of a territorial unit of the State";ILC Articles on State Responsibility, Art 4(1).
# The conduct of "a person or entity which is not an organ of the State […] but which is empowered by the law of that State to exercise elements of the governmental authority, […] provided the person or entity is acting in that capacity in the particular instance";ILC Articles on State Responsibility, Art 5.
# The conduct of an organ of another State placed at the disposal of the State in question, if "the organ is acting in the exercise of elements of the governmental authority" of the latter State.ILC Articles on State Responsibility, Art 6.
Such conduct is attributable to the State even if the organ, person or entity acting in that capacity "exceeds its authority or contravenes instructions" (acts ultra vires).ILC Articles on State Responsibility, Art 7; Tallinn Manual 2.0, commentary to rule 15, paras. 6-7 and 12.
== Non-State actors ==
Non-State actors
Activities of non-State actors (groups and individuals) are generally not attributable to States. However, such conduct can be attributable to a State in particular if the actor is:
# "in fact acting on the instructions of, or under the direction or control of, that State in carrying out the conduct";ILC Articles on State Responsibility, Art 8; see also Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JC&SL 405.
Each of the three criteria entails a form of subordination between the non-State actor and the potentially responsible State.Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JCSL 405, 426–27. Regarding the criterion of control, there is a debate on the degree of control required for the attribution of the conduct to the State, as different tests have been developed.
On the one hand, the ICJ has affirmed that the exercise of “effective control” is necessary,See: ICJ, Military and Paramilitary Activities in and against Nicaragua (Nicaragua v US) (Merits) [1986] ICJ Rep 14, para 115; ICJ, Case Concerning the Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro) (Judgment) [2007] ICJ Rep 43, para 400. which entails that the State is able to control the beginning of the relevant operations, the way they are carried out, and their end.See Stefan Talmon, ‘The Responsibility of Outside Powers for Acts of Secessionist Entities’ (2009) 58(3) International and Comparative Law Quarterly 493, 503; Tomohiro Mikanagi and Kubo Mačák, ‘Attribution of cyber operations: an international law perspective on the Park Jin Hyok case’ (2020) 9(1) Cambridge International Law Journal 51, 63; See also Marco Roscini, Cyber Operations and the Use of Force in International Law (OUP 2014) 37-38. This position has been expressly followed by some States in the realm of cyber operations, including Brazil,Official compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States, UNODA, A/76/136 (August 2021) 21. the Netherlands Government of the Kingdom of the Netherlands, Appendix: International law in cyberspace (26 September 2019) 6. and Norway.Official compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States, UNODA, A/76/136 (August 2021) 71.
On the other hand, a less restrictive approach has been developed by the ICTY,Prosecutor v Tadić (Appeal Judgment) IT-94-1-A (ICTY, 15 July 1999) paras 116 and ff. and followed by the ICRC,ICRC (ed), Commentary to the First Geneva Gonvention (CUP 2016) para 409; ICRC (ed), Commentary to the Third Geneva Convention (CUP 2021) para 304 under the “overall control” test, which requires the State in question (i) to provide the non-State entity with financial and training assistance, military equipment and/or operational support, and (ii) to participate in the organization, co-ordination or planning of operations of the entity in question.Prosecutor v Prlić et al (Trial Judgment) IT-04-74-T (ICTY, 29 May 2013), para. 86(a); see also Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JCSL 405, 422. Nevertheless, the proponents of this test limit it to organized groups, meaning that the effective control test remains applicable for the conduct of private individuals, or unorganized groups. Prosecutor v Tadić (Appeal Judgment) IT-94-1-A (ICTY, 15 July 1999) para 132; see also Antonio Cassese, ‘The Nicaragua and Tadić Tests Revisited in Light of the ICJ Judgment on Genocide in Bosnia’ (2007) 18(4) EJIL 649, 657.
# "in fact exercising elements of the governmental authority in the absence or default of the official authorities and in circumstances such as to call for the exercise of those elements of authority";ILC Articles on State Responsibility, Art 9.
# "an insurrectional movement which becomes the new Government of a State";ILC Articles on State Responsibility, Art 10(1). or
# "a movement, insurrectional or other, which succeeds in establishing a new State in part of the territory of a pre-existing State or in a territory under its administration".ILC Articles on State Responsibility, Art 10(2).
Additionally,
# the conduct of a non-State actor is attributable to a State "if and to the extent that the State acknowledges and adopts the conduct in question as its own".ILC Articles on State Responsibility, Art 11.
== Evidentiary standards ==
Evidentiary standards
Evidentiary standards applicable to the attribution of cyber activities are context-dependent.See further Marco Roscini, ‘Evidentiary Issues in International Disputes Related to State Responsibility for Cyber Operations’ (2015) 50 Texas International Law Journal 233; Isabella Brunner, Marija Dobrić and Verena Pirker, ‘Proving a State’s Involvement in a Cyber-Attack: Evidentiary
Standards Before the ICJ’ (2015) 25 Finnish Yearbook of International Law 75; Tomohiro Mikanagi and Kubo Mačák, ‘Attribution of Cyber Operations: An International Law Perspective on the Park Jin Hyok case’ (2020) 9 Cambridge International Law Journal 51, 64-68. The law of State responsibility as such does not contain generally applicable burdens, standards, or methods of proof,ILC Articles on State Responsibility, commentary to chapter III, para 4 ("Questions of evidence and proof of such a breach fall entirely outside the scope of the articles."); ibid, commentary to Art 19, para 8 ("Just as the articles do not deal with questions of the jurisdiction of courts or tribunals, so they do not deal with issues of evidence or the burden of proof."). and these matters are instead ordinarily determined by the relevant forum.Tallinn Manual 2.0, Chapter 4 Section 1, para 8.
It is generally understood that any allegation that a wrongful act has been committed by another State should be substantiated.UN Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, A/70/174 (22 July 2015) para. 28(f); UN Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security, A/76/135 (14 July 2021) para 71.(g); Acknowledged by Brazil, Germany, Russia and Switzerland in their national positions. Nevertheless, there is no obligation under international law to publicly provide the evidence on which an attribution is based.SeeTallinn Manual 2.0, Chapter 4 Section 1 chapeau, para 13. This has been reaffirmed by many States in their national positions, including Canada, Government of Canada, International Law applicable in cyberspace (April 2022) Finland,International law and cyberspace - Finland's national position (2020) France,Ministry of Defense of France, International Law Applied to Operations in Cyberspace (9 September 2019) 11. Germany,Federal Government of Germany, ‘On the Application of International Law in Cyberspace’, Position Paper (March 2021) 12. Israel,Roy Schöndorf, Israel’s Perspective on Key Legal and Practical Issues Concerning the Application of International Law to Cyber Operations (8 December 2020) the Netherlands,Government of the Kingdom of the Netherlands, Appendix: International law in cyberspace (26 September 2019) 6. New Zealand, The Application of International Law to State Activity in Cyberspace (1 December 2020) 3. Sweden,Government Offices of Sweden, Position Paper on the Application of International Law in Cyberspace (July 2022) 5 Switzerland,Federal Department of Foreign Affairs, ‘Switzerland's position paper on the application of international law in cyberspace’ (May 2021) 6. the United KingdomAccording to the UK Attorney General, "[t]here is no legal obligation requiring a state to publicly disclose the underlying information on which its decision to attribute hostile activity is based, or to publicly attribute hostile cyber activity that it has suffered in all circumstances." (UK Attorney General, Jeremy Wright QC MP, 'Cyber and International Law in the 21st Century' (23 May 2018); United Kingdom Foreign, Commonwealth & Development Office, Application of international law to states’ conduct in cyberspace: UK statement (3 June 2021) and the United States.Brian J Egan, International Law and Stability in Cyberspace (10 November 2016) 19; Official compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States, UNODA, A/76/136 (August 2021) 141. Some States have additionally affirmed that a “sufficient level of confidence”,See the national positions of Germany and Italy. See also New Zealand’s national position (“sufficient confidence”). or “sufficient certainty”See The Netherlands’ national position. must be reached before making a decision on attribution.
In case a State is considering a response to an internationally wrongful act, the standard of attribution is that of "reasonableness", i.e. "States must act as reasonable States would in the same or similar circumstances when considering responses to them."Tallinn Manual 2.0, Chapter 4 Section 1, para 10; Cf. Yeager v Islamic Republic of Iran (1987) 17 Iran-US CTR 92, 101–02 (‘[I]n order to attribute an act to the State, it is necessary to identify with reasonable certainty the actors and their association with the State.’). This depends, among other factors, on the "reliability, quantum, directness, nature (e.g., technical data, human intelligence), and specificity of the relevant available information when considered in light of the attendant circumstances and the importance of the right involved."Tallinn Manual 2.0, Chapter 4 Section 1, para 10. The scope, scale, and impact of the incident have also been stressed as aspects that should be considered to support the assessment.UN Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security, A/76/135 (14 July 2021) para 24. The utility of cooperation at the regional and international levels for attribution purposes has also been highlighted.UN Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security, A/76/135 (14 July 2021) paras 24 and 27.
Specific rules may apply to some responses, so when one State responds with countermeasures after misattributing an internationally wrongful act to another State, it commits an internationally wrongful act of its own, even though it correctly applied the "reasonableness" standard of attribution.Tallinn Manual 2.0, Chapter 4 Section 1, para 12; see also ILC Articles on State Responsibility, Art 49 para 3 (“A State taking countermeasures acts at its peril, if its view of the question of wrongfulness turns out not to be well founded.”)
==Common positions==
===African Union (2024)===
===European Union (2024)===
==National positions==
===Australia (2020)===
===Brazil (2021)===
===Canada (2022)===
===Costa Rica (2023)===
===Cuba (2024)===
===Czech Republic (2024)===
===Estonia (2019)===
===Estonia (2021)===
===Finland (2020)===
===France (2019)===
===Germany (2021)===
===Ireland (2023)===
===Israel (2020)===
===Italy (2021)===
===Japan (2021)===
===Netherlands (2019)===
===New Zealand (2020)===
===Norway (2021)===
===Pakistan (2023)===
===Poland (2022)===
===Romania (2021)===
===Russia (2021)===
===Sweden (2022)===
===Switzerland (2021)===
===United Kingdom (2018)===
===United Kingdom (2021)===
===United Kingdom (2022)===
===United States (2012)===
===United States (2016)===
===United States (2021)===
==Appendixes==
===See also===
*Scenario 02: Cyber espionage against government departments
* Scenario 05: State investigates and responds to cyber operations against private actors in its territory
*Scenario 06: Cyber countermeasures against an enabling State
* Scenario 08: Certificate authority hack
*Scenario 09: Economic cyber espionage
*Scenario 11: Sale of surveillance tools in defiance of international sanctions
* Scenario 13: Cyber operations as a trigger of the law of armed conflict
*Scenario 14: Ransomware campaign
* Scenario 17: Collective responses to cyber operations
*Scenario 23: Vaccine research and testing
===Notes and references===
===Bibliography and further reading===
Category:Attribution
Category:State organs
Category:Non-State actors
Category:Evidence
Category:Legal concepts