Note on the structure of articles

== The structure of articles ==
The core of this toolkit consists of international cyber law scenarios. Each scenario describes an incident, or a series thereof, and then analyses these from the perspective of international cyber law. The central question of the legal analysis section is the following: Do the incidents described in the scenario amount to a violation of international law by any of the relevant actors? In order to answer that question, the section is typically divided into three main parts: (1) attribution, (2) breach, and (3) responses and justifications. Occasionally, one or even two of these parts may be missing, depending on which issues are raised by a particular scenario.
This structure broadly follows the logic of the law of international responsibility. According to this logic, an entity—most commonly, but not exclusively, a StateCf. J Crawford, ‘The System of International Responsibility’ in J Crawford, A Pellet and S Olleson (eds), The Law of International Responsibility (OUP 2010) 17–18 (noting that although the “burden of compliance principally lies” on States, all international legal persons are subject to the system of international responsibility).—is only responsible for an internationally wrongful act if three conditions are met simultaneously: firstly, there is an action or omission which is attributable to the entity in question; secondly, that action or omission constitutes a breach of an international obligation of the said entity; and thirdly, there are no circumstances that would preclude the wrongfulness of such an action or omission.It should be noted that the second and the third condition are frequently considered together. For practical reasons, the toolkit analyses each of them separately, as some authors have also done in the past: see, eg, J Crawford and S Olleson, ‘The Nature and Forms of International Responsibility’ in M Evans (ed), International Law (4th edn, OUP 2014) 453 (referring to “[t]hree elements”, namely “attribution, breach, and the absence of any valid justification for non-performance”). However, it is conceded that the (non-)existence of circumstances precluding wrongfulness may be viewed as a sub-element of breach: in other words, the circumstances, when they are validly invoked, exclude that the relevant conduct constitutes a breach of a given international obligation. FI Paddeu, “Circumstances Precluding Wrongfulness” in R Wolfrum (ed), Max Planck Encyclopedia of Public International Law (OUP 2008-) (last updated September 2014), para. 4. As far as the responsibility of States is concerned, the relevant rules are codified in the International Law Commission’s Articles on State Responsibility,Articles on State Responsibility. which are generally considered to reflect customary international law.See, eg, Noble Ventures v Romania (12 October 2005) ICSID Case No ARB/01/11, para. 69 (noting that the Articles “are widely regarded as a codification of customary international law”); Tallinn Manual 2.0, commentary to Chapter 4, section 1, para. 1 (noting that the International Group of Experts agreed that, with a few exceptions, the Articles “replicate customary international law”).
The remainder of this note explains the basics of the relevant law from the perspective of its application to cyber operations of the kind discussed in the present toolkit. Its aim is to assist the readers in understanding the structure used in the analysis of the individual scenarios while avoiding unnecessary repetition in the text of those scenarios.
=== Attribution ===
The conduct of the actors in the scenario must be attributable to an entity that bears the relevant obligation under international law.Cf. Articles on State Responsibility, Art. 2(a). For the most part, international law regulates the conduct of States, and therefore the section on attribution typical considers whether the relevant conduct is imputable to any of the States mentioned in the scenario. To the extent that non-State actors (such as international organizations, private companies or organized armed groups) bear specific legal obligations under international law, this is highlighted in the text and if attribution of specific conduct to such entities poses particular problems, this is also considered in the same section.
As far as attribution of conduct to States is concerned, it is useful to distinguish between, on the one hand, the conduct of State organs or in exercise of governmental authority and, on the other hand, the conduct of non-State actors:Cf. B Stern, “The Elements of an Internationally Wrongful Act”, in J Crawford, A Pellet and S Olleson (eds), The Law of International Responsibility (OUP 2010) 203–08 (distinguishing between “[o]rgans of the State and persons or entities exercising elements of governmental authority” and “[p]ersons and entities acting on behalf of the State”).
The details of the individual modes of attribution are considered in the specific scenarios. In some cases, the aspect of evidence is considered:
=== Breach ===
Although the application of these rules to the particular facts is the task of the individual scenarios, the toolkit contains an overview of each of these rules from the perspective of cyber-related activities. These overviews provided in collapsible sections within the individual scenarios and they can also be accessed directly at the links above or through the general List of articles.
=== Responses and justifications ===
Some of the generally accepted circumstances precluding wrongfulness are responsive in nature, in the sense that they allow the relevant actor to claim that it is responding to a prior act of another entity or to a previously existing situation and that it is the fact of acting in response which justifies the lawfulness of the conduct in question. Accordingly, the scope of the third part of the legal analysis section is broader than a mere consideration of the applicable circumstances precluding wrongfulness. On occasion, other available responses (such as retorsions or responses authorized by the municipal law of the acting State) are also discussed, even if these do not serve to shield the acting entity from international responsibility.
Other responses may be available on the facts of the individual scenarios and are discussed there if appropriate.
== Appendixes ==
=== See also ===
=== Notes and references ===
=== Bibliography and further reading ===
* MN Schmitt (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (CUP 2017)
* etc.