Scenario 21: Misattribution caused by deception

A State launches a cyber operation against another State but orchestrates the attack in a way that points towards a third country as the wrongdoer. The victim State launches retaliatory measures against the alleged wrongdoer. The legal analysis of this scenario examines legal responsibility for cyber retaliation directed against the wrong target due to misattribution. It also assesses whether a mistake of fact can alleviate international responsibility of the responding State towards the victim State.
== Scenario ==
=== Keywords ===
Deception, mistake of fact, misattribution, evidence, countermeasures
=== Facts ===
[F1] State A decides to conduct a harmful cyber operation against State B with deceptive elements to orchestrate wrongful attribution of this operation to its global competitor, State C. The aim is that misattribution of such a false-flag cyber operation will be followed by retaliatory measures of State B against State C.
[F2] Thus, the Central Intelligence Bureau of State A covertly launches a sophisticated deceptive cyber operation against State B (incident 1). The malware used against State B causes significant damage to its electric power grid. In particular, servers and workstations of the National Grid Control Centre of State B are knocked offline by deleting critical system files, resulting in temporary loss of control over the distribution of power across the country and local power outages. As a result, the e-government services provided by State B are down in some regions for about a week.
[F3] The malware was created in such a way as to point towards State C. Specific segments of codes, toolkits and methods are used and combined in a way to allow State B to identify false but persuasive traces leading to State C. The alleged origin of the cyber incidents from State C is confirmed also by information acquired by State B’s intelligence services.
[F4] State B publicly denounces State C for the hostile cyber operation. At the same time, as a retaliation, its central intelligence service conducts a reciprocal cyber operation against the internal servers of the central national authority that is responsible for the distribution of electric power in State C (incident 2). This operations leads to country-wide power outages in State C and a similar disruption of e-government services provided by State C.
===Examples===
*Olympic Destroyer (2018)
*Stuxnet (2010)
==Legal analysis==
For a general overview of the structure of analysis in this section, see Note on the structure of articles.
[L1] The scenario consists of two distinct acts of two actors: the false-flag operation carried out by State A against State B (incident 1) and the retaliatory operation of State B against State C (incident 2). The scenario analyses and discusses various aspects of international responsibility in connection with these acts. The analysis first proceeds with the assessment of the initial false-flag cyber operation of State A against State B (incident 1) and then it continues with the assessment of the retaliatory measures of State B against State C (incident 2).
===Responsibility of State A===
====Responsibility for the false-flag cyber operation====
[L2] The false-flag cyber operation of State A against State B (incident 1) amounts to a breach of the prohibition of intervention and obligation to respect sovereignty of other States.For detailed analysis of these obligations, including the question of the breach of the prohibition of the use of force, see a similar fact pattern in Scenario 3 and Scenario 17. See also the Case Concerning Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Judgement (1986) at para 205 and the Tallinn Manual 2.0, Commentary to Rule 66, paras 15-18. State A launched a sophisticated cyber operation against State B that caused the loss of control over the distribution of power across its territory and local power outages. This coercive action led to the loss of functionality of State B’s critical infrastructure and its e-government systems, significantly reducing its capability to serve its inherently governmental functions and its ability to conduct its affairs freely. Alternatively, the disruption of critical infrastructure by cyber means could be linked to a loss of functionality of cyber infrastructure and hence a violation of territorial sovereignty.Tallinn Manual 2.0, commentary to rule 4, para 13. Some States would even consider a mere disruption of critical infrastructure as such a violation. Based on the facts provided, the conduct is attributable to State A since it was conducted by its central intelligence service, which is an organ of State A.Tallinn Manual 2.0, Rule 15. See also Attribution.
====Responsibility for the internationally wrongful act of another State====
[L3] A challenging question arises whether State A was internationally responsible for the wrongful conduct committed by State B against State C, but orchestrated by State A (incident 2). In other words, is it possible, and if so, on what grounds, for State C as the injured State to invoke the responsibility of State A for the consequences caused by the retaliatory measures of State B? The rules on State responsibility contain legal constructions on how a State can incur responsibility in connection with the wrongful conduct of another State. These rules are also applicable to cyberspace.Tallinn Manual 2.0, Rule 18.
[L4] The commission of a false-flag cyber operation by State A does not fit any of the recognized forms of implication of international responsibility for the conduct of State B. The nature of the relationship between the two States cannot be qualified as aid or assistance since State B was not aware of the origin of the false-flag operation and intent of State A. There was also no relationship of dependence that would amount to direction or control.Christian Dominicé, ‘Attribution of Conduct to Multiple States and the Implication of a State in the Act of Another State’ in James Crawford and others (eds), The Law of International Responsibility (OUP 2010) 287-288. It might be noted that the mere incitement is not unlawful in the law of State responsibility. Finally, State B was not coerced to engage in retaliatory measures against State C as it was not deprived of its freedom of action.The above-described forms of derived responsibility may have relevance in different scenarios. For example, a State knowingly providing its cyber infrastructure to another State for the commission of a wrongful act by the latter may incur international responsibility for such assistance (Tallinn Manual 2.0, Commentary to Rule 18, para 6). Above-described forms of derivative responsibility may also be relevant when cyber operation is conducted through networks of computers infected and used remotely without the free will of the territorial State (botnets as used against Estonia in 2007) - see François Delerue, Cyber Operations and International Law (CUP 2020) 307. Consequently, it is not possible for State C as the injured State to invoke the responsibility of State A for the consequences caused by the retaliatory measures of State B (incident 2).
====Responsibility for deceptive conduct====
[L5] It could be questioned whether State A’s misleading of State B into the commission of an internationally wrongful act against State C itself amounts to a separate breach of an international legal obligation and if so, which international obligation. In other words, does misleading another State to act in an unlawful way itself constitute a violation of international law on the part of the deceiving State?
[L6] Misleading of another State is a matter not per se regulated by international law, however it may be contrary to the sic utere tuo (no harm) principle. This principle is recognized as a limitation on State sovereigntyJutta Brunnée, ‘Sic utere tuo ut alienum non laedas’, in Rüdiger Wolfrum (ed) Max Planck Encyclopedia of Public International Law (updated March 2010) para 4 and 9. and in specific areas (in particular, international environmental law) as a distinct legal norm.Ibid, para 10; Legality of the Threat or Use of Nuclear Weapons, ICJ, Advisory Opinion (1996) para 29. However, it does not at present time constitute a standalone legal rule applicable in the cyber context.François Delerue, Cyber Operations and International Law (CUP 2020), Chapter 8: Cyber Operations and the Principle of Due Diligence. Consequently, misleading another State to engage in misdirected cyber retaliation does not in itself constitute a violation of international law.
===Retaliatory measures and responsibility of State B===
[L7] State B launched a cyber operation against State C (incident 2). Based on the facts provided, the conduct is also attributable to State B since it was conducted by its central intelligence service which is a State organ.ILC Articles on State Responsibility, Art. 4; Tallinn Manual 2.0, Rule 15. See also Attribution. This operation caused a loss of functionality of State C's critical infrastructure and its e-government systems, significantly reducing its capability to serve its inherently governmental functions and its ability to conduct its affairs freely. Alternatively, the disruption of critical infrastructure by cyber means could be linked to a loss of functionality of cyber infrastructure and hence a violation of territorial sovereignty.Tallinn Manual 2.0, commentary to rule 4, para 13. Some States would even consider a mere disruption of critical infrastructure as such a violation. Such action amounted to the violation of the prohibition of intervention and of the obligation to respect sovereignty of other States.For detailed analysis of these obligations, including the question of the breach of the prohibition of the use of force, see a similar fact pattern in Scenario 3 and Scenario 17. See also the Case Concerning Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Judgement (1986) at para 205 and the Tallinn Manual 2.0, Commentary to Rule 66, paras 15-18. The international responsibility of State B may be precluded if its conduct fulfils conditions of any of the circumstances precluding wrongfulness. The two next subsections examine whether the wrongfulness of State B’s conduct could be precluded on the grounds that it qualifies as a lawful countermeasure or that the State was acting in error.
====Countermeasures====
[L8] As the first basic precondition, the act constituting a countermeasure must be taken in response to a previous internationally wrongful act of another State and must be directed against that State.Case Concerning the Gabčíkovo-Nagymaros Project (Hungary v. Slovakia), Judgement (1997) para 83; Tallinn Manual 2.0, Commentary to Rule 26, para 6. This appears problematic in the present case since the technical evidence and intelligence information acquired by State B point towards State C as the wrongdoer, but in reality, the author of the false-flag cyber operation was State A. Identification of the wrongdoer and attribution in context of cyber operations is challenging due to evidentiary and technicalFor an overview of possible technical methods of attribution, see Massimiliano Albanese and others, ‘Deceiving Attackers by Creating a Virtual Attack Surface’ in Sushil Jajodia and other (eds), Cyber Deception: Building the Scientific Foundation (Springer 2016) 150-151. peculiarities of cyberspace that make it possible to hide identity and leave false traces.Robin Geiss and Henning Lahmann, ‘Freedom and Security in Cyberspace: Shifting the Focus Away from Military Responses Towards Non-Forcible Countermeasures and Collective Threat-Prevention’ in Katharina Ziolkowski (ed), Peacetime Regime for State Activities in Cyberspace (NATO CCD COE 2013) 625-626. At the same time, the basic principle is that in bilateral disputes, the onus to establish responsibility lies on the injured State. This places high demands on the injured State with respect to the process of attribution of a harmful conduct. See Evidentiary standards.
[L9] However, the criteria for establishment of international responsibility are objective.There are some subjective elements in the realm of derivative responsibility discussed below (eg. aid or assistance or coercion). See James Crawford, State Responsibility: The General Part (CUP 2013) 405. Subjective considerations, including mistakes of fact, faultMary Ellen O'Connell, The Power & Purpose of International Law: Insights from the Theory & Practice of Enforcement (OUP 2008) 248. or intent are not relevant unless otherwise provided by the primary norm in question.James Crawford, State Responsibility: The General Part (CUP 2013) 61. ILC Articles on State Responsibility, Commentary to Art. 2, at para 3. For an explanation of a different approach, see Giuseppe Palmisano, ‘Fault’, in Rüdiger Wolfrum (ed) Max Planck Encyclopedia of Public International Law (updated September 2007) para 6-14. Since the false-flag operation was carried out by State A and therefore cannot be attributed to State C, the condition of an internationally wrongful act attributable to State C is not fulfilled and countermeasures cannot be lawfully directed against this State.
[L10] Moreover, the retaliatory measures of State B do not fulfil other requirements for countermeasures in international law, namely a previous call upon the allegedly responsible State to fulfil its obligations, notification of the intended countermeasures and offer for negotiations.For more details on function and preconditions of countermeasures in the domain of cyberspace, see Robin Geiss and Henning Lahmann, ‘Freedom and Security in Cyberspace: Shifting the Focus Away from Military Responses Towards Non-Forcible Countermeasures and Collective Threat-Prevention’ in Katharina Ziolkowski (ed), Peacetime Regime for State Activities in Cyberspace (NATO CCD COE 2013) 628-644, and Tallinn Manual 2.0, Rules 20-25. Since countermeasures shall not affect the obligation to refrain from the threat or use of force, it would also be necessary to assess whether the destruction of a critical infrastructure in State C could not amount to the use of force. See Case Concerning Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Judgement (1986) para 249; ILC Articles on State Responsibility, Art. 50 para 1, letter a). Since the very first condition of countermeasures – existence of an internationally wrongful act on side of State C – is not met, it is not necessary to engage in an in-depth analysis of these other requirements.For the application of the other conditions of countermeasures, see Scenario 06.
====Relevance of mistake of fact====
[L11] The wrongful conduct of State B against State C was a consequence of misattribution caused by the wilful deception orchestrated by State A. Despite the existence of the mistake of fact in this case, conditions of international responsibility of State B are established due to their objective nature.
 
[L12] It is then to be discussed whether the mistake of fact on the part of State B alleviates the wrongfulness of its retaliatory operation against State C. However, mistake of fact does not qualify as a distinct circumstance precluding wrongfulness, nor is it relevant for the invocation of any of the recognized circumstances precluding wrongfulness. It follows that State B is internationally responsible for the retaliatory operation against State C, even if it acted in error.
[L13] The wrongfulness of the retaliatory operation of State B against State C is not precluded by any circumstance precluding wrongfulness. Therefore, the conduct of State B constitutes an internationally wrongful act.
==Checklist==
*Sovereignty:
**Does the conduct of State A amount to a breach of sovereignty of State B?
**Does the conduct of State B amount to a breach of sovereignty of State C?
*Prohibition of intervention:
**Does the conduct of State A or State B amount to a violation of the prohibition of intervention under international law?
*False-flag operation:
**Did State A coerce State B to engage in retaliation against State C?
**Did State A aid or assist State B in retaliation against State C?
**Did State A control State B with respect to retaliation against State C?
*Countermeasures:
**Is State B applying countermeasures in response to a prior internationally wrongful act of the responsible State?
**Do the measures taken by State B meet the conditions prescribed for the lawful resort to countermeasures under international law?
**Are the retaliatory measures directed against the State to which the internationally wrongful act can be attributed?
**What is the relevance of mistake of fact?
*Circumstances precluding wrongfulness
**Are the conditions of any of the circumstances precluding wrongfulness met?
**Does error or mistake of fact qualify as or is relevant for any of the circumstances precluding wrongfulness?
==Appendixes==
===See also===
*Attribution
*Evidentiary standards
*Mistake of fact
*Prohibition of intervention
*Sovereignty
*Use of force
*Circumstances precluding wrongfulness
*Countermeasures
*Scenario 03: Cyber operation against the power grid
===Notes and references===
===Bibliography and further reading===
* Christian Dominicé, ‘Attribution of Conduct to Multiple States and the Implication of a State in the Act of Another State’ in James Crawford and others (eds), The Law of International Responsibility (OUP 2010).
* François Delerue, Cyber Operations and International Law (CUP 2020).
* James Crawford, State Responsibility: The General Part (CUP 2013).
* James Crawford, ‘State Responsibility’ in R Wolfrum (ed), Max Planck Encyclopedia of Public International Law (OUP 2008).
* Jutta Brunnée, ‘Sic utere tuo ut alienum non laedas’ in Rüdiger Wolfrum (ed), Max Planck Encyclopedia of Public International Law (OUP 2008, updated March 2010)
* Kristin E. Heckman and others, Cyber Denial, Deception and Counter Deception: A Framework for Supporting Active Cyber Defence (Springer 2015) - addressing deception as a strategy and technical method of resisting and eliminating cyber intrusions.
* Marco Roscini, ‘Evidentiary Issues in International Disputes Related to State Responsibility for Cyber Operations’ (2015) 50 Texas International Law Journal 1. 
* Michael N Schmitt (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (CUP 2017).
* Michael N Schmitt, ‘'Below the Threshold' Cyber Operations: The Countermeasures Response Option and International Law’ (2014) 54 Virginia Journal of International law 1.
* Robin Geiss and Henning Lahmann, ‘Freedom and Security in Cyberspace: Shifting the Focus Away from Military Responses Towards Non-Forcible Countermeasures and Collective Threat-Prevention’ in Katharina Ziolkowski (ed), Peacetime Regime for State Activities in Cyberspace (NATO CCD COE 2013)
*
===Contributions===
* Scenario by: Petr Stejskal & Martin Faix
* Analysis by: Petr Stejskal & Martin Faix
* Reviewed by: François Delerue and Anna-Maria Osula
Previous: Scenario 20: Medical facilities	Next: Scenario 22: Cyber methods of warfare
Category:Attribution
Category:Countermeasures
Category:Deception
Category:Evidence
Category:Mistake of fact
Category:Misattribution
Category:Scenario