Cyber Attacks and the Problem of Attribution

Introduction

Under international humanitarian law (IHL), cyber warfare refers to the “means and methods of warfare that consist of cyber operations amounting to, or conducted in the context of, an armed conflict.¹ These attacks may include hacking, data breaches, disrupting the functioning of National Critical Infrastructure (NCIs), or aiding conventional armed conflicts with cyber technology. Cyber warfare is rapidly rising to become a global threat and thus attracting a lot of debate. Although there is no comprehensive law regulating cyber attacks under international law, Article 36 of Additional Protocol I to the Geneva Conventions (API) instructs states to routinely review the legality of emerging weapons, indicating that the existing law can regulate the cyber realm. This understanding was also echoed by the International Court of Justice (ICJ) in its Advisory Opinion on the Legality of Nuclear Weapons when it clarified that the IHL regime, its rules and laws, are applicable to “all forms of warfare and to all kinds of weapons, including those of the future.”²

While this leaves no doubt that the existing law can extend to cyber attacks; it does not mean that the application of the law is as straightforward as for conventional warfare. One of the biggest impediments to the application is the problem of attributing cyberattacks to either states or non-state actors where the identity of the attacker or the source of the attack is unknown. This article explores the question of attribution of those cyber attacks where attackers using modern technologies either conceal their identities, alter their IP addresses, or stage attacks, and offers potential solutions to ease the process of attribution in such cases.

What is a Cyber Attack?

According to Article 49 API, an attack is an “act of violence against the adversary, whether in offence or in defense”. Over the years, states have deliberated upon whether this definition should be broadened to include cyber operations under the definition of an ‘attack’. The Tallinn Manual 2.0 recognises a kinetic cyber attack as a “cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects.”³ Therefore, cyber operations causing physical damage to civilian objects or life amount to cyber attacks as per the attacks envisaged under Article 49 AP 1.

However, it is contentious whether cyber operations that cause data breaches leading to no physical damage constitute cyber attacks. This scepticism is furthered by the ICRC’s interpretation of attacks as ‘combat action’, denoting the requirement of physical force.⁴ This means that non-kinetic cyber operations which culminate in some physical damage are deemed as attacks, whereas cyber operations resulting in data breaches, or disrupting softwares or stealing military information, are not considered attacks and, therefore, not governed by the principles of distinction, proportionality and precaution under IHL. Regardless of the views on different types of attacks, states are increasingly realising the need of regulating cyberspace given its huge potential to create a humanitarian crisis during war.

The Test for Attribution

Under international law, tracing the origin of the attack is necessary for its attribution, as cyber attacks can be launched by states, non-state actors or forces posing to be both. The International Law Commission’s Draft Articles for Responsibility of States for Internationally Wrong Acts, 2001, holds that states are to be held responsible for attacks that are undertaken by state organs,⁵ persons or entities upon which the state exercises governmental authority,⁶ persons or groups acting under the state’s control and private persons,⁷ or groups whose conduct which the state adopts on its own.⁸ When the Tallinn Manual was being drafted, it was unanimously agreed by international legal experts, that the customary law of state responsibility is also applicable to cyber operations and activities.⁹ The only fact that the cyber attack breaches a state’s international legal obligation is sufficient for state responsibility to be invoked.¹⁰

Following this consensus, Rule 15 of the Tallinn Manual echoes the aforementioned Articles 4 and 5 of the Articles on State Responsibility. According to the explanatory note of the Rules, actions of state organs are attributable to the State¹¹ even outside the organisation’s approved authority, or ultra vires.¹² Furthermore, organs of the state would also consist of actors that are not directly an organ of the state, but have ‘complete dependence’ on the state or other entities that include some form of governmental authority.¹³ Additionally, the conduct of state agents acting on the instructions of, or under the direction or control of the State are also attributed to the State.¹⁴ Moreover, if an organ of the state is at the disposal of another state, if that organ functions exclusively under the control of the receiving state and thus indulges in activities for the objectives and on behalf of that state. In this case, the organ’s acts are attributable to the receiving state.¹⁵

However, there are certain problems that arise when attributing cyber activities under the state responsibility regime because of the difference between the nature of a conventional attack and a cyber attack.

Problems with Attribution

Prior to the global emergence of cyber operations, attacks could be attributed to a state when tanks, warships, or weapons were the primary means of conflict. However, the same cannot be said for cyber activities. Due to the ability to capture or spoof cyber infrastructure which may include the originating place, “the mere fact that a cyber operation has been launched or otherwise originates from a specific governmental infrastructure, or that malware used against hacked cyber infrastructure is designed to ‘report back’ to another State’s governmental cyber infrastructure is generally insufficient evidence for attribution to the State”.¹⁶ Contrary to a physical attack, the ongoing or incoming occurrence of cyber attacks is difficult to ascertain. Thus, the intangibility of cyber attacks exacerbates the attribution problem.

Another difficult legal question regarding attribution is the role of non-state actors. The problem arises when non-state actors are either deployed as proxies for a state of those non-state actors which may be working on behalf of the state without clear legal authority to do so. This problem has been expanded upon in Rule 17 of the Tallinn Manual which follows the language of Article 8 of the Articles of State Responsibility. Having said that, where a state has ‘effective control’ over the actions of the non-state actor i.e., specific instructions are given for actions, and not mere encouragement or support, the cyber activity of the non-state actor can be attributed to the state. However, the ultra vires activities of the non-state actors which fall outside the ‘effective control’ of the state would not be attributed to the state.

This problem is compounded by the contested threshold of attribution in the cyber realm and IHL in general. Traditionally, a “State’s preponderent or decisive participation in the financing, organising, training, supplying, planning” does not attract state responsibility as held by the ICJ in Military and Paramilitary Activities in and against Nicaragua (Nicaragua v the United States).¹⁷ The ICJ ruled that if the Nicaraguan rebels had been directed or controlled by the United States, only then they would have fallen on the “effective control standard”.¹⁸ Thus, in the cyber realm, providing cyber tools, identifying targets, selecting the date for the cyber operation is insufficient to implicate the state because of a non-state actor’s cyber activity. Such was seen in the Russia-Estonia conflict when Russia conducted cyber operations in Estonia, in the wake of the moving of a Russian war memorial.¹⁹

It has to be proven that the State exercises control over the non-state actors purporting cyber attacks. This leads to a two-fold problem: the difficulty of attributing a cyber activity with a state given the high threshold. If the activity cannot be attributed it means it cannot be regulated or stopped. Second, the recourse available to the victim state of an unattributable cyber activity is also problematic and unsatisfactory. The victim states cannot do much except for taking countermeasures, as they cannot force the host state to take effective action against the non-state actor in wake of the principles of sovereignty and due diligence.²⁰ Further, attribution is also critical to determine the legality of self-defence practiced by victim states through counter-offensive operations under Article 51 of the UN Charter, and further subject to the limitations of necessity and proportionality.

Solutions to the Problems of Attribution

Apart from the technological impairments that complicate attribution in the cyber realm, the lack of an evidentiary requirement agreed upon by the states is a major obstacle attributing cyber attacks. The ICJ suggested that the standards of evidence should vary according to the severity of the attack.²¹ However, as put forward by Kristen Eichensehr,²² varying scales of evidence can only be helpful for attacks of magnitude, but not for those which fall below the armed attack threshold. Hence, she argues that a minimum standard of ‘some’ evidence may avoid conflict in the developing realm.²³ For instance, detailed ‘sufficient’ technical information regarding the attack can be given to all potential attributors to confirm or debunk the attribution.²⁴

Government attributors should also provide information to other state and non-state actors for independent oversight.²⁵ Through this, attributors can bring their own findings which could collectively lead to either a confirmation or a refusal of attaching state responsibility to an attack. The recent attacks in England of WannaCry, NotPetya and the Organisation for the Prohibition of Nuclear Weapons hack demonstrate that collective attribution boosts the credibility of the claims made.²⁶ Therefore, the victim state must be able to convince every actor with sufficient and credible evidence of its attribution.²⁷ According to the Tallinn Manual, a state attributing a low-level cyber attack to a state must thus bring firm evidence against the perpetrator as compared to an attack which is highly disruptive.²⁸

Secondly, countermeasures should be restricted to states or non-state actors constituting internationally wrongful acts. However, short of countermeasures, victim States may be allowed to respond to such intrusions through ‘retorsions’ including protests, access to State resources, trade routes and economic sanctions that would affect the State.²⁹ The United States, in 2021, even allowed declaring diplomats persona non grata³⁰ and destablising cyber-activities, as hostile actions.³¹ These actions may be deemed unfriendly but still lawful.³² It should be noted that Self-Defence can only be resorted to when there is no doubt regarding the attribution of the attack.

Thirdly, there should be an international organisation which can impartially attribute cyberattacks based on the data from states and non-state actors that are reluctant in sharing data publicly. The CyberPeace Institute is an institution in Geneva that works on a similar mandate; however there is no clarity if the entity can hold states accountable.³³ If developed strategically and with the support of the leading States, such an organisation can also provide technical expertise – which is currently lacking – and support the weaker states that do not have the resources to rightfully initiate the process of attribution. Most importantly, the independence of the institution can prevent biased attributions, and its technical expertise available can avoid erroneous attributions.

Conclusion

Cyber activities are on the rise at the global stage. Such activities are now becoming the new normal instead of traditional attacks. International law, although envisaged much before the emergence of such technologies, is able to govern cyber operations under its ambit. The most important aspect of an attack for it to be fully prosecuted is its attribution to either a state, or a non-state actor. Traditionally, any activity related to a physical attack could be easily ascertained. However, the same cannot be done with cyber activities as attackers can easily conceal their identities.

Moreover, non-state actors either acting as proxies or acting without any clear legal authority is a major hurdle to the attribution of a cyber activity. This leaves many questions of how such activities can be traced back to entities and the remedies available to the victim states. In order to solve this debacle, some minimum evidentiary requirement is needed for attribution of cyber attacks to states whereby such requirement is vetted by third-parties i.e., both states and non-state actors, as all potential contributors to confirm attributions. Moreover, severing of diplomatic and economic ties should be a remedy available to victim States that do not or cannot engage in counter measures. Lastly, an international independent and impartial entity is needed to spearhead the process of attribution to ensure transparency and accuracy.

Aleezay Saeed

Aleezay Saeed is a 4th year student of law & policy at the Lahore University of Management Sciences. Her primary interests include international development and constitutional law. She also takes keen interest in the compliance of domestic policies related to gender with international standards.