International Responsibility In Cyberspace: The Problems Of Attribution Of Conduct

Abstract

Investigation and qualification of cyber incidents of a cross-border nature are complicated by difficulties to identify the device from which the attack was carried out, to establish the true place of the malicious activity, to identify specific responsible persons, and to assess their relationship with a State that may be involved in the cyberattack. This makes it problematic to attribute the harmful activity to such State for the purposes of international responsibility. Within the scholarly discussions, various options for overcoming these problems of attribution are proposed, among which two approaches are the most noticeable. One such option is to mitigate the attribution dilemma by laying stress on States' duty of due diligence. Another route is to elaborate a lex specialis "lightweight" test for attribution of non-State actors' conduct to States, namely the test of "control and capabilities". This paper contains the authors' comment on the ways proposed by scholars to overcome the problems of implementation of the international legal responsibility of States in cyberspace, generated by the difficulties of attribution of conduct. The authors advocate the view that the international obligation of due diligence and a more flexible control test for attribution may actually serve as a means of solving the attribution problems in cyberspace, but they are not without drawbacks, related to the nature of the proposed rules, their content, as well as their political effect, and these should be taken into account in the further discussion of ways out of the current situation of lack of effective tools.