STATE RESPONSIBILITY FOR CYBER ATTACKS: COMPETING STANDARDS FOR A GROWING PROBLEM

摘要

At a time in which the unchecked sovereign authority of States is being challenged across many arenas, State responsibility remains a key component of international security. However, defining State responsibility in cyberspace has proven to be difficult given both the speed and anonymity of cyber attackers. Sponsoring States may, for example, incite groups to commit cyber attacks and then hide behind a (however sheer) veil of plausible deniability to escape accountability. This Article analyzes potential legal regimes of State responsibility to help hold these State sponsors of cyber attacks more accountable, including the effective and overall control standards. Other lesser-known standards are also reviewed, including the governmental awareness and the sliding scale approach. These regimes are then applied to real examples of State sponsorship, from the Estonian cyber militia to cyber criminals in Africa, including instances of neutral States allowing their networks to be used for launching cyber attacks thus giving rise to problems of neutrality and distinction that is analyzed under the Law of Armed Conflict. The Article concludes by arguing for the adoption of a flexible standard of State responsibility for cyber attacks given the extreme difficulties involved with proving the identity of cyber attackers.