Attribution in Cyberspace: State Responsibility, Power, and Inequality in International Law
Updated: 2 days ago
INTRODUCTION
On 23rd December 2015, a cyber sabotage operation was conducted against Ukraine, a Russian advanced persistent threat group known as "Sandworm", which targeted the SCADA system power grids, disabling substations, and impacting innocent civilians. This is a pivotal moment in that cyber-attacks are no longer the prerogative of individual criminal enterprises but an apparatus of contemporary warfare. But international law still has its basis in a state-centric, evidence-intensive model, which is oriented towards a world of recognisable actors and territorial behaviour. Today, we don’t just live in a real world but also in a virtual world in which IT-mediated communication and action take place, often referred to as “Cyber Space.” It has given birth to several new crimes which are not fully or formally recognised under international law, even after the Budapest and Hanoi Conventions in 2001 and 2024, respectively. It undermines the assumptions by facilitating the anonymity, decentralisation and plausible deniability, which makes accountability harder and harder.
“In cyberspace, harm is visible, but responsibility is not.”
This shows a basic weakness with international law, as it simply fails to deal with decentralised cyber activities. Consequently, there are still major accountability loopholes, which strengthen the status quo of power asymmetry around the world and enable technologically superior states to act in a legal grey area in the computer age.
__________________________________________________________________________
2. LEGAL FRAMEWORK OF STATE RESPONSIBILITY
The legal framework of state responsibility is governed by international law, which is dealt under the Articles on Responsibility of States for Internationally Wrongful Acts. Article 2 states that an unjust act attributed to the state that is a breach of an international obligation, by commission or omission, will be liable. Article 4 also explains in detail the nature of attribution by determining that any state organs are attributable to the State. Article 8 also highlights the problem of non-state actors being instructed or directed by the state to carry out actions, broadening the responsibility sphere in international law. Similarly, Article 11 provides attribution under which a state recognises and internalises conduct as its own.
This model assumes identifiable actors, territorial conduct, and conspicuous chains of responsibility. These assumptions, however, are undermined by cyber operations: they are anonymous, borderless and obscure the distinction between warfare and espionage.
Although it is usually viewed that international law is technology-neutral and flexible to cyberspace activities, its practical application is highly flawed due to anonymity, technical obscurity, and evidentiary ambiguity in cyberspace.
___________________________________________________________________________
3. ATTRIBUTION AND DUE DILIGENCE IN CYBER OPERATIONS
Attribution is the greatest challenge faced in implementing state accountability in cyber actions. In Nicaragua v United States, the test of “effective control” was established by the International Court of Justice, and later, in the Bosnian Genocide Case, it affirmed the same. This criterion requires that some operations are clearly controlled by the state, and this is an evidentiary burden, difficult to meet in traditional cases, and even more so in the cyber world, where operations are carried out through all sorts of decentralised networks and proxies, such as unofficial groups that are state-sponsored. False flag operations and the technical ambiguity of digital evidence also make attribution challenging.
Contrarily, international law provides the other principle of due diligence. In the Corfu Channel Case, the ICJ decided that states should not wilfully permit their sovereign land to be used in committing acts that are against the rights of other states. This is reflected in the Tallinn Manual 2.0 in Rule 6, which states that states are obliged to intercept harmful cyber operations that originate on their soil, even without attribution.
Nonetheless, due diligence is not developed and implemented properly. Lack of clarity on what is meant by reasonable measures, the aspect of sovereignty and technical constraints have constrained its application in practice. Therefore, attribution might demand certainty, which is not always available, but due diligence provides a feeble and inefficient substitute.
___________________________________________________________________________
4. CYBER-ATTACKS AS USE OF FORCE UNDER INTERNATIONAL LAW
The classification of cyber-attacks under the law on the use of force remains contested. Article 2(4) of the UN Charter outlaws the “deployment of force” by states, and Article 51 acknowledges the “right to self-defence” as inherent in reaction to an armed attack. Nonetheless, how these provisions apply to cyber operations remains open to debate.
In 2010, the Stuxnet cyberattack targeted the Natanz Nuclear Facility of Iran by installing advanced malware that slowed down the Iranian nuclear programme. No state has officially accepted accountability, though many have blamed the United States and Israel. This leads to a fundamental legal issue:
Whether a cyber attack has the same amount of physical destruction as a traditional military attack, and whether it will be considered as use of force or even an armed attack?
Likewise, the 2017 NotPetya ransomware attack brought critical infrastructure, shipping companies, banks, and government systems to a halt. Although some states subsequently blamed the attack on Russia, it did not result in physical destruction per se, but rather in economic disruption. This generates additional confusion —
Can economic damage on a grand scale qualify as the threshold for the use of force under Article 2(4)?
This ambiguity in practice allows states to exploit the legal ambiguity and carry out cyber operations without severe consequences while escaping the moral and political responsibility traditionally linked to the use of force.
___________________________________________________________________________
5. POWER & INEQUALITY IN CYBER ATTRIBUTION
The distribution of cyber attribution is uneven; it reflects and reinforces pre-existing global power structures. The Global North has a “triple monopoly” on cyberspace, including infrastructure-like data centres, tech platforms, and cyber intelligence such as SIGINT Network. Therefore, these states are better equipped to use cyber capabilities.
However, the Global South is digitally dependent on the technologies and infrastructure alien to it, which places it in a vulnerable position to cyber attacks. Simultaneously, such states tend to be deficient in the necessary technical and institutional capability to achieve a dependable attribution, limiting their chance to respond effectively or hold perpetrators accountable. This asymmetry also brings about some sort of “digital colonialism” where cyber data, platforms and governance are dominated by a few influential states.
India, however, has a unique paradox. India has become one of the biggest digital economies in the world, and a high-value target of state-sponsored attacks. The AIIMS Delhi Ransomware Attack and the RedEcho campaign, both attributed to China, demonstrate that there is a wide disparity in advanced forensic skills and low attribution ability relative to the “Five Eyes alliance”.
Ultimately, cyber norms are not neutral—they mirror geopolitical realities. As such, “the inability to attribute is not merely a legal failure—it is a structural inequality.”
___________________________________________________________________________
6. CRITICAL ANALYSIS
The current paradigm of state responsibility in cyberspace, in turn, faces the main challenge of the gap between international law and its implementation, as well as the gap between existing legal standards and their practical application. While Nicaragua v United States continues to serve as a relevant case for the effective control test, it poses challenges with respect to attribution of decentralised digital warfare, which sets an unrealistic precedent of attributing a proxy actor and ignoring state-backed hacktivism. The attribution doctrine, therefore, offers states a plausible deniability since it may be employed to evade responsibility under the veil of technical ambiguity. The problem is therefore not that the law is obsolete, but that the law demands a level of attribution that cyberspace can make exceptionally difficult to prove.
Enforcement is also being weakened by the use of soft law tools like the Tallinn Manual, since they are not binding.
The structural power imbalance between the developed states and the developing states is also persistent, with the developed states in charge of the attribution narratives and the developing states unable to even name the violations. As Schia observes, these technological disparities create significant vulnerabilities for the Global South.
This makes international law nothing more than a spectator and not a strong institution to regulate cyberspace.
Author:-
Srijopriyo Das is a second-year B.A. LL.B. law student at Symbiosis Law School, Hyderabad. He has eight publications to his credit and has developed a keen interest in International Law, Criminal Law, Constitutional Law, and Corporate Law. As a motivated law student and aspiring legal researcher, he is committed to engaging in meaningful academic research and contributing to the development of the legal field.
Co-Author:-
Palash Bhattacharjee is a second-year B.A. LL.B. law student at Symbiosis Law School, Hyderabad. He has three publications to his credit and his primary research interests lie in International Law, Corporate Law, and Taxation. He is a motivated law student with a strong inclination towards legal research and scholarship, aspiring to contribute meaningfully to the legal field through his academic pursuits
