Inside Cyber Warfare - Jeffrey Carr [25]
If the LOAC is used as a guideline to determine what is and is not cyber warfare, the attack must conform to certain rules. First, LOAC applies only once armed conflict has been initiated. Next, cyber incidents that correspond with the armed conflict must be attributable to a specific government. Then there is the issue of harmful intent. Did the cyber incident cause injury or damages (monetary, physical, or virtual)?
Attribution can be direct or indirect, according to international law as interpreted in “Cyber Attacks Against Georgia: Legal Lessons Identified” authored by Eneken Tikk et al. (NATO, 2008). According to Tikk and her team:
The governing principle of state responsibility under international law has been that the conduct of private actors—both entities and persons—is not attributable to the state, unless the state has directly and explicitly delegated a part of its tasks and functions to a private entity. A shift in this rigid paradigm can be observed in the developments of recent years: e.g. the International Criminal Tribunal for the former Yugoslavia in the Tadic case 104 and further by the international community in relation to the U.S. Operation Enduring Freedom in 2001. However, the current view for attribution still requires some form of overall control by the state.
The legal precedents referred to in the preceding quote are worth reading. Each follows with a brief summary of its import:
Jinks, D. “State Responsibility for the Acts of Private Armed Groups,” Chicago Journal of International Law, 4 (2003), 83–95, p.88.
“In the Nicaragua case, the International Court of Justice (ICJ) noted that the state may be held responsible for the conduct of private actors only if it executed effective control over such actors. Hence, the ICJ could not hold the United States responsible for the conduct of the contra rebels, because the United States did not exercise effective control over the contras. The Court also noted that, in order for the conduct of private actors to give rise to legal responsibility of the state, it would have to be proved that the state indeed had effective control over the conduct of private actors.”
Prosecutor v. Tadic—ICTY Case No. IT-94-1, 1999; Jinks, p.88–89.
“The Tadic case lowered the threshold for imputing private acts to states and concluded that states only need to exercise overall control over private actors in order to attribute to the state any unlawful acts of the actors. The ICTY in its reasoning held that the ‘effective control’ criterion of the ICJ was contrary to the very logic of state responsibility and that it was inconsistent with state and judicial practice.”
Jinks, supra note 103, p.85–87.
“Compared to the Tadic case, the U.S. Operation Enduring Freedom in turn lowered the threshold for attribution because the U.S. sought to impute al Qaeda’s conduct to Afghanistan simply because its official regime Taliban had harboured and supported the terrorist group (irrespective of whether Afghanistan exercised effective or overall control). The international community among with several important international organisations endorsed the U.S approach and determined that under international instruments the attacks of September 11 constituted armed attacks which triggered the U.S