Inside Cyber Warfare - Jeffrey Carr [37]
This shift began with the International Tribunal for the former Yugoslavia’s seminal opinion on state responsibility in the Tadic case, in which it revised the direct control test to impute host-state responsibility for the actions of groups of nonstate actors over when a state exercised “overall control” of the group, even though the state may not have directed the particular act in question.[10] Although overall control is still a form of direct control, the opinion marked a significant relaxation of the standard for state responsibility.
The shift to indirect responsibility continued through the middle of 2001, with a general consensus emerging that any breach of a state’s international obligations to other states, whether from treaty law or customary law, and whether the result of a state’s acts or its failures to act, resulted in international responsibility for the state.[11] This consensus solidified following the 9/11 terrorist attacks on the United States, bringing us to today’s framework for state responsibility.
September 11, 2001, marked the culmination of the shift of state responsibility from the paradigm of direct control to indirect responsibility. On that date, Al Qaeda terrorists hijacked four airplanes, flew three of them into buildings in the United States, and killed more than three thousand US citizens in what was widely recognized as an armed attack. Al Qaeda was based in Afghanistan, which at the time was ruled by the Taliban. While the Taliban harbored Al Qaeda and occasionally provided it limited logistical support, the Taliban did not exercise effective or even overall control over Al Qaeda. Further distancing the Taliban from 9/11 is the lack of evidence suggesting that the Taliban knew of the 9/11 attacks beforehand, or even endorsed them after the fact. Yet despite all of this, it was internationally accepted that Al Qaeda’s acts were legally imputable to the Taliban, and thus to Afghanistan, because it had harbored and sheltered Al Qaeda, and refused to stop doing so, even after being warned to stop.
Thus, following 9/11, state responsibility may be implied based on a state’s failure to fulfill its international duty to prevent nonstate actors from using its territory to attack other states. As such, there need not be a causal link between a wrongdoer and a state; rather, only a failure of a state to uphold its duty to prevent attacks from its territory into another state. “Hence, a state’s passiveness or indifference toward [a non-state actor’s] agendas within its own territory might trigger its responsibility, possibly on the same scale as though it had actively participated in the planning.”[12] Much of the legal analysis of whether a state is responsible will “turn on an ex-post facto analysis of whether the state could have put more effort into preventing the...attack.”[13]
However, even when state responsibility is imputed for the armed attacks of nonstate actors, states may still be forbidden from responding with force. The final step in the legal analysis ends with the legality of cross-border operations against other states.
Cross-Border Operations
Cross-border operations into the territory of an offending state are the natural consequence of imputed state responsibility for the armed attacks of nonstate actors. However, states must meet a number of legal requirements before they may pursue a nonstate aggressor into another state in self-defense. To understand the rationale behind why states may breach a host-state’s general right to territorial integrity in self-defense and the requirements states must meet in order to do so, one