A/76/136 especially those of a technical nature, of the cyber operation. A comprehensive assessment of the circumstances of the individual case will be necessary to establish an attributive link. 104 Beyond the mentioned situations of attribution and aid and assistance, a State may also become liable under international law in connection with another State’s or a non-State actor’s actions if the first State fails to abide by its obligations stemming from the ‘due diligence’ principle. 105 The application of the international rules on State responsibility and hence the act of formally attributing a malicious cyber operation to a State under international law is first and foremost a national prerogative; however, international cooperation and exchange of information with partners in this regard can be of vital importance. In practice, establishing the facts upon which a decision on attribution may be based is of specific concern in the context of cyber operations since the author of a malicious cyber operation may be more difficult to trace than that of a kinetic operation. At the same time, a sufficient level of confidence for an attribution of wrongful acts needs to be reached. Gathering relevant information about the incident or campaign in question has a technical dimension and may involve processes of data forensics, open sources research, human intelligence and reliance upon other sources – including, where applicable, information and assessments by independent and credible non-state actors. Generating the necessary contextual knowledge, assessing a suspected actor’s motivation for conducting malicious cyber operations and weighing the plausibility of alternative explanations regarding the authorship of a certain malicious cyber act will likewise be part of the process. All relevant information should be considered. 106 Germany agrees that there is no general obligation under international law as it currently stands to publicize a decision on attribution and to provide or to submit for public scrutiny detailed evidence on which an attribution is based. This generally applies also if response measures are taken. 107 Any such publication in a particular case is generally based on political considerations and does not create legal obligations for the State under international law. Also, it is within the political discretion of a State to decide on the timing of a public act of attribution. Nevertheless, Germany supports the UN Group of Governmental Experts’ position in its 2015 report that accusations of cyber-related misconduct against a State should be substantiated. 108 States should provide information and reasoning and – if circumstances permit – attempt to communicate and cooperate with the State in question to clarify the allegations raised. This may bolster the transparency, legitimacy and general acceptance of decisions on attribution and any response measures taken. 109 Attribution in the context of State responsibility must be distinguished from politically assigning responsibility for an incident to States or non-State actors: Generally, such statements are made at the discretion of each State and constitute a manifestation of State sovereignty. Acts of politically assigning responsibility may occur in cooperation with partners. As regards attribution in the legal sense, findings of national law-based (court) proceedings involving acts of attribution, for example in the context of criminal liability of certain office holders or non-State actors, may serve as indicators in the process of establishing State responsibility. However, it __________________ 104 105 106 107 108 109 40/142 Cf. Draft Articles on State Responsibility (note 97), art. 8, commentary, paras. 5 in fine, 7. See also above, I.a). Cf. also the voluntary, non-binding recommendation made by the UN Group of Governmental Experts, report of 2015 (note 52), para. 13 (b). On these points, see Tallinn Manual 2.0 (note 55), chapter 4, section 1, para. 13. UN Group of Governmental Experts, report of 2015 (note 52), para. 28 (f). Cf. also Tallinn Manual 2.0 (note 55), chapter 4, section 1, para. 13, citing the UN Group of Governmental Experts, report of 2015 (note 52). 21-09670