40 Fifth Report Annex B about state responsibility both generally and in the IHL context based on the existence of some armed conflict as that term is used in the Geneva Conventions. 22. In terms of their responses, several Member States emphasized the difficulty of attribution in cyberspace.47 Others focused less on the question of liability for proxy behavior and more on the State’s responsibility to take care that its territory was not used by non-State actors to launch attacks.48 Thus, Peru commented that “if there is inertia on the part of a State in controlling a nonstate actor that unleashed a cyberattack against another State, despite having the capacity to control them, then that could give rise to their conduct being attributable to the State.”49 For its part, Bolivia emphasized that States should not bear responsibility where they lack the technological infrastructure to control non-State actors.50 And the United States emphasized that the “mere fact that a cyber activity was launched from, or otherwise originates from, another State’s territory or from the cyber infrastructure of another State is insufficient, without more, to attribute the activity to that State.”51 23. For those States whose responses focused on the question of proxy actors, the Articles of State Responsibility (“ASR”) loomed large. Chile, Guyana, and Peru all based their response on ASR Article 8: The conduct of a person or group of persons shall be considered an act of a State under international law if the person or group Guatemala Response, supra note 1, at 3 (finding “clear responsibility” for a cyberattack is “by no means an easy task”); Peru Response, supra note 1, at 4 (noting great “uncertainty in attribution, and levels of attribution, of cyber attacks” making it harder “to control those who use cyberspace to unleash attacks over the Internet”). 48 Ecuador Response, supra note 1, at 1 (“States cannot be held liable for an attack by a nonstate actor, but there should be some way [for them] to collaborate to find the perpetrators. Furthermore, a state is responsible for regulating/setting standards for services to prevent territory belonging to a state from being launch [sic.] an attack.”); Guatemala Response, supra note 1, at 3 (answering in terms of due diligence of the host State rather than the amount of control over proxy actors). 49 Peru Response, supra note 1, at 4 (citing ASR Article 11). 50 Bolivia Response supra note 1, at 3-7. On the question of proxies, Bolivia’s response was indirect, although it did suggest a link between a State and non-State actors associated with its defense policy objectives and/or strategies of a State in a situation of armed conflict. Id. 51 2014 US GGE Submission, supra note 1, at 738. 47 Inter-American Juridical Committee of persons is in fact acting on the instructions of, or under the direction or control of, that State in carrying out the conduct.52 The ASR, however, did not offer an opinion on which type of “control” the State needs to exhibit, suggesting it is “a matter for appreciation in each case.”53 This tracks U.S. views, which endorse State responsibility for “activities undertaken through ‘proxy actors’ who act on the State’s instructions or under its direction or control” while only saying that the degree of control exhibited must be “sufficient.”54 The United States has also acknowledged that a State may later acknowledge or adopt a non-State actor’s cyber operation as its own.55 24. However, one State, Chile, did offer its views on the level of control required to trigger legal responsibility. Citing the Nicaragua and Genocide cases, Chile opined that the “degree or level of control or involvement of a state in the operations of a non-state actor, required to trigger its international responsibility is that of effective control.”56 Chile, moreover, took the view that the standards of State responsibility are the same in the context of armed conflicts.57 25. With respect to IHL, Peru took a similar stance, favoring a uniform rule of State responsibility both in and outside of armed conflicts. While recognizing the ASR contemplates being supplanted by lex specialis, it indicated that doing so requires an integrated analysis. And in this case, “[a]n examination of the Geneva Conventions does not disclose any difference with respect to the provisions on international responsibility set down in the Draft Articles on Responsibility of States for Internationally Wrongful Acts; therefore, it cannot ASR, supra note 41, Art. 8; Chile Response, supra note 1, at 2; Guyana Response, supra note 1, at 3; Peru Response, supra note 1, at 4. Chile and Peru’s responses also appear based on ASR Article 5 assigning State responsibility to “[t]he conduct of a person or entity which ... is empowered by the law of [a] State to exercise elements of the governmental authority … provided the person or entity is acting in that capacity in the particular instance.” See Chile Response, supra note 1, at 2; Peru Response, supra note 1, at 4. 53 ASR, supra note 41, at 48 (Commentary to Art. 8). 54 Koh, supra note 1, at 596; 2014 US GGE Submission, supra note 1, at 738 (same); Egan supra note 1, at 821; 2016 US GGE Submission, supra note 1, at 826. 55 Egan supra note 1, at 821; 2016 US GGE Submission, supra note 1, at 826. 56 Chile Response, supra note 1, at 2. 57 Id. at 3. 52 International Law and State Cyber Operations 41

Select target paragraph3

Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents