38 Fifth Report Annex B At the same time, Koh clearly viewed the test as requiring an analogy, asking “whether the direct physical injury and property damage resulting from the cyber event looks like that which would be considered a use of force if produced by kinetic weapons.”39 He also cited specific examples of cyber operations that would constitute uses of force: (i) a nuclear plant meltdown caused by cyber activity; (ii) cyber operations that “open a dam above a populated area causing destruction”; and (iii) a cyber operation that disables “air traffic control resulting in airplane crashes.”40 To the extent all these examples involve some form of “violence,” it would appear that the United States favors a use of force threshold analogous to the one applied in the kinetic context. Question 4 Outside of armed conflicts, when would a State be responsible for the cyber operations of a non-State actor? What levels of control or involvement must a State have with respect to the non-State actor’s operations to trigger the international legal responsibility of that State? Question 5 Are the standards of State responsibility the same or different in the context of an armed conflict as that term is defined in Articles 2 and 3 common to the 1949 Geneva Conventions? 19. States are responsible not only for the behavior of their own organs and agencies in cyberspace, but also for any non-state actor that they endorse or control.41 The fourth and fifth questions ask about how States understand the assignment of international legal responsibility for non-State actor behavior, in particular the extent of State “control” required. As is well known, cyber threats may be authored not just by States directly but also by a range of Koh, supra note 1, at 595. Id. 41 See ILC, “Draft Articles on the Responsibility of States for Internationally Wrongful Acts” in Report on the Work of its Fifty-first Session (May 3-July 23, 1999), UN Doc A/56/10 55 [3] (“ASR”); accord Tallinn 2.0, supra note 20, Rule 15. 39 40 Inter-American Juridical Committee non-State actors, including hacktivist groups and cybercriminal organizations. In some cases, States may seek to employ these non-State actors as proxies for conducting various cyber operations. 20. Tying a proxy back to a principal in cyberspace can be technically quite challenging (although perhaps not as difficult as some supposed in the past). At the same time, a factual linkage is not enough, there must be legal attribution as well – i.e., a sufficient connection between a State and a non-State actor for the former to assume legal responsibility for the latter’s behavior. A State may, for example, endorse a non-State actor’s behavior after the fact, thereby assuming legal responsibility for it.42 Alternatively, States are legally responsible for non-State actor behavior that they control. Precisely how much control is, however, often unclear. In the Nicaragua case, the ICJ indicated that international law contains a rule imposing responsibility on a State for acts of those non-State actors over which it has “effective control” (e.g., ordering the behavior or directing an operation).43But, a few years later, the International Criminal Tribunal for the Former Yugoslavia (ICTY) adopted a looser standard of “overall control” for the purposes of IHL. As the ICTY put it, this test requires “more than the mere provision of financial assistance or military equipment or training” but not going so far as to insist on the “issuing of specific orders by the State, or its direction of each individual operation.”44 The ICC later endorsed the “overall control” standard.45 21. The ICJ, however, has continued to insist on its “effective control” formulation in the use of force context. At the same time, it signaled that the “overall control” test might be appropriate in the IHL context, raising the possibility of a consensus on “overall control” in the IHL context and “effective control” in other contexts.46 Given this possibility, the questionnaire asked ASR, supra note 41, Art. 11; HEATHER HARRISON DINNISS, CYBER WARFARE AND THE LAWS OF WAR 52 (2012). 43 Nicaragua Case, supra note 23, at 115. 44 Prosecutor v. Dusko Tadić aka ‘Dule’ (Judgment) ICTY-94-1-A (15 July 1999) 131-145, 162. 45 Prosecutor v. Lubanga, Case No. ICC-01/04-01/06, Trial Chamber, Judgement (Int’l Crim. Court, March 14, 2012) 541. 46 Case concerning application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro) (Judgment) [1997] ICJ Rep. 43, 208–09, 402-407 (indicating that the overall control test “may well be . . . applicable and suitable” for IHL sorts of classifications). 42 International Law and State Cyber Operations 39