States by other States,13 iii) persons or groups acting on the instructions or under the direction or control of the State,14 and iv) conduct acknowledged and adopted by the State as its own.15 12. Legal attribution must be distinguished from the processes of technical and political attribution. Technical attribution comprises a factual investigation into the source of a cyber operation. This often requires technical expertise and is fraught with challenges given cyberspace’s decentralized nature and the widespread use of spoofing techniques and ‘false flags’. Political attribution is the discretionary decision of a State to single out a certain entity, whether a State or a non-State actor, as the author of a certain cyber operation. While international law neither imposes a specific evidentiary threshold for legal attribution nor requires the publication of any evidence for this purpose,16 States should consider all relevant information when legally attributing cyber operations to another State, publicly or not.17 13. Pursuant to the customary rules of State responsibility, States directly injured by cyber operations amounting to internationally wrongful acts may respond by resorting to cyber or non-cyber countermeasures.18 Cyber countermeasures may also be taken in response to non-cyber internationally wrongful acts. Countermeasures are the non-forcible suspension of an international obligation whose wrongfulness is precluded by the prior breach of international law.19 They may be taken by an injured State only in order to induce the responsible State to comply with its international obligations of cessation and/or reparation of the wrongful conduct.20 Countermeasures, online or offline, must not be punitive,21 and they must be proportionate to the injury suffered, considering the gravity of the breach and the rights in question.22 They may not affect the prohibition on the use of force and other peremptory rules of international law, fundamental human rights, rules of a humanitarian character prohibiting reprisals, binding dispute settlement procedures, as well as diplomatic and consular law.23 14. To avoid the risk of escalation into conflict, countermeasures are subject to certain procedural conditions under customary international law. These are the requirements of i) calling upon the responsible State to fulfill its obligations of cessation and/or reparation, ii) notification of the intention or decision to take countermeasures, and iii) offer to negotiate with the responsible State.24 However, in Costa Rica’s view and considering the above-mentioned 13 Article 6, ILC Articles (n 8). Article 8, ILC Articles (n 8). 15 Article 11, ILC Articles (n 8). 16 Tallinn Manual 2.0 (n 4), at 83, para. 13. 17 GGE 2015 Report (n 1), paras 13(b) and 28(f). 18 Tallinn Manual 2.0 (n 4), Rule 20, at 111ff. 19 Articles 22 and 49(2), ILC Articles (n 8). 20 Article 49(1), ILC Articles (n 8). 21 Article 49(1), ILC Articles (n 8). 22 Article 51, ILC Articles (n 8). 23 Article 50, ILC Articles (n 8). 24 Article 52, ILC Articles (n 8). 14 4