Czech Republic Position paper on the application of international law in cyberspace 53. An internationally wrongful act is an act or omission that constitutes a breach of an international obligation of a State and is attributable to it under international law.46 54. The Czech Republic recognises the right of a State to attribute a cyber activity, either individually or collectively, in compliance with international law. A decision to attribute a cyber activity is a national prerogative and remains at the discretion of a sovereign State. 55. General international rules of attribution as reflected in ARSIWA are also applicable to cyberspace. A cyber operation is deemed an internationally wrongful act when it is attributable to a State under international law and constitutes a breach of an international obligation of the State. A cyber activity is attributable to a State if perpetrated by organs of States,47 or persons or entities exercising elements of governmental authority and acting in that capacity in the particular instance,48 or organs placed at the disposal of a State by another State.49 Furthermore, States are responsible for international wrongful acts conducted by cyber means and perpetrated by nonstate actors if such an actor in fact acts on the instruction of, or under the direction or control of that State in carrying out the conduct in question.50 56. Attribution is linked to the availability of information. It requires establishing the facts of the activity in question and the identity of the actors responsible for the purposes of attribution. Cooperation with relevant institutions to gather all available information, information sharing, consultations and coordination at national and international level can be required. Attribution is based not only on gathering relevant technical information but also on the assessment of a political and security context of a cyber activity, its nature, extent, and consequences. The ascertainment of the State of origin of a cyber activity is not in itself a determining factor and cannot stand as an argument alone. 57. Although States are not required to be absolutely certain to attribute a wrongful act, but rather to gather and reasonably assess the information available, a sufficient degree of certainty on attribution of a wrongful act to a particular State needs to be reached. 58. States are not obliged to disclose evidence in order to publicly attribute a cyber activity. The disclosure of evidence may be relevant when a legal proceeding is initiated (e.g., before the International Court of Justice). Retorsion 59. Retorsion is a lawful, albeit unfriendly, act of an aggrieved State towards a wrongdoing State or an international organisation. Due to its lawfulness, retorsion is a readily available response to a harmful cyber activity that does not qualify as a breach of international law. However, it is also available in response to an internationally wrongful act. Response by retorsion can be combined 46 See Article 2 ARSIWA. See Article 4 ARSIWA. 48 See Article 5 ARSIWA. 49 See Article 6 ARSIWA. 50 See Article 8 ARSIWA. 47 14