A/76/136 a customary norm that has been confirmed by international tribunals on several occasions 28 and that has been codified by the International Law Commission (ILC). According to customary international law, as codified by the ILC, an internationally wrongful act is an action or omission that is attributable to a state and constitutes a breach of its international obligations. 29 By analogy, if a cyber operation attributable to a state breaches its international obligations, the state is responsible for this internationally wrongful act. While many norms on state responsibility are generally considered customary international law, as reflected in the articles emanated from the ILC, there are other rules whose legal status is still unclear. The General Assembly took note of the ILC articles on state responsibility for internationally wrongful acts in its Resolution 56/83 of 2001. It has also commended the articles to the attention of governments without prejudice to the question of their future adoption. The ILC articles on state responsibility have been under consideration of the General Assembly for 18 years, and the debates on this issue at its Sixth Committee demonstrate that states have divergent views on their legal status. States and international courts have consistently recognized some of the ILC articles on state responsibility as customary international law, such as the rules for attribution. In the absence of any lex specialis for cyberspace, the customary norms concerning the attribution of conduct to a State are also applicable to the State’s use of ICTs. Hence, cyber operations are attributable to a State if they are conducted by a State organ, 30 by persons or entities exercising elements of governmental authority, 31 or by persons or groups “acting on the instructions of, or under the direction or control of,” 32 the State. Regarding the latter criteria, for a private person or entity’s conduct be attributable to a State, it has to be proved that the state had “effective control” over the operations. 33 It is clear, therefore, that a connection “must exist between the conduct of a [state] and its international responsibility.” 34 The technical difficulties in tracing cyber operations and in determining its authorship may lead to additional challenges in attributing an internationally wrongful act to a State. However, these added difficulties must not serve as a justification to lower the bar for determinations on attribution, which must be substantiated. On the other hand, there are questions on the customary status of other set of articles on state responsibility emanated from the ILC, such as the ones on countermeasures. There are different views on the existence of widespread state practice and opinio juris capable of giving rise to customary international law on the legality and the requirements of countermeasures. Furthermore, it is generally accepted that the ILC provisions on countermeasures went beyond the codification of customary norms and had a strong element of progressive development of international law. 35 In this regard, it is important to recall that several states have criticized countermeasures because they would be prone to abuses, especially due to the material inequality of states. 36 __________________ 28 29 30 31 32 33 34 35 36 21-09670 ICJ, Corfu Channel Case, Judgment, p. 23. ILC, Articles on State Responsibility for Internationally Wrongful Acts, article 2; PCIJ, Phosphates in Morocco, Judgment, p. 28. ILC, Articles on the Responsibility of States for Internationally Wrongful Acts, art. 4. ILC, Articles on the Responsibility of States for Internationally Wrongful Acts, art. 5 ILC, Articles on the Responsibility of States for Internationally Wrongful Acts, art. 8. ICJ, Nicaragua, Judgment, para 86; ICJ, Bosnian Genocide (2007), p. 208–211. ICJ, Bosnian Genocide (2007), p. 210. Max Planck Encyclopedia of International Law, Countermeasures (2015) See, e.g., A/C.6/51/SR.34 and A/C.6/55/SR.18. 21/142