40
Fifth Report
Annex B
about state responsibility both generally and in the IHL context based on
the existence of some armed conflict as that term is used in the Geneva
Conventions.
22. In terms of their responses, several Member States emphasized the difficulty of attribution in cyberspace.47 Others focused less on the question of
liability for proxy behavior and more on the State’s responsibility to take care
that its territory was not used by non-State actors to launch attacks.48 Thus,
Peru commented that “if there is inertia on the part of a State in controlling
a nonstate actor that unleashed a cyberattack against another State, despite
having the capacity to control them, then that could give rise to their conduct
being attributable to the State.”49 For its part, Bolivia emphasized that States
should not bear responsibility where they lack the technological infrastructure
to control non-State actors.50 And the United States emphasized that the “mere
fact that a cyber activity was launched from, or otherwise originates from,
another State’s territory or from the cyber infrastructure of another State is
insufficient, without more, to attribute the activity to that State.”51
23. For those States whose responses focused on the question of proxy actors,
the Articles of State Responsibility (“ASR”) loomed large. Chile, Guyana, and
Peru all based their response on ASR Article 8:
The conduct of a person or group of persons shall be considered
an act of a State under international law if the person or group
Guatemala Response, supra note 1, at 3 (finding “clear responsibility” for a cyberattack is
“by no means an easy task”); Peru Response, supra note 1, at 4 (noting great “uncertainty in
attribution, and levels of attribution, of cyber attacks” making it harder “to control those who
use cyberspace to unleash attacks over the Internet”).
48
Ecuador Response, supra note 1, at 1 (“States cannot be held liable for an attack by a nonstate actor, but there should be some way [for them] to collaborate to find the perpetrators.
Furthermore, a state is responsible for regulating/setting standards for services to prevent
territory belonging to a state from being launch [sic.] an attack.”); Guatemala Response,
supra note 1, at 3 (answering in terms of due diligence of the host State rather than the
amount of control over proxy actors).
49
Peru Response, supra note 1, at 4 (citing ASR Article 11).
50
Bolivia Response supra note 1, at 3-7. On the question of proxies, Bolivia’s response was
indirect, although it did suggest a link between a State and non-State actors associated with
its defense policy objectives and/or strategies of a State in a situation of armed conflict. Id.
51
2014 US GGE Submission, supra note 1, at 738.
47
Inter-American Juridical Committee
of persons is in fact acting on the instructions of, or under the
direction or control of, that State in carrying out the conduct.52
The ASR, however, did not offer an opinion on which type of “control” the State
needs to exhibit, suggesting it is “a matter for appreciation in each case.”53 This
tracks U.S. views, which endorse State responsibility for “activities undertaken
through ‘proxy actors’ who act on the State’s instructions or under its direction
or control” while only saying that the degree of control exhibited must be
“sufficient.”54 The United States has also acknowledged that a State may later
acknowledge or adopt a non-State actor’s cyber operation as its own.55
24. However, one State, Chile, did offer its views on the level of control required to trigger legal responsibility. Citing the Nicaragua and Genocide cases,
Chile opined that the “degree or level of control or involvement of a state in
the operations of a non-state actor, required to trigger its international responsibility is that of effective control.”56 Chile, moreover, took the view that
the standards of State responsibility are the same in the context of armed
conflicts.57
25. With respect to IHL, Peru took a similar stance, favoring a uniform rule of
State responsibility both in and outside of armed conflicts. While recognizing the ASR contemplates being supplanted by lex specialis, it indicated that
doing so requires an integrated analysis. And in this case, “[a]n examination
of the Geneva Conventions does not disclose any difference with respect to
the provisions on international responsibility set down in the Draft Articles on
Responsibility of States for Internationally Wrongful Acts; therefore, it cannot
ASR, supra note 41, Art. 8; Chile Response, supra note 1, at 2; Guyana Response, supra note
1, at 3; Peru Response, supra note 1, at 4. Chile and Peru’s responses also appear based on
ASR Article 5 assigning State responsibility to “[t]he conduct of a person or entity which ... is
empowered by the law of [a] State to exercise elements of the governmental authority …
provided the person or entity is acting in that capacity in the particular instance.” See Chile
Response, supra note 1, at 2; Peru Response, supra note 1, at 4.
53
ASR, supra note 41, at 48 (Commentary to Art. 8).
54
Koh, supra note 1, at 596; 2014 US GGE Submission, supra note 1, at 738 (same); Egan
supra note 1, at 821; 2016 US GGE Submission, supra note 1, at 826.
55
Egan supra note 1, at 821; 2016 US GGE Submission, supra note 1, at 826.
56
Chile Response, supra note 1, at 2.
57
Id. at 3.
52
International Law and State Cyber Operations
41
Select target paragraph3
Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents