The Attribution of Cyber Operations to States in International Law

Summary

This report examines how international law attributes cyber operations to states, comparing European and Chinese legal perspectives. It clarifies the distinction between technical, political and legal attribution, underscoring that only legal attribution, grounded in customary rules reflected in the Draft Articles on Responsibility of States for Internationally Wrongful Acts (ARSIWA), can establish an internationally wrongful act. The report reviews the main attribution pathways, including conduct by state organs, non-state actors exercising delegated governmental authority, and private actors acting under a state’s instructions, direction or control. It highlights differing views on how these standards apply in cyberspace, where anonymity, proxy actors and obfuscation techniques complicate traditional tests.

The analysis also assesses evidentiary issues, including burden and standard of proof, the role of digital forensics, and debates over whether covertly obtained evidence may be used in attribution. While both sides agree that allegations must be substantiated, they diverge on how strict evidentiary requirements should be, particularly for unilateral responses such as countermeasures. Key recommendations include clarifying attribution thresholds, strengthening evidentiary practices, and encouraging states to avoid insufficiently supported public attributions. The report ultimately underscores the difficulty of applying established rules of state responsibility to the complex realities of cyberspace.
 

Background

This report has been produced in the context of a larger research and dialogue project, in terms of which the China Institutes of Contemporary International Relations, EU Cyber Direct, the Geneva Centre for Security Policy, and Xiamen University and Suzhou Academy of Xi’an Jiaotong University, convene a joint Sino-European Expert Working Group on the Application of International Law in Cyberspace (EWG-IL). The working group provides a platform for exchange among European and Chinese legal experts to examine the application of international law in cyberspace and to examine related problems from a theoretically legal perspective. The main goal of the work in research groups is to provide more thorough analysis of the selected topics and identify points of divergence and convergence between Europe and China with the aim of creating a more evidence-based and trusted environment for policy discussions in Track 1.5. and Track 1 processes.