Cracking Attribution: Moving International Norms Forward

Abstract

This Note addresses how international law can meet the challenge of reliably and transparently identifying the actor responsible for a cyber attack, a feature of the cyber landscape referred to as the “attribution problem.” It examines the potential for customary international law to define evidentiary standards for evaluating claims of a cyber attacker’s identity, standards which would have to be met before a state victim could retaliate. Such a framework would replace the malleable and opaque ad hoc determinations of responsibility that states currently undertake in both the conventional force and the cyber contexts alike. To this end, this Note introduces a sliding-scale evidentiary standard that adapts to the—often limited—availability of evidence and short amount of time a victim might have to respond to cyber attacks.

This Note analogizes to attribution problems faced by the international community in the past, such as piracy and privateering on the eighteenth century’s high seas, to demonstrate that the legal problems posed by cyber capabilities are not unfamiliar. But the ubiquity of cyber capabilities and diffuse nature of the cyber landscape mean that the solution must be different. This Note demonstrates that a newly proposed non-governmental attribution body, structured like a tribunal, could meet the tremendous need many victims face in gathering the evidence to overcome the attribution problem inherent to cyberspace. Such a body, this Note argues, provides the best launchpad for developing the international norms—and, eventually, the customary international law—needed to build evidentiary standards in the cyber context.

Keywords: cyber, attribution, international law, evidence, law of armed conflict, cyberspace, sliding-scale, state responsibility, global consortium, international norms, cyberspace, digital Geneva Convention, cybsecurity consortium, Cybersecurity Tech Accord, hacking, hackers