The Law & Politics of Cyberattack Attribution
79 Pages Posted: 23 Sep 2019 Last revised: 1 Oct 2020
Date Written: September 15, 2019
Attribution of cyberattacks requires identifying those responsible for bad acts, prominently
including states, and accurate attribution is a crucial predicate in contexts as diverse as criminal
indictments, insurance coverage disputes, and cyberwar. But the difficult technical side of
attribution is just the precursor to highly contested legal and policy questions about when and
how to accuse governments of responsibility for cyberattacks. Although politics may largely
determine whether attributions are made public, this Article argues that when cyberattacks
are publicly attributed to states, such attributions should be governed by legal standards.
Instead of blocking the development of evidentiary standards for attribution, as the United States,
France, the Netherlands, and the United Kingdom are currently doing, states should establish an
international law requirement that public attributions must include sufficient evidence to enable
crosschecking or corroboration of the accusations. This functionally-defined standard harnesses
both governmental and nongovernmental attribution capabilities to shed light on states’ activities
in cyberspace, and understanding state practice is a necessary precondition to establishing norms
and customary international law to govern state behavior. Moreover, setting a clear evidentiary
standard for cyberattack attribution has the potential to clarify currently unsettled general
international law rules on evidence.
This Article also engages debates about institutional design for attributing cyberattacks.
Companies and think tanks have made several recent proposals for the creation of an international
entity that would handle attribution of state-sponsored cyberattacks. Although these proposals
have much to recommend them, this Article argues that such an entity should supplement, not
replace, the current decentralized system of attribution. Having a multiplicity of attributors—both
governmental and nongovernmental—yields a greater likelihood that public attributions will serve
the goals that attributors aim to achieve, namely, strengthening defenses, deterring attacks, and
improving stability in and avoiding conflict over cyberspace.
Keywords: cybersecurity, cyber, cyberattack, cyberspace, attribution, international law, evidence, WannaCry, NotPetya, standard of proof, Tallinn Manual
Suggested Citation: Suggested Citation