State responsibility for third-party cyberattacks in conditions of anonymity

Abstract

The relevance of this research is determined by the rapid increase in the number of cyberattacks carried out indirectly via third-party actors (non-state groups or proxy actors) and the difficulties in holding states accountable for such actions under conditions of the anonymity of cyberspace. A hypo­thesis has been proposed that current norms of inter­national law are insufficient for effective "proving the involvement" of a state in cyberattacks carried out by third parties, due to attribution issues and a lack of clear evidentiary standards. To verify the hypothesis, a methodology for analysing the interna­tional legal norms (including the draft articles on State responsibility for international legal violations of 2001, UN acts, etc.), precedents, and contempo­rary scientific publications on this issue has been applied. A comparative analysis of attribution criteria (the "effective control" vs. "overall control" doctrines) in classical international law and their application in cyberspace has been conducted. It has been confirmed that the anonymity and technical complexity of cyber operations create a "dilemma of normative failure" – that is, a situation in which states can effectively evade responsibility. It has been established that in order to hold state sponsors of cyberattacks accountable, it is necessary to improve legal mechanisms: to introduce clearer standards for proving involvement, to develop international cooperation in attribution, and to consider new criteria (such as the concept of "substantial support" in attribution). The obtained results contribute to the deepening of the theory of international legal responsibility in cyberspace and can be used to formulate policies and norms that will prevent the unpunished use of cyberspace for aggression.