The control & capabilities test: How a new legal regime is shaping attribution in cyberspace

Abstract

Attribution in cyberspace is one of the most difficult questions facing policy makers, lawyers, and jurists. Indeed, the first question often asked in the wake of a cyber incident is “who did it?” The answer to this question is often critical when dealing with the application of international law because it will dictate the rights and responsibilities of States both from an offensive and defensive perspective. Without proper attribution, for example, a State's responsive capabilities are limited. Making matters worse, attribution is difficult to establish factually. Non-State actors often mask their identity, and State actors often hide their true intentions. The degree to which the international rules governing State attribution apply in cyberspace is therefore a matter of great public importance.