3 - The Question of Evidence: From Technical to Legal Attribution

Summary

The evidence collected to identify the computers and individuals involved in a cyber operation may also be used to determine whether they were acting on behalf of a State. This leads to the question of how such evidence may be used and considered admissible in a judicial proceeding, or more generally in an international dispute, related to a cyber operation. The development of State activities in cyberspace, notably offensive cyber operations, has led to international disputes between States. To date, a State has neither disputed a cyber operation before an international court or tribunal nor raised the issue before the UN Security Council. Generally, victim States have chosen to respond through extra-juridical measures, such as cyber countermeasures or measures of retorsion. However, there is the possibility that a State, in future, may bring a charge of harmful cyber operations before an international court or tribunal or before the UN Security Council.