The Rationale and the Perils of Failing to Invoke State Responsibility for Cyber-Attacks: The Case of the EU Cyber Sanctions

Abstract

Malicious cyber activities are on the rise. States and other relevant actors need to constantly adapt to the evolving cyber threat landscape, including by setting up effective deterrence mechanisms. This is what the European Union (EU) has done through the adoption of Common Foreign and Security Policy (CFSP) Decision 2019/797, which allows it to impose targeted sanctions to deter and respond to cyberattacks that constitute an external threat to the EU or its member states. However, in contrast to other horizontal regimes of restrictive measures in force within the EU, foreign governments are not included as potential targets of cyber sanctions. Moreover, the recital of the Decision specifies that the adoption of restrictive measures does not involve attribution of international responsibility for cyber-attacks to a third State. This article aims at identifying the rationale behind the inclusion of these distinctive features. It starts by considering the legal uncertainty that surrounds attribution of international responsibility for cyber operations. Next, it explains why the EU is not well placed to invoke third-State responsibility, and the reasons behind its reluctance to do so. It will then illustrate the risks inherent in the lack of a clear legal framework to attribute the responsibility of cyber-attacks to third countries. This may have serious consequences in terms of legal certainty when a cyber-attack amounts to a breach of the prohibition on the use of force in international relations. Then, we explore recent developments in EU legislation in the area of cyber security and the possibility to strenghten the powers of the European Union Agency for Cybersecurity (ENISA). We draw two conclusions: first, the Union might develop the capacity to attribute cyber attacks to specific actors and there is an interest to do so. However, Member States are probably still reticent to take this step. Two, despite the advantages of establishing a reliable attribution mechanisms, it is submitted that the majority of States prefers to take advantage of a regulative gap that allows them to react to cyber incidents as they see fit.

A. Introduction

Human activity in the cyberspace may pose significant problems to the international community. States and societies have grown highly dependent on the functioning of information technology (IT) infrastructure and this, in turn, has generated new digital vulnerabilities. Indeed, only limited resources are needed to cause significant harm, capable of jeopardizing international stability.¹ Although cyberspace provides many business opportunities for individuals and is vehicle for the right of expression, it may be used for criminal and politically motivated cyber-attacks, including state-sponsored ones. These events may prompt reactions both by governments and international organizations. In the context of the European Union (EU)² the Council has—independently of the United Nations (UN)—adopted unfriendly measures as a reaction to these attacks. Common Foreign and Security Policy (CFSP) Decision 2019/797³ imposes restrictive measures against cyber-attacks with a potentially significant effect “which constitute an external threat to the Union or its Member States.”⁴ These attacks must be carried out from outside the Union in order to fall within the scope of the Union’s restrictive measures.⁵ The sanctions might also apply in case the targets of these attacks are third States or international organizations.⁶

In this essay, we focus on the legal problems connected to “cyber-attacks” because they present special features with respect to other forms of malicious cyber activities.⁷ While a universally agreed definition⁸ is not available, in the Decision under exam, cyber-attacks are described as “[a]ctions involving any of the following: (a) access to information systems; (b) information system interference; (c) data interference; or (d) data interception, where such actions are not duly authorised by the owner or by another right holder of the system or data or part of it, or are not permitted under the law of the Union or of the Member State concerned.”⁹ Article 1(4) of the mentioned Decision contains a non-exhaustive list of these targets which include: “(a) critical infrastructure, such as submarine cables and objects launched into outer space, which is essential for the maintenance of vital functions of society, or the health, safety, security, and economic or social well-being of people; b) services necessary for the maintenance of essential social and/or economic activities, in particular in the sectors of: energy (electricity, oil and gas); transport (air, rail, water and road); banking; financial market infrastructures; health (healthcare providers, hospitals and private clinics); drinking water supply and distribution; digital infrastructure; and any other sector which is essential to the Member State concerned; (c) critical State functions, in particular in the areas of defense, governance and the functioning of institutions, including for public elections or the voting process, the functioning of economic and civil infrastructure, internal security, and external relations, including through diplomatic missions; (d) the storage or processing of classified information; or (e) government emergency response teams.”¹⁰ Thus, cyber-attacks are likely to have disruptive effects by virtue of the special importance of the targets (critical infrastructure) or of the essential nature of the functions or of the services that these targets perform.

EU cyber-sanctions can be adopted against natural persons, entities or bodies who are responsible for cyber-attacks or attempt to carry out such an attack¹¹ and may the take the form of asset freezes and visa bans. These measures were adopted to respond and to deter cyber-attacks¹² and they are deprived of punitive purpose.¹³ Cyber-sanctions can be seen as a complement to existing internal measures that approximate the criminal law of Member States applicable to cybercrime.¹⁴ The aim of both instruments is to prevent potential authors of cybercrime or attacks from launching new ones.

The Union is a subject of international law autonomous from its constituent members and has competence to protect its security, including by adopting sanctions in reaction to cyber-attacks.¹⁵ It is noteworthy that this is not an exclusive competence of the organization; therefore, Member States are also entitled to react to cyber-attacks on their own. However, while “national security remains the sole responsibility of each Member State,”¹⁶ where the authors of a cyber-attack are natural persons, it is more effective for EU members to act through the Union¹⁷ because the targeted individuals will be subject to an EU-wide asset freeze (and/or visa bans).

Two aspects of the sanction regime are particularly noteworthy. First, state organs or governments are not included in scope ratione personae of the cyber sanctions, in contrast to other horizontal regimes of restrictive measures in force within the EU such as those aimed at contrasting the use of chemical weapons or at preventing human rights abuses.¹⁸ Second, Recital n. 9 of the Decision imposing sanctions for cyber-attacks states, “Targeted restrictive measures should be differentiated from the attribution of responsibility for cyber-attacks to a third State. The application of targeted restrictive measures does not amount to such attribution, which is a sovereign political decision taken on a case-by-case basis. Every Member State is free to make its own determination with respect to the attribution of cyber-attacks to a third State.”¹⁹

In this Article, we aim to explore the rationale behind the inclusion of the mentioned Recital; in particular we are interested in understanding whether the nature of cyber activities is such as to require a distinctive treatment with respect to that reserved to other “non-cyber” threats to peace and security. In order to provide an answer we will examine the text of the instituting Decision of cyber sanctions and the way the latter was applied in the practice. The article will first look at the reasons which make the attribution of cyber-attacks a difficult endeavor, thus contributing to a lack of legal clarity (section B). Then, we bring the reader’s attention to the EU’s reluctance to invoke state responsibility and we identify the possible reasons behind this choice (Section C). Next, we examine the inherent risks of failing to develop a solid legal framework in relation to cyber-threats and the underlying motivations (Section D). Then, we show that the trend of expanding the EU legislation in the area of cyber activities has not ceased since 2008 when internal legislation seeking to harmonize security requirements at national level was enacted so as to be able to better address cyber-attacks or malicious activities (section E); we also consider that the EU has an interest and potential capacity to develop an attribution mechanism for cyber-attacks. Yet, we conclude that although the creation of an autonomous capacity in the EU to attribute cyber-attacks would present certain advantages for some Member States, it is not clear whether it would be possible for the EU organs to develop an attribution mechanism due to the uncertain boundaries of EU’s competence (Section E). We finally suggest that, even beyond the EU, a possible way forward would be to agree on a multilateral attribution mechanism. Yet, at the moment, there is no sufficient interest in the international community for such an initiative (Section F).

B. Difficulties in Establishing State Responsibility for Cyber-Attacks

While the application of international law to cyberspace was the object of some controversies in the past,²⁰ it is now undisputed that the principles of sovereignty, non-intervention, the prohibition on the use of force and other general rules of international law apply to states’ cyber activities as they do in the analogical world.²¹ Yet, it is still far from clear how traditional principles of international law need to be transposed in the cyber domain.²² In truth, there seems to be a general trend among States to refrain from establishing rigid legal frameworks in the area of cyber operations, also in light of the fast technological development.²³ Many States have chosen to adopt a policy of silence and ambiguity about how international law applies in cyberspace.²⁴ As stated by former US Department of State Legal Advisor Brian Egan, the international community is currently faced “with a relative vacuum of public State practice.”²⁵ This uncertainty pertains both to the very qualification of malicious cyber operations as breaches of international law (i.e. to whether any primary norm is actually breached), but also to the difficult exercise of attributing cyber-attacks to a specific State actor (i.e. whether the conduct can be imputed to a specific subject of international law).²⁶

Starting with the first issue, not all malicious cyber activities – including those defined as cyber-attacks under Decision 2019/797 - constitute breaches of international law. There are different categories of cyber activities that could be defined as “malicious”, including cyber crime or cyber espionage. Cyber-crime, for instance, does not call necessarily into question the international responsibility of States because it is a form of crime that may be carried out by non-state entities. The most important multilateral Treaty in this area is the Council of Europe “Budapest Convention” of 2001,²⁷ which has 66 Parties, including 26 EU Member States.²⁸ This Treaty imposes on its Parties obligations to criminalize a wide range of conducts.²⁹

Cyber espionage, however, involves cyber activities that are carried out with the objective of obtaining information. It is a form of cyber-crime because it amounts to an illegal access to a computer system. Some of the activities against which the EU has imposed restrictive measures might fall under this category. The Tallin Manual 2.0 defines cyber espionage as “an act undertaken clandestinely or under false pretences that uses cyber capabilities to gather (or attempt to gather) information with the intention of communicating it to the opposing party.”³⁰ However, many experts contend that there is no prohibition in international law on espionage per se,³¹ and on cyber espionage in particular. The experts working on the Tallin Manual 2.0, for instance, could not reach a consensus as to whether remote cyber espionage violated international law. While the majority believed that the exfiltration of data violated no rule of international law, a few believed that at some point the data breach might be so severe as to make it illegal.³² Similarly, the experts did not agree on the legality of close-access operations, such as operations where an individual in the territory of the target state inserts a USB drive into a government system to steal or alter data. Clearly, there is a lack of a shared understanding among States on what is allowed and what is proscribed in the cyber domain. This makes the determination of an objective breach of international law a rather complex task.

Turning now to the issue of attribution, one of the biggest challenges for a State that finds itself a victim of a hostile cyber operation is ascertaining who was behind it. Even if a certain cyber-attack is considered to represent a breach of state sovereignty, without clearly identifying who is responsible for the hostile cyber activity it is difficult to take any targeted action in response. The problem of attribution in the context of cyber activities has generated a great deal of discussion among scholars.³³ The Tallin Manual 2.0 addresses the issue by echoing Articles 4 and 5 of the Articles of State Responsibility,³⁴ accordingly to which cyber operations conducted by state organs are generally attributable to the state. Even though this approach reflects international law in non-cyber situations, its application to cyber activities is not without controversy. For example, the experts noted that traditionally the use of government assets such as tanks or warships was a near irrefutable indication that such activity should be attributed to a that state. The same cannot be said of cyber activities. Indeed, given the ability to capture or spoof cyber infrastructure, including where the cyber activities might originate from, “the mere fact that a cyber operation has been launched or otherwise originates from governmental cyber infrastructure, or that malware used against hacked cyber infrastructure is designed to “report back” to another State’s governmental cyber infrastructure, is usually insufficient evidence for attributing the operation to that State.”³⁵ Moreover, even if the actual material source of a specific cyber activity has been ascertained, “identifying the persons, organizations, or states that are legally responsible for the cyber-attack remains challenging.”³⁶ As some scholars claim, “although legal attribution relies on forensic evidence produced by technical attribution in order to make determinations and justify legal action in the form of indictments, sanctions or countermeasures, forensic evidence needs to be interpreted and assessed according to legal criteria.”³⁷ In other words, the technical attribution is a precondition for the legal attribution to an individual state organ but is not sufficient in itself to legally ascribe the conduct to a given State.

The challenge, however, is not simply with the law. As with other forms of hostile activity, there are technical, political and diplomatic considerations in publicly attributing hostile cyber activity to a State, in addition to whether the legal test is met. Such political considerations concern the question of whether to attribute and when; whether attribution will be public or private; and what will be attributed and to whom.³⁸ This predominantly political process may lead to action “such as diplomatic demarches, public denunciations or restrictive measures,”³⁹ but leaves open the question of the exact legal responsibility originating from the cyber-attack. As will be shown, the complexity of the legal and political issues involved has even more important ramifications when an attribution process needs to be conducted within a supranational organization such as the EU.

C. The EU’s Reluctance to Rely on State Responsibility in the Context of the Cyber Restrictive Measures

It is submitted that the existence of evidentiary and legal hurdles in the process of attribution contributes to explain the absence of an explicit reference to third countries in the list of addresses of cyber sanctions as well as the clause in Recital n. 9. The EU is free to target the authors of the attack (natural persons or other non-state entities) on the basis of the technical attribution.⁴⁰ In contrast, the right to trigger the rules on the responsibility of the State is reserved to individual Member States. The implicit reference is to the State(s) whose territory/ies has or have been affected by a cyber-attack. In some cases EU members have the capacity to attribute a cyber-attack to a certain third country. Yet, not all EU Members may have the necessary capability to do so.⁴¹ In case one EU member is not affected by the cyber-attack and does not have the capacity to verify the forensic evidence provided by the State target of the attack, it may refrain from triggering state responsibility.⁴² This is because there may be a lack of trust between the European national authorities if only some of them have the capacity to identify the authors of a cyber-attack. Probably, it is because of this situation and of intelligence activities gaps that the EU Council opted to specify that the EU does not attribute the cyber activity to a state and left the decision to trigger state responsibility to each Member state. In the Draft Council Conclusions on a Framework for a Joint EU Diplomatic Response to Malicious Cyber Activities (Cyber Diplomacy Toolbox) the Council remarks: “The EU reminds that attribution to a State or a non-State actor remains a sovereign political decision based on all-source intelligence and should be established in accordance with international law of State responsibility. In that regard, the EU stresses that not all measures of a joint EU diplomatic response to malicious cyber activities require attribution to a State or a non-State actor.”⁴³ At the same time, the Commission and the High Representative of the Union for foreign affairs and security policy have stressed that currently there is limited mutual cooperation between Member States and no operational mechanism between the latter and EU institutions, agencies and bodies is in place, in the event of a large-scale, cross-border cyber incidents or crisis.⁴⁴

In sum, it seems that the reasons why the clause is included in Recital n. 9 is that the EU, as a subject of international law, intended to refrain from invoking state responsibility. Member States’s representatives in the Council probably preferred to reserve this decision for themselves. As mentioned in Section A, in principle, Member States have the primary responsibility to protect their internal security and they may react to cyber-attacks on their own.

Another possible reason explaining the EU’s decision to leave to Member States the choice to invoke state responsibility is that the organization has started to exercise its competence in the area of cyber activities quite recently. The first Directive in the field of cybersecurity was enacted in 2008⁴⁵ on the basis of the “implicit powers” provisions (the then Article 308 of the Treaty on the European Community) and its scope was limited.⁴⁶

At the moment, there are no harmonized evidentiary standards on how to identify authors of cyber-attacks which could be taken into account by national authorities. Therefore, in case these events occur the EU has self-imposed a restriction on engaging state responsibility of the third State in which the authors of the attack operated and has also limited the range of possible measures that can be taken when those actors carry out a cyber-attack. The EU has confined itself to make it possible for the Council to freeze the assets of (or to impose admission restrictions on) natural or legal persons and has listed individual state organs,⁴⁷ relying on the intelligence provided by the Member States,⁴⁸ without triggering state responsibility.

Turning to the practice, the EU has made a modest use of cyber-sanctions. So far, these measures were imposed in response to only three distinct episodes: the first one concerned a single Member State while the second one affected a group of them; the third one was an attempted cyber-attack directed against an international organization located in one EU Member State. As mentioned above, the target of the first attack was the German Bundestag in 2015.⁴⁹ Being a state organ, this is a sensitive target. MPs received bogus emails containing a link that led to the installation of malware on their computers. The malware was able to spread and eventually infiltrated the networks of the Parliament and allowed hackers to access internal confidential communication data, schedules, and other sensitive data.⁵⁰ The attack was linked to the hacker group APT28, an actor believed to be associated with the Russian military intelligence.⁵¹ The second attack (2016-2017) was dubbed “Operation Cloud Hopper” and was directed at managed service providers located in at least fifteen States, including five EU Member States.⁵² The hackers installed malware and hacking tools to access systems and steal data,⁵³ causing significant economic loss. The operation was conducted by cyberespionage group APT10 which is allegedly sponsored by the Chinese government.⁵⁴ The last attack was an attempt by Russian intelligence agents to infiltrate the Wi-Fi network of the Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague.⁵⁵ While conducting the operation, the attackers had been observed and were subsequently arrested by the Dutch military intelligence and no concrete damage was caused. The arrest facilitated the attribution process as all four operatives were clearly linked to the Russian military intelligence service. Five states (Australia, Canada, the Netherlands, New Zealand and the United Kingdom) coordinated accusations that the latter was responsible for a series of cyber operations including the one at the OPCW.⁵⁶ Notwithstanding the involvement of Russian and Chinese State agents, the EU refrained from attributing legal responsibility to either of the sending States, thereby restating its unwillingness to engage in this exercise.

D. The Perils of the Reluctance to Agree Common Standards on the Attribution of Responsibility to a State for Carrying out Cyber-Attacks

Clearly the current state of affairs with respect to the rules on the attribution of responsibility for malicious cyber activities is not satisfactory. The lack of a more settled legal framework potentially entails huge economic costs.⁵⁷ But the possible damage is not only of economic or financial nature. The reputational harm caused by cyber-interferences with electoral processes, for instance, is difficult to quantify but has the potential to undermine the political stability of entire countries.⁵⁸ Even more worrying is the prospect that a cyber-attack crosses the threshold required to be considered a “use of force” under Article 2(4) of the UN Charter and trigger the right to individual or collective self-defense foreseen by the Charter and customary international law.⁵⁹

While the practice of States and international organizations is only beginning to clarify how cyber operations must be addressed under the jus ad bellum,⁶⁰ there is widespread consensus among States and scholars that a cyber-attack can amount to a violation of the prohibition of the use of force. As is known, the International Court of Justice (ICJ) has stated that Articles 2(4) and 51 of the UN Charter, apply to “any use of force, regardless of the weapons employed.”⁶¹ Thus, if a computer network is used instead of a traditional kinetic weapon this will not prevent the classification of the cyber operation as a “use of force.” According to the majority view, the decisive factor to distinguish a cyber operation that qualifies as “use of force” from less serious breaches is the scale and severity of its consequences.⁶² This stance is reflected in the Tallin Manual 2.0, according to which “[a] cyber operation constitutes a use of force when its scale and effects are comparable to non-cyber operations rising to the level of a use of force.”⁶³ It is beyond the scope of the present Article to examine the different factors that might influence the assessment at hand; yet, it is worth emphasizing that attacks on critical infrastructure – such as the ones listed in Decision (CFSP) 2019/797 - have a higher probability of reaching the “use of force” threshold.⁶⁴ The idea that cyber-operations may breach the prohibition on the use of force and that the consequences of the attack are decisive in this assessment is also supported by the national positions of several States, including Australia,⁶⁵ Germany, ⁶⁶ Italy,⁶⁷ and the US.⁶⁸ Moreover, particularly severe cases of “use of force” may qualify as “armed attacks” and therefore entitle the victim State to lawfully use force in self-defense.⁶⁹ The type of force employed by the injured state is not necessarily limited to taking measures by cyber means as it can make resort to kinetic means, as long as the response is necessary, proportionate and in accordance with other provisions of international law.⁷⁰

The lack of commonly agreed standards on the attribution of responsibility to a State for carrying out cyber-attacks bears important risks. There seems to be agreement that a State may use kinetic force in response to a cyber-attack that meets the definition of “armed attack” under the jus ad bellum, and yet the uncertainty that surrounds the issue of attribution opens the way to dangerous mistakes. Brazil’s position paper on the application of international law to cyberspace underlines that “technical, legal and operational challenges to determine attribution might make it impossible to verify potential abuses of the right of self-defense, which in turns creates the risk of low impact persistent unilateral military action undermining the collective system established under the Charter.”⁷¹ In the absence of any reliable verification mechanism, when a cyber-attack amounts to a “use of force” or to an “armed attack,” the target State will find itself in a problematic condition of uncertainty. Ultimately, the state (or the International Organization) concerned will either not be able to protect its security or risk to use force against a State without being certain that it was at the origin of the cyber-attack. A real need for a clearer legal framework exists, as the current lack of certainty might lead to arbitrary unilateral reactions. As Wright notes, “if we accept that the challenges posed by cyber technology are too great for the existing framework of international law to bear, that cyberspace will always be a grey area, a place of blurred boundaries, then we should expect cyberspace to continue to become a more dangerous place.”⁷²

Considering the challenges highlighted above and the specific rules laid down in Recital n. 9 of the EU Decision on cyber sanctions, it is necessary to examine whether there is a special attention within the EU towards the setting up of a verification mechanism. In principle the EU should be particularly sensitive to this problem because it shares with its Member States the competence to address cyber-attacks and in case of an armed attack there is a special mutual defense clause in the EU Treaty⁷³ requiring Member States to assist the victim of the attack. It is therefore interesting to review the terms of the discussion on the setting up of a verification mechanism in this context.

E. The Strengthening of EU Powers to Attribute a Cyber-Attack: A Way Forward?

In Section C, we have seen that the EU’s interest in cybersecurity is relatively recent. However, the number and the quality of EU-derived obligations for Member States has constantly grown since 2008. Several strategies were developed in 2013, 2017 and 2020 to tackle these security threats. Various instruments were deployed by EU to boost Member States’ response capacity.⁷⁴ The most important is Directive (EU) 2016/1148⁷⁵ which was adopted in order to harmonize the security requirements of network and information systems (‘NIS’) against which cyber-attacks might be directed. This piece of legislation laid down minimum harmonization requirements and introduced obligations concerning security measures and incident notifications across sectors which are vital for the economy and society.⁷⁶ The objective of this measure was to achieve a high common level of security of network and information systems and was designed to enhance strategic and operational cooperation between Member States. The rationale for the adoption of Directive 2016/1148 was to prevent that cyber-attacks could have serious disruptive effects affecting more than one Member State, thus hampering the functioning of the internal market.⁷⁷ Yet, this legislation was too limited. This is why in 2020 the Commission proposed to expand the harmonization requirements of the NIS Directive and to increase the number of sectors subject to it.⁷⁸

At the same time, in December 2020, an amendment to the “ECI” Directive⁷⁹ was also put forward. The proposed new rules are aimed at increasing resilience of “critical entities”⁸⁰ by extending the application of the Directive, which initially covered the energy and transport sectors, to banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, and space. The proposed rules seek to “enhance the resilience of entities in the Member States which are critical for the provision of services which are essential for the maintenance of vital societal functions or economic activities in the internal market in a number of sectors underpinning the functioning of many other sectors of the economy of the Union.”⁸¹ The idea behind the new rules is that considering the increased interdependency between services provided using critical infrastructure in the sectors mentioned above, a disruption in one Member State may have implications in other EU members or the whole EU. The divergence of regulations at national level is a factor that obstructs the functioning of the internal market and makes the Union more vulnerable in terms of security. Harmonizing the security requirements, which should be respected by critical entities providing essential services, is necessary. The proposed directive sets up a procedure for Member States to identify critical entities using common criteria on the basis of a national risk assessment and sets out a number of obligations on Member States.

The EU is clearly enhancing the security requirements that the mentioned infrastructure should respect and will continue to do so in the future, considering that the effects of cyber-attacks may either hamper the functioning of the internal or undermine the security of the Member States, that of the Union and international security. Given the unique level of integration of the EU and the specific solidarity mechanisms amongst the Member States, provided for by the EU Treaties,⁸² the EU has an interest in addressing the lack of capacity of several of its members to identify and respond to cyber-attacks. In addition, the dependency on the intelligence of the US and United Kingdom (UK) as far as the attribution to third states of a cyber-attack is problematic. In this context, it is submitted that the EU could contribute to address the “special attribution problems” created by cyber-attacks, thus identifying an attribution mechanism enabling the organization, as a subject of international law, to trigger state responsibility in the event a cyber-attack targets the territories of one of its Member States. It may be wondered whether the EU has also the ability to carry out this task. In principle the answer is positive. Indeed, on the one hand, the EU has strengthened its research and technological capacities to secure network and information systems, and in particular to protect critical network and information systems because this is in the Union’s strategic interest.⁸³ On the other hand, the EU institutional set up was reinforced. In 2019 a specific body, the European Union Agency for Cybersecurity (ENISA),⁸⁴ which was created in 2013, was entrusted amongst other tasks, to assist the Member States and the EU institutions to prevent, detect and improve their capabilities to respond to cyber threats and incidents.⁸⁵ The Agency also plays an important role in assisting national authorities to develop strategies on the security of network and information systems and, broadly speaking, in implementing Directive 2016/1148.⁸⁶ In principle, this body does not have an autonomous capacity to make the technical determination necessary to attribute a certain cyber conduct to a given threat source.

The mentioned EU organ assists both the Member States and the EU institutions and is considered as “a centre of expertise on cybersecurity by virtue of its independence, the scientific and technical quality of the advice and assistance it delivers, the information it provides.⁸⁷” The Agency may, at the request of one or more Member States, “provide support in relation to ex-post technical inquiries regarding incidents having a significant or substantial influence within the meaning of Directive (EU) 2016/1148.”⁸⁸ It is submitted that these powers could be used and further expanded through a change of the Regulation instituting this agency to develop, in cooperation with national authorities, an attribution mechanism of cyber-attacks to a third state. If this were to happen, the EU would achieve a double purpose: on the one hand, it would address the problem of those EU members that lack capacity and expertise in this area; on the other hand, it could provide a model for technical attribution to be adopted or adapted by the international community.

Yet, there are a number of legal and political obstacles to the expansion of the EU Cybersecurity agency’s tasks. Indeed, the delegation of powers to agencies is subject to the constraints of the Meroni ⁸⁹ case-law: first, agencies may be delegated only executive powers while discretionary powers have to be exercized by the delegating authority; second, the latter cannot delegate broader powers than it enjoys itself. While the technical attribution of responsibility may be seen as an executive power, it is not clear whether the EU would have the competence to attribute state responsibility to a third country. This is the reason why the Agency could not be given powers to define an attribution mechanism. Yet, the legal framework is uncertain. It could be counterargued that given that the requirements of the “Meroni doctrine” have been made less stringent by the Court of Justice with the ESMA ruling,⁹⁰ it is possible to enshrine on the Cybersecurity Agency more powers, provided that the latter are clearly defined, as required by the ECJ.⁹¹ Therefore, the legal obstacle to expanding EU Agency’s powers would be overcome; it goes without saying that Member States would have to agree on taking such a step and this is a political decision.

At the same time, other platforms could be equipped with powers to attribute cyber-attacks. In this respect, it is interesting that the Commission recommended to build the Joint Cyber Unit and to set it up in a 4-step process that will include the identification of the EU available operational capabilities, the preparation of incident and crisis response plans at national and EU levels, and expansion of activities to establish cooperation with private entities. The operationalization of the Joint Cyber Unit is expected to be completed by 30 June 2023.⁹² It should be noted that in an annex to the recommendation on building a joint cyber unit, it is envisaged that this unit may be used “by the cyber diplomacy community to align public communication. The platform may allow participants to contribute to political attribution as well as attribution within the criminal justice framework employed at police and judicial level.⁹³” In addition, it may facilitate recovery and allow for structured synergies with national and cross-border monitoring and detection capabilities that participants to coordinate public communication and contribute to political attribution, as well as attribution in the context of the criminal justice. However, in the EU's Cybersecurity Strategy for the Digital Decade it is also confusingly stated that this platform “would not be an additional, standalone body, nor would it affect the competences and powers of national cybersecurity authorities or EU participants.”⁹⁴ Be as it may, should the organization be able to make the decision to extend ENISA’s powers or to set up the new cyber unit, the decisions on attribution of cyber-attacks would be recognized by the EU Member States but certainly not by third countries. This is an important limit. Therefore, developing the powers of new Union bodies would serve to enhance the ability of the Member States to attribute cyber-attacks and to take a common decision within the EU. Yet, it would not provide a universally acceptable verification mechanism.

F. Final Remarks

Because States are reluctant to establish a comprehensive legal framework to counter cyber-attacks, this hints at a tendency of informalization and flexibility of regulation that one can observe in other areas related to digitalization as well. This also happens in the EU context. The organization is ready to impose cyber sanctions on individuals, including de jure state organs, but not to trigger the rules on international legal responsibility. We consider that the main reason for the inclusion of the clause in Recital n. 9 is that there is a reluctance by Member States to let that the EU engage state responsibility. However, the choice of the Council may also be due to the inherent difficulties in attributing a cyber-attack to a given actor, which prompted its explicit decision to leave this task to Member States. Significantly, in other cases of restrictive measures addressing non-digital threats, the Union had never openly affirmed that legal attribution should be left only to Member States.

To address the challenges posed by malicious cyber activities some have proposed to set up a widely accepted attribution mechanism.⁹⁵ Yet, at the moment, EU Member States (but more broadly the international community) do not seem to have an interest towards the establishment of a technical verification mechanism which could only be fully legitimized if all main state actors would agree to its establishment and possibly contribute to its running. Major cyber actors, notably China, have shown little enthusiasm for this initiative and suggest (rather opportunistically) that “attribution is nearly impossible.”⁹⁶ Without China and its allies on board the credibility of the independent entity would be severely undermined.

At the same time, it was suggested that more specific rules of attribution of conduct and responsibility that would apply to the cyber domain should be developed (or are indeed emerging from State practice).⁹⁷ According to this proposal, States should be able to attribute unlawful cyber operations of non-State actors to States, even in the absence of evidence demonstrating clear State direction and control. While such a special regime would technically be possible under the law on State responsibility,⁹⁸ there seems to be little state practice upon which these special rules should rest. States are only now beginning to set forth their views on how international law governs cyberspace, but too few of them have made their approach clear and they are still overshadowed by the number of States that are reticent to do so. As evidenced above, so far States have not been inclined to develop public and shared rules for attributing cyber-attacks and prefer to take advantage of a regulative gap that allows them to react to cyber incidents as they see fit (and perhaps to carry out hostile cyber operations themselves).⁹⁹ The EU itself has never advocated for structural changes of international law as far as the attribution mechanism of cyber activities is concerned.¹⁰⁰

However, the idea of concluding binding agreements of a more limited scope to regulate State behavior in the cyber domain should not be entirely abandoned.¹⁰¹ While a treaty on general rules of conduct would require a political will that is currently lacking, steps forward could be made on banning or regulating specific areas, such as commercial cyber espionage or malicious cyber-activities against critical infrastructure.¹⁰² The prospect of having to cope with huge financial and reputational costs might pave the way for the adoption of more specific treaties which could also establish rules and procedures regulating issues of attribution and responsibility that could serve as models for other similar exercises. Meanwhile, it is to be hoped that the severity of hostile cyber operations remains under the threshold of what could be regarded as an armed attack, as otherwise the described normative ambiguity could dramatically backfire.