State responsibility in cyberspace

The commission of internationally wrongful acts in cyberspace may lead to the responsibility of States. However, there appears to be substantial difficulty in applying the existing legal framework introduced in the International Law Commission’s Articles on State Responsibility (2001). This difficulty concerns the rules on attribution of an act in cyberspace to a particular State. Attribution in the law as it currently stands is focused on the link of natural persons to a specific State; but this is nearly impossible to establish in the case of cyber acts for they are ascribed to computers, the users of which remain largely unidentified. Therefore, as computers constituting the source of wrongful acts may be traced to the territory of particular States the best solution would be to establish a breach of the duty of due diligence on the part of the State from the which injurious cyber acts emanate. Evidence in this respect would seek to prove that the State from which the injurious act emanated had knowledge that the act occurred in its territory and a more flexible approach to its evaluation should be admitted.