key: cord-0048815-oqiz2b88
authors: Aravindakshan, Sharngan
title: Cyberattacks: a look at evidentiary thresholds in International Law
date: 2020-08-17
journal: Indian Journal of International Law
DOI: 10.1007/s40901-020-00113-0
sha: b7198f0ac096e7452d0c1931f19f46aa0106f2e8
doc_id: 48815
cord_uid: oqiz2b88

This paper notes the increasing prevalence of cyberattacks on the international plane and identifies the shortcomings of “public attribution” or “naming-and-shaming”, the tool currently being used by nation states to publicly call out perpetrator-states (including non-state actors) to both punish as well as deter future cyberattacks. The paper points to a need for legally proving attribution in international law as a pre-requisite to receiving any form of redressal or reparations. The paper then examines the current standards and methods of proof in international law and attempts to cull out the nature and amount of evidence required for a state to prove responsibility for a cyberattack in an international legal forum. It concludes that circumstantial evidence is currently the most viable way of proving state responsibility for a cyber operation including cyberattacks and then contextually examines this in the backdrop of the recent malicious cyber incident at India’s nuclear power plant in Kudankulam.

surreptitiously enslave other computers without their owners' knowledge-and then use their computers to do your dirty work.'' 1 Cyberspace presents a vast array of tools for concealment and disguise. Today, any person can impersonate another computing system (IP spoofing) 2 , anonymize communication through layers of encryption (onion routing) 3 and even prevent reverse engineering and deliver untraceable code (obfuscating log files) 4 . These are merely a few techniques among several that enable actors to commit malicious cyber acts with impunity, including nation states.

However, while these issues do make it difficult for public attribution, i.e., a government publicly calling out the perpetratorstate, they present an even larger challenge to the victim state legally proving its claims in an international judicial forum. After all, the next step to identifying the perpetrator is claiming remedies and this can only be done once the victim State is able to prove its claims in accordance with evidentiary standards in international law.

Given that states now accept that international law applies to cyberspace 5 , this article first discusses the limitations in public attribution and highlights the need for using legal fora for redressal in cases involving cyber-attacks. This is followed by an examination of the existing requirements and treatment of evidence in international law for international wrongs and teases out the evidentiary thresholds that states will be required to meet to show an international wrong in cyberspace. The article concludes that while it is likely that international judicial forums will not relax standards of proof to accommodate the obvious cyber-challenges, circumstantial evidence is available as a potentially viable route to prove a violation. Since state to state disputes have been more commonly addressed in the International Court of Justice (''ICJ / Court''), this article will rely on the standards used by the ICJ, while also pointing out a few decisions by other international judicial forums as well.

To be clear, the article primarily deals with standards of proof and methods of proof, both of which must be distinguished from rules of attribution in international law. While the standard of proof deals with the quantum of evidence required to prove a claim, rules of attribution deal with the level of control exercised by the State over a non-state actor that caused the violation. 6 These rules of attribution primarily find their source in Article 8 of the Articles of Responsibility of States in Internationally Wrongful Acts 7 (''Articles of State Responsibility'') as well as the extremely strict ''effective control'' test formulated by the ICJ in Nicaragua v. United States (''Nicaragua'') and the slightly lower standard of ''overall control'' formulated by the International Criminal Tribunal for the former Yugoslavia in Prosecutor v. Tadic (''Tadic''). In the cyber domain, new tests are being proposed such as the ''control and capabilities'' test which is supposedly based on recent state practice in public attribution of cyber-attacks and is one that has an even lower threshold than the overall control test. 8 While a discussion on these evolving tests is certainly important in the cyber domain, it is worthwhile to point out that these tests of attribution should not be conflated with the standards of proof that states' evidence must meet to prove their claims. perpetrators, but also publicly reporting details of their investigations, this discussion will be limited to instances of public attribution by governments. Public attribution by governments largely consists of statements issued by officials with various levels of formality. 11 It is perceived as having several benefits including exposing errant states 12 and driving vulnerable targets to providers to bolster their networks 13 , besides calling public attention to malicious activity in cyberspace. It has particular use in forcing states to draw ''red lines'' on norms and violations in cyberspace, thereby also contributing to the growth of much needed opinio juris in cyberspace.

However, a state that has been victim to a cyber-attack has to also be able to resort to legal remedies since the benefits of public attribution, though important, are still limited. 14 While the exercise of naming and shaming can contribute to opinio juris, the repeated involvement of only a handful of states willing to engage in public attribution as well as the lack of any real costs or measures being imposed on the accused state besides the naming and shaming, limits its efficacy as a tool to deter future cyber malicious activity in the international community. 15 Pursuing legal remedies in an international legal forum, on the other hand, can result in tangible benefits such as injunctions and reparations as well as serve as strong reminders to states that cyber mal-activities have real consequences.

Further, judicial determinations in international legal fora ordinarily result from a rigorous process that grants them legitimacy and renders them trustworthy, which can be hard to achieve through public attribution in its present form, chiefly consisting of one-sided accusations by the victim state, often with vocal support from its allies, followed by dismissive denials by the accused state. For instance, the collective public attribution to Russia by the United States, the United Kingdom and the Netherlands for attempting to hack the Organisation for the Prohibition of Chemical Weapons (OPCW) elicited a dismissive Russian response, terming the joint action as ''Western spymania'' and 11 John S Davis II and others, 'Stateless Attribution: Toward International Accountability in Cyberspace' (RAND Corporation 2017) 21. 12 that it was the victim of ''yet another stage-managed propaganda campaign''. 16 Also, even though the 2015 Report of the United Nations Group of Governmental Experts (UNGGE) expressly provides that accusations of organizing and implementing wrongful acts brought against States should be substantiated 17 , states have expressed contrary views. For instance, Brian Egan, the then Legal Advisor to the State Department in the United States, stated that while states may choose to do so, there exists no international legal obligation to reveal evidence on which attribution is based prior to taking appropriate action. 18 Even in the largest yet exercise of collective attribution in which several countries (the United States, Australia, the United Kingdom and many EU countries including Poland, Estonia, Lithuania, the Czech Republic and Denmark) all named Russia as responsible for the cyber-attacks on Georgia 19 , thereby giving the impression that there was a strong basis for the allegations, no evidence was publicly disclosed. Refusal to produce evidence can often be perceived as lack of evidence further exacerbating distrust and undermine confidence in claims of public attribution, thereby negating any beneficial outcomes. Hence, it becomes necessary to look at other ways and means of achieving tangible outcomes in disputes involving cyber-attacks, such as legal redressal. For a state to take legal action against another state in an international legal forum for harm caused to it by a malicious cyber activity, it will necessarily have to meet the required evidentiary standards of proof in international law. 

The highest standard of evidence in law is posited by domestic criminal law which demands proof beyond reasonable doubt, while civil cases in most common law jurisdictions only require proof by a preponderance of evidence or balance of probabilities, i.e., a more likely than not standard. While some scholars note that the nature of international litigation between states in a forum such as the ICJ is more comparable to civil litigation than criminal, 20 the Court has typically refrained from laying down any particular standard of proof in the cases dealt by it, preferring to determine causality and responsibility on a case by case basis.

Portions of the Court's decisions concerning the evidence presented before it shed some light on the prevailing standards of proof in international law considered by it. For instance, in Bosnia and Herzegovina v. Serbia and Montenegro (''Bosnian Genocide case'') in which Bosnia alleged that Serbia contributed to and failed to prevent and punish acts of genocide, the Court stated that ''..claims against a State involving charges of exceptional gravity must be proved by evidence that is fully conclusive'' 21 indicating that the standard of proof in cases of exceptional gravity such as genocide was that of ''fully conclusive'' evidence.

However, for cases involving use of force, the Court has used different terminology. For instance, the Court in Nicaragua explicitly states that it had to ensure that ''the facts on which [the claim of the party appearing] is based [is] supported by convincing evidence'' 22 and that there was ''no clear evidence of the United States having actually exercised such a degree of control in all fields as to justify treating the contras as acting on its behalf.'' 23 Again, in Democratic Republic of Congo Vs Uganda (''Armed Activities case'') the Court kept referring to evidence that must be ''convincingly established'' or terms such as ''convincing evidence'' or ''sufficient and convincing evidence'' in the context of proving allegations of use of force. 24 of proof is that for violations of exceptional gravity, ''fully conclusive'' evidence is required and for lesser violations, at least ''clear and convincing'' evidence is required. Both these standards set high evidentiary bars to reach.

Where does this leave cyber-attacks? Given these high evidentiary thresholds, how is any victim-state supposed to prove that the perpetrator state carried out an international wrong in cyberspace, with all its vagaries including concealment and disguising issues?

Ongoing efforts to examine issues in application of international law to cyberspace also do not address these issues. The International Group of Experts (IGE) tasked with creating a Manual on the Law of Cyberwarfare under the aegis of the NATO Cooperative Cyber Defence Centre of Excellence, and whose work resulted in the Tallinn Manual 1.0 and the Tallinn Manual 2.0, also did not discuss the standards and methods of proof in international law applicable for cyber-norm violations, instead leaving them to be ''determined by the relevant forum''. 25 They were not wrong to do so, given that the constituting instruments of most international courts usually leave it to the court to determine issues of burden and standards of proof as well as rules of evidence on their own. 26 However, significantly, the IGE in the Tallinn Manual 1.0 do opine that a cyber-attack originating from a state's governmental cyber infrastructure, while not sufficient to attribute the cyber-attack to that government, is an indication that the state in question is associated with the operation. 27 Even though the Tallinn Manual 1.0 also notes the dangers of spoofing and disclaims that this rule be used to pre-determine evidentiary conclusions as to attribution, if applied by states, it could give rise to a rebuttable presumption that the state from whose governmental cyber infrastructure the attack as launched was involved with the attack. 28 If and when accepted by states, this would be an important development since it could significantly ease proving cyber-attacks. However, as the Tallinn Manuals stand currently, they are considered by states as more of a ''starting point of a conversation'' than an authoritative text. 29 In any case, scholars have advised against the lowering of the standard of proof in the cyber-context simply on account of identification and attribution issues. 30 As Roscini aptly puts it, the standard of proof exists not to disadvantage the claimant but to protect the respondent against false attribution, an all-too-present danger in the cyber-domain. 31 But while this cautious approach generally bodes well to prevent states from being framed or mistakenly held responsible, it still does nothing to solve the problem of attribution in the cyberdomain, which is plagued by problems of a general lack of evidence and when it exists, the evidence being controlled by another state's territory. However, as discussed in the next section, one viable route appears to be in the proper accumulation of and use of indirect or circumstantial evidence, currently the main form of evidence available in the cyberdomain.

Evidence is of two types -(i) Direct and (ii) Indirect or Circumstantial. While direct evidence establishes a conclusion, circumstantial evidence is commonly understood as evidence that establishes facts and circumstances from which reasonable inferences can be drawn to reach a conclusion. Today, the nature of digital forensic evidence and other intelligence available post any cyber-attack is circumstantial inasmuch as it only gives rise to inferences that can together lead to a conclusion. For instance, while investigating the source of Stuxnet, a malware that was designed to sabotage Iran's nuclear enrichment facility 32 , analysts took into account various facts including an article published by a former US intelligence officer one year prior to Stuxnet being discovered, outlining a strategic cyber strike against centrifuges, and the high level of sophistication in the software to conclude that the US government was involved. 33 As far as international law is concerned, circumstantial evidence is commonly used and has sometimes even been sufficient to find states responsible for violations. In the very first dispute before it, the Corfu Channel case, the ICJ had to deal with issues involving circumstantial evidence provided by the United Kingdom (''UK'') and exclusive control of evidence by Albania. In the case, the UK alleged that Albania had knowledge of and failed in its obligation to warn the UK of the mines in its channel which struck two UK warships. With regard to the indirect or circumstantial evidence provided by the UK, the Court ruled that ''proof may be drawn from inferences of fact provided they leave no room for reasonable doubt''. 35 After acknowledging that the UK did not have access to evidence that was within Albania's exclusive territorial control and was hence disadvantaged by it, the Court allowed it a ''more liberal recourse to inferences of fact and circumstantial evidence.'' 36 By establishing that Albania closely guarded the channel waters, could observe the mine-laying from the Albanian coast, and providing evidence of previous Albanian mine-sweep operations, the UK was able to establish ''a series of facts linked together and leading logically to a single conclusion'' 37 that in the Court's opinion left ''no room for reasonable doubt'' that Albania knew about the mines in the channel, 38 and hence, violated its obligation to warn the UK. Other facts that corroborated the UK's claim included a declaration by the Albanian delegate in the Security Council and diplomatic notes from Albania on the passage of ships through its territorial waters. 39 The Corfu Channel case shows that the Court allows ''recourse to liberal inferences of fact and circumstance'' to prove state responsibility when (a) the relevant direct evidence is within the exclusive territorial control of another state and (b) the circumstantial evidence furnished is consistent with or does not contradict any direct evidence produced. 40 But cyber attribution experts would do well to note that it was simply the method of proof that was relaxed in this case, and not the standard of proof. Even in cases where such circumstantial evidence is allowed to be adduced, it would still have to sufficiently meet the requisite standard of proof or threshold, which in the Corfu Channel case was characterized as ''no room for reasonable doubt''. Hence, applying this to the cyber-domain can mean that the lack of evidence could allow for a lower method of proof, but the standard of proof remains high.

While the Corfu Channel rule is regularly cited as the prevailing standard on the treatment of circumstantial evidence in international law, the ICJ's Bosnian Genocide case is often cited as the decision in which the Court rejected the argument that circumstantial evidence was sufficient to fix state responsibility. But the Court's ruling in this case was for different reasons.

In the Bosnian Genocide case, Bosnia and Herzegovina alleged that Serbia had violated the prohibition on genocide under the Genocide Convention and had also failed in its obligation to prevent and punish the perpetrators of genocide. 41 Similar to the UK in Corfu Channel, Bosnia also argued that Serbia had exclusive territorial control over the territory making it almost impossible for it to produce direct evidence showing Serbian complicity and that the Court should allow Bosnia to make liberal inferences of fact and circumstance from patterns of evidence to hold Serbia responsible for and also having the specific intent of carrying out the genocide 42 , i.e., the Court should use circumstantial evidence to come to a positive finding of specific intent on Serbia's part. But the Court refused to do so and held that for the requisite intent to be proven, any pattern of conduct would have to ''be such that it could only point to the existence of such intent.'' 43 With regard to the Court rejecting circumstantial evidence in this instance, a number of factors played a role. One factor was that Serbia presented a lot of direct evidence to the contrary, such as witness statements. The ICJ also relied on the ICTY's judgements which contained findings of fact that went against what Bosnia was trying to prove. 44 Given this, it is hard to take the view that the Court has moved away from the Corfu rule on circumstantial evidence. Clearly the Court prefers direct evidence, as would any judicial forum, but this is not to say that in cases where such direct evidence may be absent either due to technical difficulties or the refusal of a party to produce it, the Court will not turn to circumstantial evidence.

Circumstantial evidence has also found common use in other international forums. For instance, the Eritrea-Ethiopia Claims Commission in its Partial Award for the Central Front, Involving Eritrea's Claims 2, 4, 6, 7, 8, and 22, 45 held Ethiopia liable on the basis of the testimony of a civilian who testified that a cemetery that had been undamaged before he fled the village before Ethiopian troops arrived, was found destroyed after he returned. The inference from this testimony, together with the fact that the village was under Ethiopian control, was used by the Commission to conclude that Ethiopia responsible. 46 Similarly, the NAFTA tribunal in Methanex v. United States was ''not averse to trying to connect the dots'' 47 put forth by Methanex to examine whether they led to the ''most compelling of possible explanations of events'' 48 and conclude that the United States was in violation of its obligations under the NAFTA. While the Tribunal ultimately concluded that the ''dots'' together did not point to liability on the part of the United States 49 , it is a good example of the use of inferences or circumstantial evidence in international law, particularly since the NAFTA tribunal relied on the same sources of law as the ICJ, specified in Article 38(1) of the ICJ Statute. 50

7 Cyberspace attribution: current status in brief

Most digital forensic data available to analysis experts in the aftermath of cyber-attacks are in the form of IP addresses, email addresses, domain names, hashes, etc. which are analysed to answer the what, how, who and why questions. Much of this currently involves educated guesswork which includes examining samples such as malware or custom tools found in the affected cyber-infrastructure, or identifying language and content patterns found in phishing emails, determining locations of servers and so on to answer the what and how questions. This then needs to be viewed in combination with other evidence typically obtained from signals intelligence, human intelligence, etc. to form a clearer picture of the who and why questions. For instance, the US indictment of 5 PLA members in United States v. Wang Dong, et al. was based, apart from digital forensic data including patterns in spear-phishing emails, on facts such as the target / victim companies all having significant economic or business interests in China as well as the period of activity by the accused corresponding to business hours in Shanghai. 51 While this is an example of the use of the ''connect the dots'' method in cyber violations, it happens to be a far cry from the ''fully conclusive'', ''clear and convincing'' or the ''no room for reasonable doubt'' standards of evidence required in state-to-state litigation. Indeed, the indictment is only the first step in domestic criminal proceedings and even within the United States, the accused in this case are innocent until they are proven guilty in a court of law.

In the cyber sphere itself, there have so far been multiple private investigative attempts to attribute cyber-attacks or identify malicious cyber actors. Some examples are the Project Grey Goose Report on the Georgia DDOS attacks which indicates that the attacks originated from Russia and that they were also possibly supported by the Russian 49 Ibid at Para 60. 50 52 , and the Mandiant Report which traces and identifies a cyber unit in the PLA as the main perpetrator in multiple cyber-attacks and cyber-espionage in the United States. 53 Despite the technical detail in these Reports, the connections drawn by them from inferences or ''dots'', so to speak, to link the perpetrators to the states, are tenuous and not likely to meet legal thresholds. At best, these reports may be viewed as corroborative evidence and are otherwise not likely to withstand scrutiny in any international judicial forum.

Having noted that gathering circumstantial evidence is difficult, let us contextualize the use of circumstantial evidence to prove state responsibility in the cyber-domain. Taking the malicious cyber-activity in one of India's nuclear reactors at Kudankulam as an example, investigations have reportedly revealed that (i) the attack was traced to a computer model that is produced in and only used in North Korea, (ii) that the MAC and IP addresses bear North Korean signatures, (iii) that the Korean language was used in the code, (iv) the malignant code corresponded with a previous cyber-attack on South Korea's banks that was also attributed to North Korea and lastly (v) that the code is a variant of the ''Dtrack'' malware known to be associated with the Lazarus Group believed to be composed of North Koreans. 54 Add to the mix other ''circumstances'' such as the highly state-controlled nature of North Korean cyberspace and reports of a cyber-warriors trained by the North Korean government used to carry out similar cyber espionage operations in different countries. Based on this information, it is certainly tempting to point the finger at the North Korean government for the Kudankulam cyber-attack and many have. 55 But still, by itself this evidence is not likely to achieve much at the ICJ. It is doubtful that these facts, even if proved, would be construed as constituting ''a series of facts linked together and leading logically to a single conclusion'' leaving ''no room for reasonable doubt'' as in the Corfu Channel case. India would not just have to prove that the malware was traced to North Korea, she would also be required to negate the possibilities of IP spoofing, code-mimicking and other modes of concealment and disguise in cyberspace since it will bear the burden of proving its claim. In fact, if it were to rely on this kind of circumstantial evidence, India might also be required to prove facts such as the malware being of a kind that only the North Korean government possesses and uses with no reasonable possibility of any other actor having access to it, and that the North Korean government stands the most to gain to the exclusion of any other state or actor. Obviously this is a very high burden on any state. Considering most of the evidence is likely to be in the exclusive control of North Korea, would India be allowed liberal recourse to facts and circumstance? Possibly. But such recourse would still be circumscribed by the requirement of meeting the high ''no room for reasonable doubt'' standard. And it is that high standard that India is not likely to meet, unless more evidence sees the light of the day.

Despite the law almost never functioning within the boundaries of absolute certainty, it is apparent that the ''good enough'' standard currently touted as sufficient for public attribution or for taking countermeasures 56 is definitely not going to cut it for states that wish to seek reparations or other legal reliefs in any international court, particularly the ICJ. Even the Tallinn Manual 2.0 recognizes this when it cautions that if the conclusion as to attribution proves to be flawed, the State responding to the cyber-attack with countermeasures will itself have committed an internationally wrongful act. 57 As for ongoing efforts to lower the threshold for attribution in case of non-state actors from the prevailing test of ''effective control'' to the test of ''overall control'' or even form entirely new tests such as the ''control and capabilities'' test, it should be noted that no matter what the attributive test, the evidentiary standard of proof remains high and the methods of proof in cyberspace difficult to navigate. 56 Rapid modernization, along with the ongoing Covid-19 pandemic, has both spurred and highlighted the importance of the digital world as well as its supporting infrastructure. It is no surprise that cyber operations are currently high on the agenda for most States. Estonia's recent presidency of the United Nations Security Council saw cyberattacks being raised for the first time as an issue at the Security Council. 58 In a bid to stay ahead, States are racing against technological progress by attempting to identify norms for responsible state behaviour in cyberspace. This effort has already led to broad agreement (barring a few States) that conventional jus in bello or the law of war is applicable to cyberspace and cyber-attacks. 59 There is also broad consensus that concepts of jus ad bellum such as the prohibition of the threat or use of force and the right to self-defence under Article 2(4) and Article 51 of the United Nations Charter, 1945, respectively, are also applicable to cyberspace. 60 Even though States are still in the process of agreeing on the modalities of how these rules apply, surely there can be little question that the evidentiary rules of proving the violation of these obligations must simultaneously receive serious consideration. After all, standards of proof and methods of proof are not decided by States, but the judicial forum deciding contesting claims. As States engage in the all-important task of fleshing out the rules for applying conventional legal obligations in cyberspace, it is important for them to bear these issues in mind. Technical experts and strategists involved at all levels of attribution must necessarily be mindful of evidentiary hurdles so they may be guided in determining how much information / evidence is required to make attribution meaningful. Publisher's Note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. 58 'The Estonian Presidency of the UN Security Council Holds a Landmark Discussion on Cybersecurity' (Permanent Mission of Estonia to the UN, 21 May 2020)\https://un.mfa.ee/the-estonian-presidency-of-the-unsecurity-council-holds-a-landmark-discussion-on-cybersecurity/[ accessed 8 July 2020. 59 'Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security' (n 17). 60 Ibid.

Russia/Georgia Cyber War-Findings And Analysis

North Koreans behind Indian Nuclear Plant Hack

Here's Why North Korean Hackers Attacked India's Nuclear Power Plant