Abstract
The absence of formal legal attributions of State responsibility for malicious cyber operations reflects a strategic choice by influential States—foremost the United States and the United Kingdom—rather than doctrinal certainty. So long as States avoid creating legal rules for attribution, they entrench cyberspace as a legal gray zone and expose the limits of collective attribution as a governance mechanism. This article identifies probative and institutional impediments in the secondary rules of attribution: the effective control test is difficult to satisfy for proxy cyber operations, the lack of an authoritative standard of proof enables plausible deniability, and, absent consent, States remain beyond the compulsory jurisdiction of international courts. The article then traces substantive uncertainty in primary rules concerning sovereignty, due diligence, and non-intervention, compounded by the expansion of interstate peacetime cyber espionage. The article suggests a modus operandi—based on official attributions announced as of January 2026—as an incipient State practice. The article concludes that narrowing the gray zone requires effects-based thresholds—apart from de minimis sovereignty intrusions—and clear criteria distinguishing lawful intervention (influence) and espionage from unlawful intervention and illegitimate (unlawful) espionage. This imperative is sharpened by the accelerating integration of AI into cyber operations, and by the Typhoon campaigns, which have challenged the U.S. cyber deterrence strategy and manifested the urgent need for action.
html
Included in
Accessibility Request
Some items in this repository were created or digitized prior to implementation of the accessibility standards under the Rehabilitation Act of 1973 and are preserved in their original, unmodified state for research, reference, or historical recordkeeping. In accordance with the ADA Title II Final Rule, the College provides accessible versions of archival materials upon request. To request a version of a file or resource, please submit an Accessible File Request Form.
