Cyber Attacks, Self-Defence and the Problem of Attribution

This article examines the conditions under which a cyber attack can trigger a State’s right to self-defense and argues that the current international law standards for attributing attacks to a State can cover the case of cyber attacks. More specifically, the victim State can use force by way of self-defense against another State if the attack has been committed by the latter’s organs or agents or has been committed by non-State actors tolerated by that State. When no State is implicated in the cyber attack, the victim State can take direct self-defense action against the non-State actor. It is however noted that future State practice may amplify further the attribution standards or introduce new standards.