The legal dilemmas of cyber-attribution by Argyri Panezi

Key Concepts

• Attribution (Cybersecurity): The process of assigning responsibility for a malicious cyber activity to a specific actor.
• Technical Attribution: Investigation of cyber incidents by security teams and law enforcement.
• Political Attribution: Decision-making by policymakers based on political factors, alliances, and geopolitical consequences.
• Legal Attribution: Assigning responsibility based on legal frameworks, primarily criminal law (for individuals) and international law (for states).
• State Responsibility: A principle in international law concerning the responsibility of states for breaches of international obligations.
• Evidentiary Standards: The level of proof required in legal or political contexts to establish responsibility.
• Refugium (Ultimate Refuge): A Latin term used to describe criminal punishment as the last resort due to its severe intrusion on personal rights.
• Patriotic Hackers: Individuals or groups who claim to act on behalf of a state but may not have direct official state backing.
• Imposter Syndrome: A psychological pattern in which an individual doubts their accomplishments and has a persistent internalized fear of being exposed as a "fraud."

---

Introduction: The Lawyer's Perspective on Cybersecurity Attribution

The speaker, a law faculty member at UNB Law, addresses an industry summit of cybersecurity experts, emphasizing the crucial and increasing role of law and policy in cybersecurity practice, particularly concerning the theme of "attribution." Despite acknowledging a sense of "imposter syndrome" when speaking to a technical audience, the presentation highlights how legal and policy frameworks are integral to understanding and responding to cyber incidents.

Defining Attribution: A Decision-Making Process

Attribution is broadly defined as the process of assigning responsibility for a malicious cyber activity to a specific actor based on available evidence, including intelligence and forensic investigation. The speaker stresses that attributing a cyber operation, especially from a political and legal standpoint, is ultimately a decision. This decision-making process involves several concrete choices and dilemmas:

• Level of Certainty: The required legal certainty to make an attribution decision.
• Evidentiary Standards: The quality and type of evidence needed.
• Response Instruments: The concrete actions available to an entity or state in response to malicious activities, ranging from issuing public statements and initiating criminal investigations to imposing restrictive measures.
• Process Flow: Attribution typically follows a sequence: suspicion, technical investigation, accusation, and finally, attribution with potential consequences.

Typology of Attribution: Technical, Legal, and Political Dimensions

The presentation distinguishes between three main types of attribution:

1. Technical Attribution

This dimension involves the practical investigation of cyber incidents.

• Key Players: Computer Security Incident Response Teams (CSIRTs), national cybersecurity agencies, and law enforcement agencies.
• Scope: Investigations are generally conducted at the victim organization level, whether in the private sector or a state entity.
• Canadian Context: Examples include the Canadian Centre for Cyber Security, the National Cyber Crime Coordination Center, and the Canadian Anti-Fraud Center.
• Collaboration: Described as a "team sport," involving national security sectors, provincial prosecution bureaus, and academic partners like CIC.
• Global Cooperation: Organizations such as Interpol, Europol, and the Five Eyes alliance facilitate international collaboration.
• Distinction: Technical attribution, while foundational, is theoretically and practically distinct from political and legal attribution.

2. Legal Attribution

Legal attribution operates within two primary fields of law: criminal law and international law.

a. Criminal Law

• Focus: Deals with individuals, not states. Examples include individuals behind schemes like LockBit.
• Severity of Punishment: Criminal punishments are considered the "harshest intrusion into personal rights" and are therefore the "ultimate refugium" (last refuge).
• Process: A domestic/national process.
• Individual Rights: Triggers a set of rights for the individual, including the presumption of innocence and rights to defense. Privacy laws also play a role in defining admissible evidence.
• Procedure: Must adhere to the rule of law, involving warrants and safeguards.
• Recent Challenges: The rise of AI-enhanced cybercriminal activity and misinformation (e.g., Cambridge Analytica case highlighting privacy law relevance).
• Legal Certainty: Requires a high threshold for conviction, typically "beyond a reasonable doubt" in Anglo-Saxon criminal justice systems like Canada's. Evidence must be strong and often needs to become public.

b. International Law

• Focus: Primarily concerned with states, not individuals.
• Key Questions:
  1. State Responsibility: Whether and which norm of international law has been breached.
  2. Evidentiary Standards: These are "hotly debated" in international law scholarship.
• Challenges:
  • State-Private Actor Nexus: States are often assisted by private individuals or groups, requiring evidence of "direct support" rather than mere sponsoring.
  • Patriotic Hackers: Individuals who claim to act on behalf of a state but may not have official backing, complicating attribution.
• Resolution Forum: A significant challenge is the absence of a global cybersecurity court to resolve disputes between states regarding cyber operations.

3. Political Attribution

• Focus: Policymakers define an incident as a political problem and seek appropriate remedies.
• Factors Considered: Unlike legal processes that focus on norms, political attribution takes into account a broader range of parameters, including:
  • Alliances and attribution coalitions.
  • Geopolitical dimensions.
  • Political consequences.
• Distinction: It is distinct from legal attribution, driven by different considerations.

Interconnectedness, Challenges, and Future Outlook

The speaker's main thesis is that while technical, legal, and political attribution are distinct notions, they are "part of the same larger picture." Technical attribution and investigation often trigger political and legal attribution processes.

• Attribution as a Choice: A state might choose not to publicly attribute an operation for political reasons, even if technical evidence exists.
• High Thresholds and Lack of Forums: The high legal certainty required, especially in international law, does not guarantee a conviction. The absence of a global cyber security court makes resolving inter-state disputes particularly difficult.
• Inherent Difficulties: Attribution is inherently challenging from technical, legal, and political standpoints due to:
  • Difficulty in gathering robust evidence.
  • The complex cross-border nature of cyber incidents.
• State Investment: States are actively investing in capacity building, information sharing, and sharing good practices with industry to overcome these challenges.

Conclusion: Advancing Attribution and Accountability

Despite the current difficulties, the speaker believes that attribution will become increasingly easier due to the rapid development of cyber capabilities and the evolution of norms at both national and global levels. These factors will continue to advance the common objective of attribution and accountability in cyberspace. The ongoing efforts involve building capacity collaboratively, both nationally and internationally.