State Responsibility in the Cyber Age: The Course towards Indirect Evidence

The problem of attributing responsibility for cyber-attacks is almost as old ascyberspace itself, yet it remains one of the most troublesome issues of that domain. It is oftenimpossible to uncover direct evidence that would reveal the identities of the attackers. Investigatorsmust therefore rely on other, more indirect avenues of proof. The aim of this exploratory study is todevelop a basic categorisation of indirect evidence that can be used to attribute state responsibilityfor cyber-attacks in international relations. To do so, the article works with international legalconcepts but transposes them into the analysis of international relations. The categorization ofindirect proof is based on the Russian-Georgian conflict of 2008, which provides one of the richestarrays of this kind of evidence. The analysis identifies four kinds of indirect evidence: level ofcoordination, level of preparedness, state relations with the national hacker community, and stateconception of cyber-security.