Cyber attacks, self-defence and the problem of attribution

This article examines the conditions under which a cyber attack can trigger a State’s right to self-defence and argues that the current international law standards for attributing attacks to a State can cover the case of cyber attacks. More specifically, the victim State can use force by way of self-defence against another State if the attack has been committed by the latter’s organs or agents or has been committed by non-State actors tolerated by that State. When no State is implicated in the cyber attack, the victim State can take direct self-defence action against the non-State actor. It is however noted that future State practice may amplify further the attribution standards or introduce new standards.