Cyberattacks: a look at evidentiary thresholds in International Law

This paper notes the increasing prevalence of cyberattacks on the international plane and identifies the shortcomings of “public attribution” or “naming-and-shaming”, the tool currently being used by nation states to publicly call out perpetrator-states (including non-state actors) to both punish as well as deter future cyberattacks. The paper points to a need for legally proving attribution in international law as a pre-requisite to receiving any form of redressal or reparations. The paper then examines the current standards and methods of proof in international law and attempts to cull out the nature and amount of evidence required for a state to prove responsibility for a cyberattack in an international legal forum. It concludes that circumstantial evidence is currently the most viable way of proving state responsibility for a cyber operation including cyberattacks and then contextually examines this in the backdrop of the recent malicious cyber incident at India’s nuclear power plant in Kudankulam.