By: Carter D. Westphal*
Abstract
Currently, deterrence theory serves as the cyber domain’s primary enforcement mechanism. However, States are developing cyber capabilities at different rates and not all States can deter others from conducting operations against them. In addition, States have not agreed on a set of rules for regulating cyber operations. Consequently, international rules, formulated for kinetic operations, are applied to the cyber domain. These kinetic standards do not appreciate the uniqueness of the cyber domain and therefore, create responsibility gaps for certain cyber operations. For example, attribution for third-party kinetic attacks, and therefore third-party cyber-attacks, are currently governed by International Court of Justice’s (ICJ) effective control test. Many have criticized this test for being too high of a bar and no match for the plausible deniability available to cyber domain actors. Despite these criticisms and the responsibility gap, the ICJ has reaffirmed the viability of the effective control test and rejected easier-to-satisfy tests. To highlight the responsibility gap, this Comment applies the effective control test to a hypothetical cyber-attack scenario.
After highlighting the effective control test’s failures, this Comment proposes a two-part test, the Cyber Enablement and Control Test (CECT). The CECT, designed for the cyber domain’s intricacies and realities, focuses on a State’s enablement of a specific operation and the State’s exercise of overall control over the non-State actor conducting the operation. If a State satisfies both parts of the CECT, the non-State actor’s operation can be legally attributed to the controlling State. Consequently, the CECT results in the accountability of State puppeteers and cyber- deficient States gain a shield that their lacking cyber capabilities fail to wield.
*J.D. Candidate, The Pennsylvania State University, Penn State Law, 2022. I would like to thank my wife and family for their endless support and the Penn State Law Review editing team for their feedback.