State-sponsored Cyber Attacks Research Articles

A BRIEF STUDY OF INTERNATIONAL LAW IN THE AGE OF CYBERSECURITY

The rapid evolution of cyberspace has transformed the global landscape, giving rise to a complex and interconnected digital realm. As nations and individuals increasingly rely on digital technologies, the need to establish a robust framework for cybersecurity within the realm of international law has become paramount. This paper explores the evolving landscape of international law in the age of cybersecurity, focusing on key challenges, developments, and the imperative for international cooperation. The digital domain transcends geographical boundaries, making traditional notions of state sovereignty and jurisdiction inadequate for addressing cyber threats. This has necessitated the development of international norms and regulations to govern cyberspace. The paper delves into the prominent developments in international law, including the Tallinn Manual and the United Nations Group of Governmental Experts, which have sought to clarify the application of existing legal principles to cyberspace. Cybersecurity challenges such as state-sponsored cyberattacks, cyber espionage, and the weaponization of information have strained the existing framework of international law. The paper discusses the critical need for a consensus on defining cyberattacks and determining proportionate responses in accordance with the principles of self-defense and the law of armed conflict. Furthermore, this paper emphasizes the importance of international cooperation and the role of multilateral organizations in promoting cyber stability. It explores the potential for global cyber norms and confidence-building measures to enhance international security and reduce the risk of cyber conflict. However, as the digital age continues to reshape the global landscape, the adaptation and evolution of international law in response to cybersecurity challenges is imperative. The paper highlights the ongoing developments and challenges in this arena, underscoring the necessity for collaborative efforts among nations to establish a secure and stable digital environment for all. KEYWORDS: Cybersecurity, International Law, Cyberspace, Norms, Cooperation

The role of insurers in shaping international cyber-security norms about cyber-war

ABSTRACT Faced with defending against myriad online threats, businesses are increasingly turning to insurers to purchase cyber-insurance policies that will shield them from bearing the full costs of these incidents. Eager not to miss out on the expanding market, insurers have aggressively ramped up their cyber-insurance offerings, and in doing so, have assumed enormous responsibility—and power—as the arbiters of what types of state-sponsored cyber-attacks are covered by insurance. This article argues that insurance companies are influencing multilateral processes and setting de facto standards around responsible state behavior in cyberspace through their policies on risk and liability for serious cyber-operations and “cyber-war.” It approaches this issue through the lens of the 2017 Russian NotPetya cyber-attack which led to significant legal disputes between many insurers and their policyholders about whether Russia’s behavior constituted a “warlike action” and was therefore excluded from insurance coverage under standard war exclusions.

Direction of Japan’s New Cybersecurity Policy

The direction of Japan’s cybersecurity policy is shaped by the escalating threat of state-sponsored cyberattacks in peacetime. This surge, notably from Russia, China, and North Korea, involves diverse tactics such as information manipulation, functional disruption, and financially motivated attacks, posing economic and national security risks. In response, nations are increasingly adopting Active Cyber Defense (ACD) strategies. ACD combines real-time attack detection with proactive countermeasures, aiming to impose costs on malicious cyber actors and mitigate potential damage. The United States and the United Kingdom lead in ACD implementation, using technical and policy responses, including hackbacks, to deter and attribute cyber threats. Japan is aligning its security policy with ACD principles, recognizing the need for proactive cyber measures beyond passive cyber defenses. This shift involves enhancing cyber capabilities, increasing cyber-related units, and fostering collaboration with the private sector. However, legal and regulatory challenges hinder ACD implementation in Japan, with existing laws restricting activities such as attack monitoring and attribution. Bridging these gaps is crucial for developing a comprehensive cybersecurity framework and ensuring the nation’s resilience against evolving cyber threats.

Cross-Domain Deterrence in the Cyber World

Abstract: Cyber Space, like outer space, is strategically a vital domain for state offence and defence. However, there has been a substantial rise in the sponsored cyber activities to inflict heavy losses to critical infrastructures due to the lack of rules or norms or any strict international regulations to govern the conflicts in cyberspace. This activity affects the national defence strategies when oppressed by the response crisis and hugely impacts the risk factors. In these circumstances, the dilemma is whether any operative or offensive choice in the event of a cyber threat or cyber-attack violates international law. War has always been a last resort when other forms of punishment have failed, but the power dynamic has fundamentally shifted since World War II. State Governments have been hoarding the arsenals that could destroy cities in a second; hence a need for unconventional resolution has led to the evolving nature of deterrence. States must reconsider alternate strategies to protect their sovereignty by implementing cross-domain deterrence that can cripple an adversary economy, swift surgical strike as retaliation, or curb the attack using counterintelligence. The threat landscape in Cyber Space is beyond frontiers, and the consequences cannot be contained at the perimeter by the regular armed forces. Require special forces and strategies to mitigate the risks. Cross-Domain deterrence to increase cyber resilience, it is crucial to identify existing strategy disparities to take necessary actions on the state misconduct and the misconduct of a policy for global cooperation during state-sponsored cyberattacks. This paper discusses the evolving framework by assessing the changing threat landscape and its associated risks.

The Implications of State-sponsored Cyber Attacks in South Asian Countries

The Implications of State-sponsored Cyber Attacks in South Asian Countries

CYBER DIMENSION OF HYBRID WARS: ESCAPING A ‘GREY ZONE’ OF INTERNATIONAL LAW TO ADRESS ECONOMIC DAMAGES

The subject of the article is the international and national legal aspects of compensation for economic damages caused by cyber attacks. The purpose of the article is to contribute to the ongoing debate on attribution and liability for malicious and destructive cyber activity. Cyber attacks have become a global problem facing the international community, posing enormous risks to the stability of international security, economic and social development, and the safety and well-being of individuals. Cyber attacks have proven to be numerous problems for domestic and international law – international humanitarian law, human rights law, the law of armed conflict – how to counter the actions of hybrid warfare by legal means, what are the remedies for losses due to cyber attacks. This article examines cyber attacks to show how the international community is moving toward responsible behavior by states in cyberspace, protecting civilians and critical infrastructure. The article's methodology is based on doctrinal legal research in this area, as well as international legal instruments, in order to examine how economic damages should be paid to victims of malicious acts in cyberspace. The difficulty of attributing cyber attacks has been analyzed to show that perpetrators evade responsibility, a separate problem for international law. It is concluded that international law, as it currently stands, provides little legal basis for substantive guidance on responsible state behavior in cyberspace, the necessary levels of attribution to establish state or non-state responsibility for cyber attacks. Economic losses from cyber attacks can be covered by insurance schemes, although analysis has shown that they do not work because insurers argue that cyber attacks exclude military risk insurance clauses that exclude coverage, which is reasonable, although it leaves victims of cyber attacks without the ability to recover damages. The paper supplements current research with a comprehensive analysis of legal and economic issues and calls for the development of an appropriate strategic environment, legal and infrastructural framework. The need for a joint international framework is emphasized, as civil liability under national law is hardly possible because cyber attacks are predominantly transnational in nature. A joint structure is also needed to prevent, deter and respond to state-sponsored cyber attacks.

Democracy and cyberconflict: how regime type affects state-sponsored cyberattacks

ABSTRACT A large body of research in international relations has focused on the relationship between regime type (i.e., the degree a nation is democratic or authoritarian) and traditional military conflict between states. However, to date, no research has examined how regime type affects conflict in the cyber domain. Thus, we attempt to analyze the effect regime type has on the initiation of state-sponsored cyberattacks. We examine 143 states from 2005 - 2013 utilizing cyber data on known state-sponsored cyberattacks taken from the Council on Foreign Relations Cyber Operations Tracker dataset (CFR-COTD) and economic, political, military, and social data collected by the authors. In conducting a cross-sectional, time series analysis we find that democratic institutions have a pacifying effect on the initiation of state-sponsored cyberattacks.

International trade and cyber conflict: Decomposing the effect of trade on state-sponsored cyber attacks

A state’s decision to engage in cyber operations has important implications for its trade. Successful cyber espionage could yield valuable trade secrets that could boost domestic production and spur economic growth. On the other hand, uncovered cyber operations could invite devastating sanctions that retard economic development. In spite of this, the nexus between trade and cyber attacks has received little attention in the literature. In this article, I explore how a state’s trade relations affect its propensity to engage in cyber attacks. I develop a theoretical framework that links the composition of a state’s trade to its deficit in proprietary information relative to other states. I decompose trade into its inter- and intra-industry components and show that while inter-industry trade is associated with higher incidence of state-sponsored cyber attacks, intra-industry trade has the opposite effect. I also show that these effects are non-monotonic, varying by the share of inter- or intra-industry trade in total trade. The results also show that states that have a heavy concentration of high-tech industries such as aerospace, computers, and pharmaceuticals have a higher propensity to engage in cyber espionage operations. These results are robust to a variety of controls and specifications.

Beyond Physical Threats: Cyber-attacks on Critical Infrastructure as a Challenge of Changing Security Environment – Overview of Cyber-security legislation and implementation in SEE Countries

States, organizations and individuals are becoming targets of both individual and state-sponsored cyber-attacks, by those who recognize the impact of disrupting security systems and effect to people and governments. The energy sector is seen as one of the main targets of cyber-attacks against critical infrastructure, but transport, public sector services, telecommunications and critical (manufacturing) industries are also very vulnerable. One of most used example of cyber-attack is the Ukraine power grid attack in 2015 that left 230,000 people without power for up to 6 hours. Another most high profile example of a cyber-attack against critical infrastructure is the Stuxnet computer virus (first used on Iranian nuclear facility) which could be adapted to attack the SCADA systems (industrial control systems) used by many critical infrastructures in Europe.Wide range of critical infrastructure sectors are reliant on industrial control systems for monitoring processes and controlling physical devices (sensors, pumps, etc.) and for that reason, physical connected devices that support industrial processes are becoming more vulnerable. Not all critical infrastructure operators in all sectors are adequately prepared to manage protection (and raise resilience) effectively across both cyber and physical environments. Additionally there are few challenges in implementation of protection measures, such as lack of collaboration between private and public sector and low levels of awareness on existence of national key legislation.From supranational aspect, in relation to this papers topic, the European Union has took first step in defense to cyber threats in 2016 with „Directive on security of network and information systems“ (NIS Directive) by prescribing member states to adopt more rigid cyber-security standards. The aim of directive is to improve the deterrent and increase the EU’s defenses and reactions to cyber attacks by expanding the cyber security capacity, increasing collaboration at an EU level and introducing measures to prevent risk and handle cyber incidents. There are lot of other „supporting tools“ for Member States countries, such as European Union Agency for Network and Information Security – ENISA (which organize regular cyber security exercises at an EU level, including a large and comprehensive exercise every two years, raising preparedness of EU states); Network of National Coordination Centers and the European Cybersecurity Industrial, Technology and Research Competence Centre; and Coordinated response to major cyber security incidents and crises (Blueprint) with aim to ensure a rapid and coordinated response to large-scale cyber attacks by setting out suitable processes within the EU.Yet, not all Member States share the same capacities for achieving the highest level of cyber-security. They need to continuously work on enhancing the capability of defense against cyber threats as increased risk to state institutions information and communication systems but also the critical infrastructure objects. In Southeast Europe there are few additional challenges – some countries even don't have designated critical infrastructures (lower level of protection; lack of „clear vision“ of criticality) and critical infrastructures are only perceived through physical prism; non-EU countries are not obligated to follow requirements of European Union and its legislation, and there are interdependencies and transboundary cross-sector effects that needs to be taken in consideration. Critical infrastructure Protection (CIP) is the primary area of action, and for some of SEE countries (like the Republic of Croatia) the implementation of cyber security provisions just complements comprehensive activities which are focused on physical protection.This paper will analyze few segments of how SEE countries cope with new security challenges and on which level are they prepared for cyber-attacks and threats: 1. Which security mechanisms they use; 2. The existing legislation (Acts, Strategies, Plan of Action, etc.) related to cyber threats in correlation with strategic critical infrastructure protection documents. Analysis will have two perspectives: from EU member states and from non-EU member states point of view. Additionally, for EU member states it will be analyzed if there were any cyber security legislation before NIS directive that meets same aims. The aim of research is to have an overall picture of efforts in region regarding cyber-security as possibility for improvement thorough cooperation, organizational measures, etc. providing also some recommendations to reduce the gap in the level of cyber-security development with other regions of EU.

Hacks Dangerous to Human Life: Using JASTA to Overcome Foreign State Sovereign Immunity in Cyberattack Cases

State-sponsored cyber-attacks are on the rise. With the continually growing presence of automated and autonomous technologies in our lives, the ability to harm individuals behind a keyboard is becoming an increasingly plausible and desirable option for foreign states seeking to target persons abroad. Those particularly vulnerable to such attacks include political dissidents, activists, and any individuals deemed to be an enemy of the regime employing such cyber-attacks. In recent years, U.S. nationals victimized by foreign state-sponsored cyber-attacks have attempted to sue their foreign-state cyber-attackers in U.S. courts under the traditional exceptions to the Foreign Sovereign Immunities Act (FSIA), but to no avail. Commentators have offered a few suggestions to help these victims overcome the barrier of sovereign immunity, including an alternative interpretation of the FSIA’s noncommercial tort exception, or a cyber-attack exception amendment to the FSIA. This Note, however, offers a more concrete and accessible solution: the Justice Against Sponsors of Terrorism Act (JASTA). The recently passed JASTA creates the latest exception to the FSIA, which differs from the other exceptions in two important ways: (1) it does not require an alleged tort to have taken placed in the United States, and (2) it does not require the foreign state being sued to have been officially designated a state sponsor of terrorism by the U.S. government. Thus, under JASTA, many U.S. victims of state-sponsored cyber-attacks should be able to overcome sovereign immunity and finally attain justice against their foreign-state cyber-attackers in U.S. courts.

ANALYSIS OF CYBER-ATTACKS ON UKRAINIAN POWER GRID SYSTEMS IN THE CONTEXT OF ARMED CONFLICT IN DONBAS

Attribution of cyber-attacks committed by non-state actors is not an easy task; however, it is far from impossible. Being unable to apply the effective control test to invoke state responsibility for state-sponsored cyber-attacks, states have started relying upon multitude of factors for the purpose of public attribution. This approach is not a solution due to political nature of public attribution. By example of Ukraine author demonstrates the potential danger of cyber-attacks against critical infrastructure and the need of attribution. The 2015 and 2016 attacks on Ukrainian power grid systems evidence that private actors posses resources and knowledge to attack the vital objects of critical infrastructure. The article contains the analysis of committed cyber-attacks in the context of armed conflict. Author concludes that these attacks are linked to the armed context in Donbas and stresses out on the need to create an independent body responsible for attribution.

Evolving Toward a Balanced Cyber Strategy in East Asia: Cyber Deterrence or Cooperation?

This paper investigates the limits of implementing a cyber deterrence strategy in East Asia. Given that national security documents from both Taiwan and Japan indicate the need to deter state-sponsored cyberattacks, there is very little literature that empirically and theoretically investigates the utility of such an approach in this region. This paper looks into the various deterrence constructs and argues that none of them can be implemented without problems. The paper looks further into a deeper level of the conceptual issues upon which deterrence thinking is based and argues that an alternative strategy promoting regional cooperation is not only possible but also desirable in the current political climate. It is later concluded that looking for a one-size-fits-all solution is idealistic, and policymakers should develop security countermeasures that align with the threats posed by the actors they wish to confront.

Personalised Deterrence of Cyber Aggression

The continuing occurrence of state-sponsored cyber attacks against liberal democracies, including private sector and civil society targets, shows that deterrence efforts have been less than successful. Elisabeth Braw and Gary Brown argue that adversary governments’ practice of hiding behind proxies makes response and thus deterrence extraordinarily difficult. As a deterrence strategy adding to the existing deterrence directed against hostile actors, they propose ‘personalised deterrence’, with governments of targeted countries communicating directly to individual cyber attackers their intent to hold them personally responsible through denial of benefits and use of criminal law.

Decentralized Cyberattack Attribution

Attribution of state-sponsored cyberattacks can be difficult, but the significant uptick in public attributions in recent years has proven that attribution is far from impossible. After several years of only sporadic attributions, Western governments in 2017 began publicly attributing cyberattacks to other governments more frequently and in a more coordinated fashion. But more consistent over the past several years have been public attributions by non-governmental actors, including companies, a non-profit, and an academic institute. Although not without risks, these non-governmental attributions have an important role to play in the cybersecurity ecosystem. They are often faster and more detailed than governmental attributions, and they sometimes fill gaps, bringing clarity about cyberattacks that governments, for various reasons, may choose not to attribute. Companies and think tanks have recently proposed centralizing attribution of state-sponsored cyberattacks in a new international entity. But the current system of public-private attributions, decentralized and messy though it is, has some underappreciated virtues — ones that counsel in favor of preserving a multiplicity of attributors even alongside a possible future attribution entity.

Decentralized Cyberattack Attribution

Attribution of state-sponsored cyberattacks can be difficult, but the significant uptick in attributions in recent years shows that attribution is far from impossible. After several years of only sporadic attributions, Western governments in 2017 began attributing cyberattacks to other governments more frequently and in a more coordinated fashion. But nongovernment actors have more consistently attributed harmful cyber activity to state actors. Although not without risks, these nongovernmental attributions play an important role in the cybersecurity ecosystem. They are often faster and more detailed than governmental attributions, and they fill gaps where governments choose not to attribute. Companies and think tanks have recently proposed centralizing attribution of state-sponsored cyberattacks in a new international entity. Such an institution would require significant start-up time and resources to establish efficacy and credibility. In the meantime, the current system of public-private attributions, decentralized and messy though it is, has some underappreciated virtues—ones that counsel in favor of preserving some multiplicity of attributors even alongside any future attribution entity.

Considering the Potential Deterrence Value of Legislation Allowing Hacking Back

Would proposed legislation creating an affirmative defense from prosecution under the Computer Fraud and Abuse Act to those engaging in active cyber defense measures advance efforts to deter state-sponsored hackers from attacking private actors in the United States? I argue that despite legitimate concern regarding the Active Cyber Defense Certainty Act, the United States is in dire need of deterrence mechanisms to stop future state-sponsored cyber attacks and ACDC has at least some deterrent value.

The European Union as a Cybersecurity Actor

The working paper discusses the challenges facing the European Union as it seeks to become a more active player in the field of cybersecurity. It outlines the concept of cybersecurity and the various approaches to cybersecurity governance. It then discusses the EU’s approach to cybersecurity issues, focusing on three elements: cybercrime, network and information security, and cyber-defence. Although a relative newcomer on the scene, the EU has made strides towards establishing a coherent policy framework across these areas. The EU is also developing a role in cyber defence, a field that has been largely left to the Member States. It finally analyses the external dimension of cybersecurity policy, and argues that the EU can influence the development of international norms. EU policy must also deal with the political and diplomatic dimension, especially as threats of state-sponsored cyber attacks increase.

A Criminological Perspective on Power Grid Cyber attacks: Using Routine Activities Theory to Rational Choice Perspective to Explore Adversarial Decision-Making

Abstract The US power grid has been identified by security experts as a prime target for terrorist-based and state-sponsored cyber attacks. In addition to downing the grid, cyber attacks can also destroy and manipulate data systems, obtain sensitive intellectual property and steal trade secrets. Existing research has addressed the technical factors, such as vulnerabilities and poor intrusion detection systems, which lead to cyber attacks. However, it remains silent on the human factors in the cyber attack equation. This study uses a criminological framework, specifically Routine Activities Theory and Rational Choice Perspective to capture intelligent adversaries who plan and execute attacks based on their analysis of target suitability and guardianship efficacy. It uses a two-step methodology to identify adversary-, target-, and guardianship-specific factors that collectively impact decision-making processes. First, a document analysis of existing literature reveals nine factors (PARE RISKS) that influence adversarial decision-making: Prevention measures, Attacks and Alliances, Results, Ease of Access, Response and Recovery, Interconnectedness and Interdependencies, Security Testing, Assessments and Audits, Knowledge, Skills, Research and Development, and System Weaknesses. Second, surveys and interviews conducted between 2010 and 2012 with various hackers, penetration testers, and power grid representatives helps validate and refine the PARE RISKS framework. This study identifies (i) adversary-specific factors as resources (skills, money, and time), and research (targets and techniques); (ii) target-specific factors as accessibility (electronic and physical) and weaknesses (outdated architecture and inadequate testing/updates); and (iii) guardian-specific factors as prevention (quality of prevention and intrusion detection measures). It argues that altering each of these three elements of Routine Activities Theory can impact adversarial decision-making, which may help reduce the likelihood of power grid cyber attacks.