Holding states accountable for cyberattacks?

Large-scale cyberattacks are regularly carried out by hackers acting on behalf of a foreign government. This is according to Evgeni Moyakine, associate professor of IT Law and Cybersecurity. He discusses his research into the question of how countries can be held legally accountable for cyberattacks.

_{Text: Jelle Posthuma}

When asked whether he is comfortable with the interview being recorded, Moyakine has no objections. ‘But once it has been transcribed, the recording should of course be deleted,’ he says with a grin. The associate professor knows what he is talking about: he is an expert in data protection, privacy and cybersecurity. The latter is his particular interest. ‘I am researching whether we can hold states liable for cyberattacks. The attacks are carried out by individuals or hacker collectives, but they are often supported and funded by states.’

Far-reaching consequences

Cyberattacks often make the news. DDoS attacks, in which a computer or server is flooded with data traffic, are a well-known example. Ransomware, or ransom software, is also notorious. Organizations are forced to pay an amount, often in Bitcoin, to anonymous hackers to get their disabled services back online. The universities of Eindhoven and Maastricht have recently experienced this. ‘Sooner or later, it will also happen to the University of Groningen. As a university, we are already attacked daily.’

The consequences of cyberattacks can be enormous, Moyakine continues. From doors of buildings that no longer open to payment systems that no longer work. Even an attack on a nuclear facility is not out of the question. ‘This has already happened in Iran. The Stuxnet virus shut down Iranian nuclear centrifuges at the time. The US and Israel were presumably behind it.’ Another far-reaching example from the recent past is NotPetya, ‘destructive malware’ that posed as ransomware in 2017 and took down the Port of Rotterdam. International intelligence services state that Russia was behind this attack, the researcher explains.

Hybrid warfare

How can we ensure that not only the hackers, but also the states hiding behind their digital operations, are held accountable? This is the central question for Moyakine. ‘I want to be able to hold the contractors accountable – the main actors, in my opinion.’ However, holding a state accountable for a cyberattack is highly complex. ‘There are rules within international law that countries must comply with regarding cyberattacks, but these are not laid down in a treaty. The UN deliberately refrained from drawing up a treaty on state liability that also applies to digital attacks a long time ago, because such a treaty text would quickly become outdated. The current rules therefore fall under customary international law, or unwritten rules.’

Previous rulings are often severely outdated and ill-suited, Moyakine knows. These rulings were made in the 1980s and 1990s and, moreover, relate to military operations, whereas cyberattacks often involve hybrid warfare: a grey area in which it is difficult to speak of a genuine act of war.

International sensitivity

Moyakine distinguishes between technical, political, and legal attribution. In technical attribution, technical analysis is used to determine which actor carried out a cyberattack. In the case of political attribution, for example, US diplomats say that North Korea is behind a particular attack. Legal attribution of digital attacks is a significantly more complex issue, the associate professor continues. States are ‘sovereign entities’ independent of each other. This is the core of international law: you have no mandate in the countries from which the attack originated. ‘If Russia says, ‘We do not extradite our citizens’, there is virtually nothing you can do.’

Measures that go further are internationally extremely sensitive, Moyakine states. Many countries are not keen, according to him. ‘You can assume that the US and various other Western countries have offensive cyber capabilities and carry out cyber operations, but of course they do not want to be held accountable themselves.’

Striking back

Nevertheless, the associate professor believes that there are legal possibilities. ‘It is very difficult to prove, but it is not impossible. I want to develop a control test or theory that allows us to attribute the current way of digital warfare to states.’ Within international law, there are possibilities to settle the damage, the researcher explains.

There is also the possibility of striking back. ‘Suppose the Netherlands is attacked by Russian hackers and we can prove it; in principle, our country is allowed to retaliate using the same means.’ According to Moyakine, such a counterattack can be legally justified under international law, provided that the response is proportionate and does not go beyond what is necessary to induce the attacking state to comply with its international obligations.

Opportunity and threat

The rapid pace of technological developments makes his field of expertise – IT law and cybersecurity – highly dynamic, the researcher explains. He cites artificial intelligence (AI) as an example. According to Moyakine, AI offers both opportunities and new threats. ‘It’s a double-edged sword: it can help hackers, but AI can also be used to improve cybersecurity. State actors are already making extensive use of it. AI allows you to carry out attacks very effectively and without being detected.’

Moyakine is collaborating with researchers from the Faculty of Science and Engineering (FSE) and other universities to explore ways in which AI can be used to enhance cybersecurity. AI agents, which are trained to make decisions and carry out tasks autonomously, show great promise, he says. At the same time, however, the same double-edged sword applies here: recent attacks involving AI agents that have spiralled out of control have also highlighted the significant risks.

The collaboration with researchers from other disciplines fits his role as a JTS Scholar. In addition to interdisciplinary collaboration, he also works with societal partners, such as the police. ‘Such collaboration is challenging, but all the more interesting because of it. We often do not speak the same language. If I generalise a bit, for police officers it is about prosecuting criminals. As a lawyer, I keep pointing to fundamental rights, freedoms, and safeguards: it is not just about the data of criminals, but also about that of their family members, often children. Their personal data must continue to be protected. It is up to me to explain this story well.’

More information

• Evgeni Moyakine
• As a ‘JTS Scholar’, Moyakine is affiliated with the Jantina Tammes School of the University of Groningen. The Jantina Tammes School brings together researchers in the field of digitalization, digital technologies, and artificial intelligence.

  
  Also read the other interviews with Jantina Tammes researchers on the overview page.