New Technologies in International Law / Tymofeyeva, Crhák et al.

We might add to this that an important aspect in the context of attribution is the role of private sector. Private cybersecurity companies play a particularly crucial role due to their technological capability and expertise (e. g. computer forensic capabilities). 553 As pointed out by experts in the field, “ some of the most influential reports linking malicious cyber operations to governments and non-state actors have been released by private companies .” 554 Indeed, he concludes that the public-private relationship in the field of cyber sanctions (EU and private companies) has been reversed and the former is by now much more dependent on the latter than vice versa . In reality then, “ governments rely on the private sector for forensic and strategic information, thereby turning the security companies into quasi-intelligence services .” 555 It is mostly Western countries where these private companies are located and thus, the governments (or the EU in our case) is able to harness the capabilities and expertise of these actors, thus having the potential for contributing to the development of state responsibility (attribution for instance). On the other hand, we claim that there is a formidable challenge to this practice by a large number of states mainly from the Global South, together with powerful states like China or Russia. 556 Moreover, cyber sanctions are often imposed precisely against cyber attacks or other malicious cyber activity perpetrated by the abovementioned states that are simultaneously (formally) critical towards the sanctions practice. 557 Furthermore, in the context of attribution, other considerations are present also. States, having the capacity to make the technical determination and attributing cyber-attacks to other states rarely do that, for political and strategic reasons. Although it shall be recognised, that these states still have the capability to do that. Subsequently, we claim in this regard that digitalization or the emergence of new technologies may empower also less powerful states in the context of great-power competition. It is recognized that some of the new technologies could be rather “efficient”, i. e. causing significant damage and being effective as a tool of asymmetric warfare. One indication that supports this contention is the transformation of argumentative practices of states. 558 It seems to be the case that the principle of non-intervention and sovereignty in the cyberspace is being more often invoked by more powerful states. Traditionally, these kinds of arguments based on the said principles were used by weaker states against the intrusion

553 Pawlak P and Biersteker TJ, ‘Guardian of the Galaxy. Eu Cyber Sanctions and Norms in Cyberspace’ ( Graduate Institute of International and Development Studies , October 2019) 70 accessed 31 December 2023.

554 Ibid., p. 71. 555 Ibid., p. 75.

556 The fact however is that China and Russia’s opposition to sanctions is purely formalistic, taking this position only due to strategic and geopolitical reasons. This can be clearly seen from their practice – both China and Russia have imposed sanctions on several occasions and continue to do so. See chapters 5 and 6 in Beaucillon C, Research Handbook on Unilateral and Extraterritorial Sanctions (Elgar, 2021). 557 As stated above, even though some of the cyber-attacks were not officially attributed to Russia or China by the EU, several analyses confirmed this. Furthermore, cyber sanctions were imposed against foreign state officials (e.g. GRU officials). 558 Burchardt D, ‘Does Digitalization Change International Law Structurally?’ (2023) 24 German Law Journal 438.

130