New Technologies in International Law / Tymofeyeva, Crhák et al.

under special circumstances. Accordingly, a plurality of tests has been developed over the years to tackle the attributability of often covert conduct of cyber operations. In the principled Nicaragua case, ICJ concluded that a link of “effective control” between the State and non-State actors is necessary for attribution to be attained. 644 The degree of such control and the timeframe under which this control must be maintained has, however, been traditionally subject to much debate. Organized groups have received a less restrictive treatment by the ICTY where both the qualitative and quantitative threshold has been lowered in order to facilitate the “overall control” test, which requires the State in question (i) to provide the non-State entity with financial and training assistance, military equipment and/or operational support, and (ii) to participate in the organization, co-ordination or planning of operations of the entity in question. 645 States are thus not required to directly participate in all individual attacks of an organized group in order to bear blame as long as their overall level of involvement is of a high enough intensity. This marks a clear dismissal of the Nicaragua case, where ICJ implied that attribution can only be granted as long as the State is able to control the beginning of the relevant operations, the way they are carried out, and their end. 646 Granted, the ICJ and ICTY differed in jurisdiction and the desired outcome of the proceedings, so the disagreement is less poignant than it seems at first. Other traditional methods of attribution have generally been focused on State attribution of armed and terrorist groups engaged in kinetic warfare, with their State patron being either clandestine or entirely non-existent. In some instances, the power of these groups reached such an apex, that the opposite scenario became plausible, that is the effective control of such groups over the State they conduct their activities from. Suffice to say, these methods are ill-suited for cyber operations and will not be further elaborated on here. Worthy of note is also the problem of attribution with regard to companies and enterprises which are partially or entirely State-controlled. In line with the principle of separateness between corporate entities on a national level, the fact that the State initially establishes a corporate entity, whether by a special law or otherwise, is not a sufficient basis for the attribution to the State of the subsequent conduct of that entity. In other words, whether the State is a partial or majority shareholder or the enterprise is entirely State-owned is not conclusive for attribution. Only when the State would exercise public power through the institution, or it would use its ownership share interest to maneuver the enterprise into specific action could attribution be inferred. The Tallinn Manual takes on a different, lex specialis , approach to ease the way to de facto attribution. In line with the principle established in the Corfu Channel case - a State may not “ allow knowingly its territory to be used for acts contrary to the rights of 644 ICJ, Case Concerning Military and Paramilitary Activities in and Against Nicaragua (Nicaragua v. United States of America) , Judgment [1986] ICJ Rep 392, para 115. 645 ICTY, Prosecutor v. D. Tadić, Sentencing appeals in the case Dusko Tadic, CC/P.I.S./465-E (26 January 2000), paras 120–121. 646 ICJ, Case Concerning Military and Paramilitary Activities in and Against Nicaragua (Nicaragua v. United States of America) , Judgment [1986] ICJ Rep 392, para 242.

153