Authored By: Ayesha Tabassum
Punjab Bar Council
I. Introduction
When forensic investigators traced the 2020 SolarWinds Orion supply-chain compromise back to Russia’s Foreign Intelligence Service, it took months of painstaking work: reused code, characteristic tooling, and operational patterns that pointed, however indirectly, to a human intelligence unit acting under State direction. Now imagine the same compromise carried out by an AI system that independently identified the vulnerable target, generated its own exploit code, and varied its behaviour to defeat detection. Whose ‘direction’ would there be left to trace? International law’s rules on State responsibility were built for a world in which a wrongful act could, at least in principle, be traced back to a human decision-maker acting on behalf of, or at the direction of, a State. Article 2 of the International Law Commission’s Articles on Responsibility of States for Internationally Wrongful Acts (‘ARSIWA’) requires that conduct be attributable to a State and constitute a breach of an international obligation before responsibility arises[1]. Cyber operations already strained this model by allowing States to act through remote, deniable, and often privatised infrastructure. The emergence of artificial intelligence (‘AI’) as an operational tool in cyber operations — selecting targets, crafting exploits, adapting malware in real time, and generating disinformation — strains the model further, and in some respects breaks it.
This article argues that the existing attribution architecture, principally ARSIWA and its cyber-specific elaboration in the Tallinn Manual 2.0, is inadequate to address AI-assisted cyber operations. The inadequacy is not merely evidentiary — a matter of States lacking the technical means to trace an operation to its source — but structural: the doctrinal tests of ‘instructions’, ‘direction’ and ‘control’ presuppose a level of human, State-directed decision-making that autonomous or semi-autonomous AI systems are specifically designed to reduce. Part II sets out the existing framework. Part III explains how AI disrupts it. Part IV illustrates the problem against a real-world baseline. Part V advances the critical argument, and Part VI sketches directions for reform.
II. The Existing Attribution Architecture
Attribution operates in three attenuated senses — technical, political and legal — and only the last of these engages State responsibility[2]. Legally, conduct is attributable to a State where it is performed by a State organ[3], by a person or entity exercising elements of governmental authority, or by a person or group acting on the State’s instructions or under its direction or control[4]. A State may also incur responsibility where it acknowledges and adopts otherwise private conduct as its own.
The ‘instructions, direction or control’ standard, codified in Article 8 ARSIWA, derives from the International Court of Justice’s ‘effective control’ test in Nicaragua, which held that mere financing, organising, training, equipping or planning of a non-State actor’s operations is insufficient; the State must have directed or enforced the specific conduct in which the violation occurred[5]. The International Criminal Tribunal for the former Yugoslavia proposed a looser ‘overall control’ test in Tadic, requiring only that the State have a role in organising, coordinating or planning the group’s actions, without needing to direct each specific operation[6]. The ICJ subsequently declined to adopt Tadic’s standard for the purposes of State responsibility, reaffirming ‘effective control’ in the Genocide case[7]. Attribution and breach must also relate to the same conduct — control that is general in nature will not attribute a specific wrongful act unless it extends to that act[8].
The Tallinn Manual 2.0 imports this framework into cyberspace largely without modification. Rule 17 provides that cyber operations by a non-State actor are attributable to a State where engaged in pursuant to its instructions or under its direction or control, or where the State acknowledges and adopts the operation as its own[9]. Rule 15 cautions that the mere fact an operation originates from, routes through, or reports back to governmental cyber infrastructure is ordinarily insufficient evidence of attribution[10]. The International Group of Experts also confirmed that no heightened evidentiary threshold — such as a criminal ‘beyond reasonable doubt’ standard — is required as a matter of international law before a State may attribute conduct, publicly or otherwise, although the commentary emphasises that the control exercised must be traceable to the specific operation in question[11]. State practice, reflected in the national positions collected in the CCDCOE’s Cyber Law Toolkit, largely confirms that customary rules of State responsibility apply to cyber operations without a distinct lex specialis[12].
III. How AI Disrupts the Attribution Link
1. The Autonomy Problem
The ‘instructions, direction or control’ standard assumes a continuous, traceable chain of State agency reaching down to the conduct that breaches an obligation. AI-enabled cyber tools are increasingly designed to sever that chain deliberately. A system that autonomously selects targets, generates novel exploit code, or adapts its behaviour in response to defensive countermeasures is not, at the moment of the breach, being ‘directed’ in the Nicaragua sense. The human or State input occurs earlier and more diffusely — in training data curation, model fine-tuning, or the setting of broad operational parameters — rather than in relation to the specific act that constitutes the wrongful conduct. Under the orthodox reading of Article 8, control that is general, remote or temporally disconnected from the specific act will not suffice[13]. Where a State (or its proxy) sets an AI system loose with only high-level objectives, the doctrinal question of whether that State ‘directed’ the resulting operation becomes close to unanswerable on the existing tests.
2. Technical Attribution Undermined by the Same Technology
Even before the legal question of attribution arises, a State must first establish, as a technical matter, who conducted the operation. Technical attribution has traditionally relied on behavioural fingerprinting: reused code, characteristic tooling, infrastructure overlaps and operational patterns associated with known threat actors. Generative AI directly undermines each of these indicators. It can synthesise code stylistically unlike an actor’s known toolkit, generate decoy indicators mimicking a rival State’s or criminal group’s known tradecraft, and vary operational patterns at a scale no longer economically constrained by manual labour. The result is not merely a harder attribution exercise but a qualitatively less reliable one: the technical evidence upon which legal attribution ultimately rests becomes easier to falsify precisely because AI is being used.
3. The Private-Actor and Diffusion Problem
Where State organs deploy AI systems directly, Article 4 ARSIWA attributes the conduct without difficulty[14]. The harder cases involve States that benefit from, finance or merely tolerate AI-enabled operations conducted through commercial AI providers, contracted developers or loosely affiliated proxy groups[15]. Commercial foundation-model providers sit outside any plausible reading of ‘State organ’, and a State’s mere reliance on, or failure to regulate, privately developed AI tools falls well short of the direction or control required by Article 8. States may therefore benefit from AI-enabled operations — through intelligence advantage, economic harm to a rival, or strategic disruption — while remaining legally insulated, because the operative technology is designed, trained and often executed by intermediaries several steps removed from State instruction.
4. The Primary-Rule Threshold Problem
A secondary difficulty compounds the attribution problem: many AI-enabled cyber and information operations — large-scale synthetic disinformation, automated influence campaigns, or low-intensity data manipulation — may cause serious societal or economic harm without clearing the threshold of a prohibited use of force under Article 2(4) of the UN Charter, or even of unlawful intervention[16]. Even where attribution could in principle be established, there may be no settled primary rule for a State to invoke, leaving the conduct in the same unregulated ‘grey zone’ that has long characterised sub-threshold cyber operations, now populated by a more capable and scalable class of tools.
IV. An Illustrative Baseline: SolarWinds and Its AI-Augmented Analogue
The 2020 SolarWinds Orion supply-chain compromise offers a useful, if imperfect, baseline. The operation, which affected roughly 18,000 organisations, was publicly and formally attributed by the United States and the United Kingdom to Russia’s Foreign Intelligence Service (the SVR), tracked by industry as APT29 or ‘Cozy Bear’, following a sustained forensic investigation identifying characteristic tooling and infrastructure[17]. Even here, formal attribution took several months, rested on an intelligence assessment described only as held with ‘high confidence’, and was contested by the alleged perpetrator[18]. If a comparable supply-chain compromise were instead conducted using an autonomous AI agent — one that independently identified the vulnerable dependency, generated novel implant code, and varied its command-and-control patterns to defeat behavioural detection — both stages of the exercise would be harder: technical attribution would face deliberately degraded indicators, and legal attribution would face a weaker claim that any State organ ‘directed’ conduct that the system itself selected and executed. The SolarWinds case, difficult enough under the existing framework, represents something close to a best-case scenario for attribution compared to a plausible AI-augmented equivalent.
V. Why the Existing Framework Is Inadequate
Three points sustain the argument that current international law is not merely strained but structurally inadequate for AI-assisted cyber operations.
First, the control-based tests in Nicaragua and Article 8 ARSIWA were designed for principal-agent relationships between States and human proxies, where direction can be evidenced by orders, funding flows, or after-the-fact endorsement. They were not designed for principal-tool relationships, where the ‘tool’ itself makes the operationally significant decisions. No amount of doctrinal flexibility in interpreting ‘direction’ comfortably captures a State’s decision to deploy, or fail to restrain, an autonomous system whose specific conduct it did not — and by design could not — dictate in advance.
Second, the evidentiary infrastructure underpinning attribution — technical fingerprinting — is being degraded by the same technology that attribution seeks to regulate. This is a novel feedback problem: unlike earlier developments in cyber capability, AI does not simply make operations more damaging: it makes the process of establishing who is responsible for them systematically less reliable, at scale, and at falling cost to the operator.
Third, the disjunctive structure of Article 8 — instructions, direction, or control[19] — was intended to lower the bar for attribution by giving States multiple routes to the same conclusion. Against AI-mediated conduct, all three routes are simultaneously weakened, because each presupposes a moment of specific, act-connected human agency that autonomous operation is engineered to remove. The cumulative effect is not a marginally higher evidentiary burden but a doctrinal gap: conduct that is functionally state-enabled but not, on the orthodox tests, state-directed.
It should be acknowledged that this critique is contested. Some commentators maintain that ARSIWA remains adequate because AI systems are, in the final analysis, deployed pursuant to some State or State-tolerated decision, and that acknowledgment-and-adoption or due-diligence-based obligations can fill residual gaps[20]; others note that States have so far preferred political over legal attribution in any event, making the doctrinal precision of the control tests less consequential in practice than the political will to name and shame[21]. These are reasonable qualifications, but they concede rather than answer the structural point: the law’s operative doctrine still asks who instructed, directed, or controlled the specific conduct, and AI autonomy is designed to make that question progressively harder to answer honestly in the affirmative.
VI. Towards Reform
A full reform proposal exceeds the scope of this article, but three directions merit brief mention. First, some commentators and expert groups have begun exploring whether a ‘control and capabilities’ or risk-based standard — attributing responsibility where a State knowingly deploys, funds, or fails to regulate a foreseeably harmful AI capability — might supplement, rather than replace, the effective-control test, shifting emphasis from moment-of-conduct direction to upstream design and deployment choices[22]. Second, due-diligence obligations, already recognised in a preliminary form in State cyber-security practice, could be extended to require States to prevent knowingly harmful AI-cyber capabilities from operating out of their territory or under their sponsorship, attaching responsibility to the omission rather than requiring proof of direction[23]. Third, a stronger multilateral push toward technical standards for AI-system provenance and logging — analogous to aviation’s black-box requirements — could partially restore the evidentiary basis for technical attribution that generative techniques currently erode. None of these routes is uncontroversial, and each raises its own questions of sovereignty and feasibility; but continued reliance on the unmodified Nicaragua/Article 8 framework leaves an expanding category of harmful, State-enabled conduct outside the reach of the law of State responsibility.
VII. Conclusion
The law of State responsibility was constructed around the premise that a wrongful act, however remote or deniable, could ultimately be traced to a human decision made by or for a State. AI-assisted cyber operations test that premise at both of its load-bearing points: the technical evidence needed to identify a perpetrator, and the legal standard needed to link that perpetrator’s specific conduct to a State. The Tallinn Manual 2.0’s straightforward transposition of Nicaragua-era doctrine into cyberspace was already contested; transposed further into an era of autonomous, self-modifying tools, it risks becoming a framework that formally applies to AI-assisted operations while substantively failing to reach most of them. Closing that gap will require international law to look past the instruction, direction or control exercised over conduct, toward the choices States make in developing, deploying and failing to restrain the systems that increasingly choose that conduct for themselves.
Reference(S):
Cases
Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro) (Judgment) [2007] ICJ Rep 43.
Military and Paramilitary Activities in and against Nicaragua (Nicaragua v United States of America) (Merits) [1986] ICJ Rep 14.
Prosecutor v Tadić (Judgment) IT-94-1-A (ICTY, 15 July 1999).
Legislation and Instruments
International Law Commission, ‘Draft Articles on Responsibility of States for Internationally Wrongful Acts’ (2001) UN Doc A/56/10.
Secondary Sources
Bing C, ‘Russian Spy Agency SVR Responsible for SolarWinds Hack: White House’ (Insurance Journal, 16 April 2021).
‘Cyber Operations, Artificial Intelligence and the Law of State Responsibility’ (Mondaq, 2026).
International Cyber Law: Interactive Toolkit, ‘State Responsibility’ (CCDCOE, 2026).
National Security Agency, Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation, ‘Russian SVR Targets US and Allied Networks’ (Cybersecurity Advisory, 15 April 2021).
Schmitt MN (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2nd edn, CUP 2017).
‘SVR Chief Denies Russia Was Behind SolarWinds Cyberattack’ (RFE/RL, 18 May 2021).
‘Tallinn Manual 3.0: Sovereignty and Attribution in 2025’ (Journal of Law and Cyber Warfare, 22 July 2025)
[1]International Law Commission, ‘Draft Articles on Responsibility of States for Internationally Wrongful Acts’ (2001) UN Doc A/56/10, art 2 (‘ILC Articles’).
[2]‘Cyber Operations, Artificial Intelligence and the Law of State Responsibility’ (Mondaq, 2026) (‘AI and State Responsibility’).
[3]ILC Articles (n 1) art 4.
[4]ILC Articles (n 1) art 8.
[5]Military and Paramilitary Activities in and against Nicaragua (Nicaragua v United States of America) (Merits) [1986] ICJ Rep 14, paras 109-115.
[6]Prosecutor v Tadic (Judgment) IT-94-1-A (ICTY, 15 July 1999) paras 116-145.
[7]Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro) (Judgment) [2007] ICJ Rep 43, paras 396-407.
[8]ILC Articles (n 1) art 8, commentary para 3 (noting that ‘instructions’, ‘direction’ and ‘control’ are disjunctive, but each must relate to the specific conduct alleged to be wrongful).
[9]Michael N Schmitt (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2nd edn, CUP 2017) rule 17 (‘Tallinn Manual 2.0’).
[10]Tallinn Manual 2.0 (n 9) rule 15 and accompanying commentary.
[11]Tallinn Manual 2.0 (n 9) rule 17, commentary paras 4-6.
[12]International Cyber Law: Interactive Toolkit, ‘State Responsibility’ (CCDCOE) <https://cyberlaw.ccdcoe.org/wiki/State_responsibility> accessed September 2026, national positions of Austria (2024), Estonia (2021) and Colombia (2025) (‘Cyber Law Toolkit’).
[13]ILC Articles (n 1) art 8, commentary para 3.
[14]ILC Articles (n 1) art 4.
[15]AI and State Responsibility (n 2).
[16]AI and State Responsibility (n 2).
[17]National Security Agency, Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation, ‘Russian SVR Targets US and Allied Networks’ (Cybersecurity Advisory, 15 April 2021); White House statement of 15 April 2021, discussed in Christopher Bing, ‘Russian Spy Agency SVR Responsible for SolarWinds Hack: White House’ (Insurance Journal, 16 April 2021).
[18]ibid; Sergei Naryshkin, interview with BBC, discussed in ‘SVR Chief Denies Russia Was Behind SolarWinds Cyberattack’ (RFE/RL, 18 May 2021).
[19]ILC Articles (n 1) art 8.
[20]ILC Articles (n 1) art 11.
[21]AI and State Responsibility (n 2).
[22]‘Tallinn Manual 3.0: Sovereignty and Attribution in 2025’ (Journal of Law and Cyber Warfare, 22 July 2025).
[23]Cyber Law Toolkit (n 12), national position of Costa Rica (2023), on the emerging role of due diligence in State cyber practice.
