Authored By: Dami Kalejaiye
University of Cambridge
Introduction
Individual criminal responsibility refers to whether a specific person can be tried and punished for their own conduct. State responsibility is about whether the state itself has breached a binding obligation, which depends on attribution, the test for whether an act should count, in law, as the state’s own, rather than merely the independent act of the group that carried it out. [1] Nicaragua v United States (1986) established the ‘effective control’ standard, setting a high threshold for attribution and requiring evidence that a state controlled the specific operation in which the violation occurred. [2]
This raises a pertinent legal question: does the effective control test protect states from being falsely accused, or does it reward them for never documenting anything which could prove their guilt? This article argues that the effective control test creates an accountability gap in international law which states can exploit to evade responsibility for violations committed through their proxies. Requiring proof that a state directed a specific operation in which a violation occurred incentivises states to structure their involvement in a way which allows them to maintain plausible deniability. [3]As modern conflicts increasingly rely on indirect and technologically driven means, this attribution test becomes harder to justify and easier for states to exploit.[4]
Section II sets out the legal framework governing individual and state responsibility, including the origins of the competing attribution standards. Section III examines the reasoning behind the leading decisions and the divide between them. Section IV argues that technological advancements and structural gaps in the laws exacerbate this accountability gap. Section V tests this argument against Rwanda’s documented support for the M23 rebel group and Russia’s use of the Wagner Group.
The legal framework
Individual criminal responsibility
Individual criminal responsibility operates within international criminal law. This means that an individual who is personally liable and tried for their own conduct will be punished (e.g. go to prison). This occurs irrespective of whether the state they were working for is also held responsible for the same conduct.[5] This notion is traced back to the Lieber Code, 1863, which acknowledged that soldiers could be personally punished for unlawful conduct, rather than treating it as something only the state was responsible for. [6] The Geneva Conventions, 1949, enshrined this obligation into a binding treaty. It requires states to prosecute or extradite individuals accused of a “grave breach” of the Conventions, such as war crimes or crimes against humanity.[7] The Rome Statute, 1998, further reinforces this, stating that a person who commits, orders, or facilitates international crimes is personally liable.[8]
State responsibility: Attribution and Breach
State responsibility operates within public international law, where states are treated as legal entities rather than individuals acting on their own accord[9]. This means that a state cannot be imprisoned and responsibility for a crime is addressed by stopping the wrongful act, apology, restitution or compensation.[10] The primary legal framework for holding states accountable is the International Law Commission’s (ILC) 2001, Articles on Responsibility of States for Internationally Wrongful Acts (ARSIWA). For a state to be held legally responsible under this legal framework, two conditions must be satisfied: attribution and breach.[11]
Attribution refers to whether a particular act can be recognised as an act of the state. The tests used to determine attribution are contingent on who committed the conduct. When the individual is a “state organ”, in which they hold a position within the state, the state is automatically attributed, provided that the act connects the role the individual occupied within the state. [12]A state remains legally responsible if the state organ goes beyond their designated duties, provided they were acting on behalf of the state.[13] For private actors or groups, it must be clear that they were acting under “ the instructions of, or under the direction or control of, that State” when carrying out the specific act for the state to be attributed[14]. Breach refers to the state’s conduct violating an existing international legal obligation.[15]
The Attribution Debate: Effective Control and Overall Control
The International Court of Justice (ICJ) established the ‘effective control’ test in n Nicaragua v United States (1986). Nicaragua claimed that violations committed by the Contras, an armed rebel group that opposed the government, should be attributed to the United States, which funded, supplied and trained them. The ICJ ruled stated this involvement was insufficient to attribute the Contra’s acts to the United States. This is because attribution required evidence that the United States controlled the specific Contra operation in which the alleged violation occurred.[16]
The Overall control test emerged from the International Criminal Tribunal for former Yugoslavia (ICTY) in Prosecutor v Tadić (1999), in which a Bosnian Serb official was being tried for the crimes committed at the Omarska concentration camp during the Bosnian War. The ICTY ruled that a state which coordinates and supports a non-state actor can be attributed, without evidence of it controlling a specific operation. [17]
Case law analysis
The effective control standard rests on a particular conception of causation. It treats attribution as depending on whether a state directly caused the proxy group to commit a specific violation, rather than whether the state caused the proxy group to exist and have the capacity to commit the violations[18]. Treating assisting a proxy group and controlling a specific operation as legally distinct has significant risks. This is because a state can provide the means to for a proxy to operate but maintain plausible deniability, under public international law if there is lack of evidence for controlling an operation in which a violation occurred.
The ICJ settled the debate between which test was suitable for attribution in the Bosnian Genocide case. Bosnia claimed that Serbia was responsible for the Srebrenica massacre as it supported the Bosnian Serb Army (VRS) to conduct a series of atrocities against Bosnian civilians . The ICJ repudiated ICTY’s ‘overall control’ test because the ICTY concerns individual criminal responsibility. This means its overall control test was only applicable for individual rather than state attribution. The Court stated that the effective control test first introduced in Nicaragua v United States, should be the standard for state attribution > genocide was not attributed to Serbia. Applying this standard, the Court found that the Bosnian genocide could not be attributed to Serbia as there was insufficient evidence to show that Serbia exercised effective control over the VRS’s specific operations at Srebrenica.[19]
Critical Analysis
Inconsistency in Article 8
One problem lies in the language used in Article 8 of the ARISAW . The ICL identified ‘control’, ‘direction’ and ‘instructions’, as three separate grounds for attribution. This implies that attribution could arise where a state either instructs a group to commit an act, directs its conduct, or has control over it[20]. Conversely, the ICJ interprets it from the lens of ‘effective control’ over the operation in which the act occurred[21]. This inconsistency between the ILC’s drafting and the ICJ’s interpretation has severe consequences. The reason is that the effective control test requires a formal and explicit causal relationship between the state and the proxy, when modern day proxy conflict operates through indirect influence. [22]States victim to state-sponsored (proxy) violence are frequently left with pursuing individual attribution as the only avenue for accountability to be held.
Cyber proxy wars
The evolution of modern conflict has amplified the existing challenges for the effective control threshold as states rely on cyber proxies to conduct illicit operations indirectly. States use private independent contractors, criminal networks and hacking groups where any affiliation to the state is obscured, to initiate its cyber operations. Cyber proxies operate through anonymous servers, in jurisdictions with weak data protection laws and false identities. Additionally, cyber proxies are created for a single operation and disposed of once the operation is complete, further eliminating any evidence of an affiliation between the state and the proxy. [23]Notably, this doesn’t imply that the effective control test is outdated because of technological advancement but highlights that states recognise and exploit the standards required for attribution. In doing this, it allows them to organise cyber proxies in a way which circumvents any state responsibility.
Due Diligence: Redirects rather than solves the problem
Due diligence has been suggested as a means of bypassing the attribution problem. Due diligence in this context refers to whether a state had knowledge of harm occurring in its jurisdiction and took reasonable steps to prevent the harm from occurring. This principle stems from the Corfu Channel case, in which the ICJ ruled that a state must knowingly allow its own territory to be used to inflict harm on other states. [24]Tallinn Manual, 2.0, an expert statement on how international law should apply to cyber operations, extends this principle of exercising due diligence to the digital domain. Rule 6 requires states to exercise due diligence to prevent their territory or systems used for cyber-related activity from causing harm to other states.[25] Rule 7 demands that states take the necessary measures to prevent the harm from occurring once made aware of it[26]. This shifts the legal question from whether a proxy’s harmful conduct can be attributed to a state to whether the state knew or should have known about the harmful and failed to prevent it. However, this does not address the underlying accountability gap. This is because states can easily argue that they lacked any knowledge of any harm occurring and/or the capacity or capabilities to prevent the harm.[27] Additionally, various states also rejected the Tallin Manuals as legally binding . [28]Thus, this demonstrates that due diligence obligation redirects rather than solves the attribution problem.
Comparative perspectives
Rwanda and M23
Rwanda’s support for the March 23 Movement (M23), an armed rebel group operating in eastern Democratic Republic of Congo since 2021, has been well documented by various sources. A UN Security Council report documented Rwandan troops fighting with M23 soldiers and equipment being directly supplied to them. It emphasised Rwanda’s direct and decisive involvement’ with M23.[29] Moreover, the European Parliament highlighted that Rwanda’s “de facto control of M23” in which approximately 3000 and 4000 Rwandan soldiers are working alongside M23.[30] Despite this substantial evidence of Rwanda’s involvement meeting the ICTY’s threshold of “overall control,” [31]it does not meet the “effective control” threshold. [32]This means that any state seeking to attribute M23’s conduct to Rwanda would need to find compelling evidence that Rwanda controlled specific operations in which the violation occurred. This shows that the accountability being legally recognised stems from which legal precedent the evidence is measured against. Under the standard effective control test, Rwanda’s liability remains unproven.
Russia and the Wagner Group
The Wagner Group case shows how the effective control test creates an accountability gap in proxy warfare. Established in 2014, Wagner operated as a private Russian paramilitary group. It received funding, training and support from Russia, while also being linked to a series of alleged war crimes in Mali, Central African Republic, Libya, Sudan, Mozambique, Syria etc.[33] A UN report believed that Malian soldiers, accompanied by Wagner officials, were responsible for over 500 civilian executions during the 2022 Mouri Massacre[34]. Despite Putin’s admission that Russia fully funded and supplied the Wagner Group[35], funding a proxy group does not satisfy the ‘effective control’ threshold to attribute these acts to Russia[36]. Moreover, following Wagner’s mutiny in 2023 and the deaths of key leaders in the organisation, Russia formed a new government-controlled entity, ‘Africa Corps’, to replace Wagner. While this makes Africa Corps future conduct attributable to Russia as a ‘state organ’, it remains difficult for states seeking justice for violations by Wagner to hold Russia responsible. This is because they cannot retrospectively attribute Wagner’s conduct to Russia as attribution is based on the time of the wrongful act[37]
Conclusion
The effective control test [38]has shown that the problem is not simply the lack of evidence to show that a state managed a specific illicit operation, but the absence of a robust legal framework capable of recognising state influence as a basis of state responsibility. This potentially creates a blueprint for evading responsibility. In cases like Rwanda’s relationship with M23 and Russia’s with Wagner, the myopic conceptualisation of attribution excludes the broader forms of control captured by the overall control test[39]. This structural gap in the legal frameworks means it becomes a legally viable route for states to avoid liability. The proliferation of cyber proxies has intensified this problem, as anonymity and untrace ability make it easier for states to deny directing specific cyber operations and thus makes harder to satisfy the threshold for effective control[40]. The overall control test should therefore be reconsidered as a possible complementary benchmark for state attribution to ensure that effective control test does not insulate states who use proxies from legal responsibility.
Reference(S):
Cases
Bosnia and Herzegovina v Serbia and Montenegro [2007] ICJ Rep 43
Corfu Channel (United Kingdom v Albania) [1949] ICJ Rep 4
Nicaragua v United States of America [1986] ICJ Rep 14
Prosecutor v Tadić [1999] 124 ILR 61
Legislation
Geneva Convention (I) for the Amelioration of the Condition of the Wounded and Sick in Armed Forces in the Field (Geneva, 12 August 1949)
Geneva Convention (IV) relative to the Protection of Civilian Persons in Time of War (Geneva, 12 August 1949)
Instructions for the Government of Armies of the United States in the Field (24 April 1863)
International Law Commission, ‘Articles on Responsibility of States for Internationally Wrongful Acts’ (2001) UN Doc A/56/10
Rome Statute of the International Criminal Court (Rome, 17 July 1998)
Bibliography
Bosch, Shannon Joy and Kimble, Matthew, ‘State Responsibility for Violations of International Humanitarian Law and Human Rights Law by Private Security Companies in Africa: The Case of the Wagner Group and Africa Corps’ (2026) 70(1) Journal of African Law 1
Brookings, ‘Russia’s Wagner Group in Africa: Influence, Commercial Concessions, Rights Violations, and Counterinsurgency Failure’ (Brookings, 2022)
European Parliament, ‘Resolution of 13 February 2025 on the Escalation of Violence in the Eastern Democratic Republic of the Congo’ P10_TA(2025)0020, 2025/2553(RSP)
Hathaway, Oona and others, ‘Ensuring Responsibility: Common Article 1 and State Responsibility for Non-State Actors’ (2017) 95(3) Texas Law Review 539
International Committee of the Red Cross, ‘Individual Criminal Responsibility’ (How Does Law Protect in War?, 2026)
Maddocks, Jennifer, ‘Putin Admits to Funding the Wagner Group: Implications for Russia’s State Responsibility’ (Articles of War, 30 June 2023)
NATO CCD COE, International Cyber Law Interactive Toolkit (1st edn, CCD COE Interactive Press 2026)
Schmitt, Michael N (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2nd edn, Cambridge University Press 2017)
Schmitt, Michael N and Vihul, Liis, ‘The Nature of International Law Cyber Norms’ (2014) 5 The Tallinn Papers 1
Špáčil, Jakub, ‘Attribution of Cyber Operations’ (2024) 24(2) International and Comparative Law Review 86
UN News, ‘Moura: Over 500 Killed by Malian Troops, Foreign Military Personnel in 2022 Operation’ (UN News, 2023)
UN Security Council, ‘Final Report of the Group of Experts on the Democratic Republic of the Congo’ (4 June 2024) UN Doc S/2024/432
Wither, James K, ‘Outsourcing Warfare: Proxy Forces in Contemporary Armed Conflicts’ (2020) 31(4) 109
[1] International Law Commission, ‘Articles on Responsibility of States for Internationally Wrongful Acts’ [2001] UNGA
[2] Nicaragua v United States of America ICJ Rep 14
[3] Oona Hathaway and others, ‘Ensuring Responsibility: Common Article 1 and State Responsibility for Non-State Actors’ (2017) 95(3) Texas Law Review 539, 542–543
[4] Jakub Špáčil, ‘Attribution of Cyber Operations’ (2024) 24(2) International and Comparative Law Review 86, 90-92
[5] Rome Statute of the International Criminal Court (Rome, 17 July 1998) art 25.
[6] Instructions for the Government of Armies of the United States in the Field (24 April 1863) arts 44, 47; International Committee of the Red Cross, ‘Individual Criminal Responsibility’ (How Does Law Protect in War? 2026) https://casebook.icrc.org/a_to_z/glossary/individual-criminal-responsibility accessed 21 August 2026
[7] Geneva Convention (I) for the Amelioration of the Condition of the Wounded and Sick in Armed Forces in the Field (Geneva, 12 August 1949) art 49; Geneva Convention (IV) relative to the Protection of Civilian Persons in Time of War (Geneva, 12 August 1949) art 146.
[8] Rome Statute (n 7).
[9] International Law Commission, ‘Articles on Responsibility of States for Internationally Wrongful Acts’ [2001] UN Doc A/56/10, art 1
[10] International Law Commission (n 11) arts 30-31.
[11] International Law Commission (n 11) art 2.
[12] International Law Commission (n 11) art 4(1).
[13] International Law Commission (n 11) art 7.
[14] International Law Commission (n 11) art 8.
[15] International Law Commission (11) art 2
[16] Nicaragua v United States (n 1) para 115.
[17] Prosecutor v Tadić [1999] 124 IRL 61
[18] Nicaragua v United States (n 1); Prosecutor v Tadić (n 17)
[19] Bosnia and Herzegovina v Serbia and Montenegro [2007] ICJ Rep 43; Nicaragua v United States (n 1)
[20] International Law Commission (n 11) art 8.
[21] Nicaragua v United States (n.1)
[22] James K Wither, ‘Outsourcing Warfare: Proxy Forces in Contemporary Armed Conflicts’ (2020) 31(4) 109, 112
[23] Spacil (n 4), 90-92
[24] Corfu Channel. United Kingdom v Albania [1949] ICJ Rep 4
[25] Michael N Schmitt (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2nd edn, Cambridge University Press 2017) 30
[26] Schmitt (n25) 43
[27] NATO CCD COE, International Cyber Law Interactive Toolkit (1st edn, CCD COE Interactive Press 2026) 6
[28] Michael N Schmitt and Liis Vihul, ‘The Nature of International Law Cyber Norms’ (2014) 5 The Tallinn Papers 1, 14
[29] UN Security Council, ‘Final Report of the Group of Experts on the Democratic Republic of the Congo’ (4 June 2024) UN Doc S/2024/432.
[30] European Parliament, ‘Resolution of 13 February 2025 on the Escalation of Violence in the Eastern Democratic Republic of the Congo’
[31] Prosecutor v Tadić (n 17)
[32] Nicaragua v United States (n 1)
[33] Brookings, ‘Russia’s Wagner Group in Africa: Influence, Commercial Concessions, Rights Violations, and Counterinsurgency Failure’ (Brookings, 2022) https://www.brookings.edu/articles/russias-wagner-group-in-africa-influence-commercial-concessions-rights-violations-and-counterinsurgency-failure/ accessed 24 August 2026.
[34] UN News, ‘Moura: Over 500 Killed by Malian Troops, Foreign Military Personnel in 2022 Operation’ (UN News, 2023) https://news.un.org/en/story/2023/05/1136607 accessed 24 August 2026.
[35] Jennifer Maddocks, ‘Putin Admits to Funding the Wagner Group: Implications for Russia’s State Responsibility’ (Articles of War, 30 June 2023) westpoint.edu accessed 24 August 2026.
[36] Nicaragua v United States (n 1)
[37] Shannon Joy Bosch and Matthew Kimble, ‘State Responsibility for Violations of International Humanitarian Law and Human Rights Law by Private Security Companies in Africa: The Case of the Wagner Group and Africa Corps’ (2026) 70(1) Journal of African Law 1, 1-18.
[38] Nicaragua v United States (n 1)
[39] Bosch and Kimble (n 37)
[40] Spacil (n 4), 90-92
