국가가 연루된 비국가행위자의 사이버공격에 대한 국가책임 귀속성

The UN GGE report distinguishes international law applicable to cyberspace from voluntary and non-binding norms as responsible state behavior. Considering the former, the report makes it clear that states’ malicious ICT activities may constitute international wrongful acts whereby a victim state could invoke the law of state responsibility. On the contrary, subsuming a cybercrime under the latter, the report simply recommends that states should seek cooperation and mutual assistance to effectively punish a cybercrime. This difference implies that while a cyberattack committed by states is subject to the application of international law, a cybercrime perpetuated by individual criminal organizations falls within the scope of domestic criminal law. This article points out that there are legal gray areas where the law of state responsibility, as well as states’ domestic criminal law, could not resolve or regulate certain patterns of cyber operations. The ambiguity of the boundary between the cyberattack committed by states and the cybercrime perpetrated by non-state actors appears in the case of cyber operations suspected using of proxies. The article argues that the dichotomy cannot properly solve the complex aspects of cyber operations where states and non-state actors are complicatedly involved with each other. According to the GGE report, the only legal principle that can hold the state responsible for malicious cyber operations of non-state actors is the law of state responsibility. Considering the anonymity of cyber operations and various types of links between states and non-state actors, however, it is nearly impossible to prove that the non-state actors concerned were acting on the instructions of, or under the direction or control of, the suspected state. Concerning the domestic law regulating cybercrime, it is unrealistic for the victim states to expect cooperation between the hostile state for cybercrime investigations. Accordingly, this article argues that it is necessary to apply the principle of due diligence affirmed in the ICJ Corfu Channel case as a way to remove the gray areas.