Siber Ortamda Devletlerin Sorumluluğu: Devlet Dışı Aktörlerce Gerçekleştirilen Siber Saldırıların Atfedilebilirliği Meselesi

Bu makale uluslararası hukukun işlevselliği ve etkinliği bağlamında devlet organı olmayan özel kişilerin siber aktiviteleri ve bu konuda devletlerin sorumluluğunu doğuran esasları irdelemektedir. Hususi olarak; özel kişilerin siber-uzaydaki haksız eylemlerinden dolayı devletlerin sorumlu tutulup tutulamayacağı hususu hukuki bir sorunsal olarak ele alınmaktadır. Burada amaç, daha güvenli bir siber dünya için devletlerin uluslararası sorumluluğunu düzenleyen uluslararası normların açıklığa kavuşturulması ve bu normlara bağlı atfedilebilirlik kurallarının uygulamasını tanımlamaktır. Devlet organı olmayan, devlet dışı aktörlerin günümüz politik ve askeri çatışma ortamında gittikçe artan etkisi yadsınamayacak noktadadır. Bir kısım devletler bunu kendi avantajlarına kullanmak suretiyle, özel kişileri aracı kılarak işledikleri haksız eylemlere rağmen kolayca sorumluluktan kaçınabilmektedirler. Siber uzaydaki haksız eylemler ve bu konuda sponsor olan devletlerin hukuk karşısında hesap verebilmeleri için katı veya esnek delillere başvurulup başvurulmayacağı, devletlerin uygulamasıyla ancak netlik kazanacaktır. Bu çalışmada atfedilebilirlik kuralları kategorik bir analize tabi tutulmuş ve de facto organ teori ile kontrol teori olmak üzere iki ana başlık altında irdelenmiştir. Atfedilebilirlik kurallarına ilişkin bu kategorik sınıflandırma hukuken uygulanabilir, pratik ve fakat teorik bir çerçeve sunmaktadır. Her iki teori de özel kişilerin eylemlerinden oluştuğu izlenimi veren fakat gerçekte uluslararası hukuk bağlamında devlete özgü faaliyetlerden sayılan ve yine özel kişilerin eylemlerinin devlet faaliyeti sayıldığı esasları tanımlamaktadır. Makalede mevcut atfedilebilirlik kuralları, Uluslararası Hukuk Komisyon’u tarafından kodifiye edilen uluslararası haksız eylemlerden devletlerin sorumluluğunu düzenleyen çalışması ve uluslarararası mahkeme kararlarına paralel olarak irdelenmiştir. Bu çalışmada söz konusu atfedilebilirlik kuralları esas alınarak siber-uzaydaki devletlerin sorumluluğunu doğuran hususların belirlenmesi ve açıklığa kavuşturulması amaçlanmıştır.

STATE RESPONSIBILITY IN CYBERSPACE: THE PROBLEM OF ATTRIBUTION OF CYBERATTACKS CONDUCTED BY NON-STATE ACTORS

This paper assesses the effectiveness of international law in ensuring the responsibility of states for the cyber activities of non-state actors. In particular, it addresses the most critical international legal question of whether states can be held responsible for wrongful acts committed by non-state actors in or through cyberspace. The aim is to identify and apply the law of international responsibility and attribution models in order to help make the cyber world safer for all. This paper introduces a categorical analysis for the attribution of private conduct to a state by formulating attribution models in two main settings, de facto organ theory (agency-based attribution) and control theory (control-based attribution). This categorization offers a theoretical framework with which to validate legally consistent and practically applicable models of attribution. Both attribution theories characterize the legality of a state operation that is seemingly private conduct and transform the conduct of a physical person or entity into an “act of state.” This paper highlights the current models in the doctrine of attribution that correspond to the International Law Commission’s (ILC) articles and international case law concerning the responsibility of states for internationally wrongful acts. Since non-state actors have assumed a prominent role in modern day conflicts, states may elude responsibility by acting through them. If the requirement for attribution is set relatively high, states can simply evade responsibility. While it remains unclear whether state practice will adopt the lower or higher standards of proof in terms of accountability for sponsorship of cyber-attacks, this paper is nevertheless able to examine the applicability of the two theories of attribution for state responsibility as applied to cyber-attacks.

PDF

___

Siobhan Gorman, U.S. Team and Israel Developed Iran Worm, June 1, 2012, available at http://www.wsj.com/articles/SB1000142405270230482130457 7440703810436564 (visited November 2016)http://www.wsj.com/articles/ SB100014240527023048213045774
Peter Beaumont, Stuxnet Worm Heralds New Era of Global Cyberwar, September 30, 2010, available at https://www.theguardian.com/ technology/2010/sep/30/stuxnet-worm-new-era-global-cyberwarhttp:// www.theguardian.com/technology/2010/sep/30/stuxnet-worm-new-era- global-cyberwar, (visited September 2016)
Paul Cornish, David Livingstone, Dave Clemente and Claire Yorke On Cyber Warfare, A Chatham House Report (November 2010) available at http:// www.chathamhouse.org/sites/files/chathamhouse/public/Research/ International%20Security /r1110_cyberwarfare.pdf (visited September 2016)
Nikhil D’Souza, Cyber Warfare and State Responsibility: Developments in International Law, (May 16, 2011) available at http://ssrn.com/ abstract=1842984 (visited September, 2016)
NATO Strategic Concept 2010, updated May 2012, “Cyber attacks continue to pose a real threat to NATO and cyber defence will continue to be a core capability of the Alliance.” available at http://www.nato.int/cps/en/natohq/ official_texts_68580.htm http://www.nato.int/cps/en/natohq/topics_78170. htm (visited October, 2016)
NATO’s documentary ‘Six Colours: War in Cyberspace’ at < http://www.nato. int/ebookshop/video/six_colours/SixColours.html >, (visited September, 2016)
Michael Schmitt, International Law and Cyber Attacks: Sony v. North Korea, (December 17, 2014) available at https://www.justsecurity.org/18460/ international-humanitarian-law-cyber-attacks-sony-v-north-korea/ http:// justsecurity.org/18460/international-humanitarian-law-cyber-attacks-sony-v- north-korea/ (visited September, 2016)
Mark Landler & John Markoff, Digital Fears Emerge After Data Siege in Estonia, (May 29, 2007), available at http://www.nytimes.com/2007/05/29/ technology/29estonia.html http://www.nytimes.com/2007/05/29/ technology/29estonia.html?pagewanted =all&_r=0, (visited October, 2016)
Josh Holliday, Stuxnet worm is the ‘work of a national government agency’, September 24, 2010, available at https://www.theguardian.com/ technology/2010/sep/24/stuxnet-worm-national-agency, http://www. theguardian.com/technology/2010/sep/24/stuxnet-worm-national-agenc,, (visited September, 2016)
Josh Chin, Cyber Sleuths Track Hacker to China’s Military, September 23, 2015, “China’s army has divisions devoted to cyber attacks, and recent evidence shows links between the country’s military and hackers who appear to be pressing the country’s interests abroad.” available at http://www.wsj.com/articles/ cyber-sleuths-track-hacker-to-chinas-military-1443042030 http://www.wsj. com/articles/cyber-sleuths-track-hacker-to-chinas-military-1443042030 (visited October, 2016)
Ian Traynor, Russia Accused of Unleashing Cyberwar to Disable Estonia, The Guardian (London, 17 May 2007) available at https://www.theguardian. com/world/2007/may/17/topstories3.russia http://www.theguardian.com/ world/2007/may/17/topstories3.russia, (visited September, 2016)
Damian Paletta, Danny Yadron & Jennifer Valentino-Devries, Cyberwar Ignites a New Arms Race, October 11, 2015 http://www.wsj.com/articles/cyberwar- ignites-a-new-arms-race-1444611128 “Getting into the cyberweapon club is easier, cheaper and available to almost anyone with cash and a computer.” available at http://www.wsj.com/articles/cyberwar-ignites-a-new-arms- race-1444611128.
Danny Yadron & Jennifer Valentino-Devries, Cataloging the world’s Cyberforces, October 11,2015, available at http://www.wsj.com/articles/cataloging-the- worlds-cyberforces-1444610710 (visited October, 2016)
Daniel Bethlehem, Sandesh Sivakumaran, Noam Lubell, Philip Leach, Elizabeth Wilmshurst, Classification of Conflicts: The Way Forward (1 October 2012) available at http://www.chathamhouse.org/sites/files/chathamhouse/ public/Research/International%20Law/011012summary.pdf (visited October, 2016)
Carol E. Lee & Jay Solomon, U.S. Targets North Lorea in Retaliation for Sony Hack, January 3, 2015 available at http://www.wsj.com/articles/u-s-penalizes- north-korea-in-retaliation-for-sony-hack-1420225942 http://www.wsj.com/ articles/u-s-penalizes-north-korea-in-retaliation-for-sony-hack-1420225942, (visited September, 2016)
Internet Alexander Klimburg, Mobilising Cyber Power, Survival, 53:1, 41-60 (2011), available at http://www.tandfonline.com/doi/abs/10.1080/00396338.2011.5 55595 (visited March 2017)
U.N. International Law Commission. 63 rd Sess., Responsibility of International Organizations. Reports of the Working Group or Sub-Committee and the Special Rapporteur, U.N. Doc. A/CN.4/L.778 available at http://legal.un.org/ ilc/guide/9_11.htm (visited March, 2017)
U.N. 58 th Sess., International Law Commission, by Martti Koskenniemi, Conclusions of the work of the Study Group on the Fragmentation of International Law: Difficulties arising from the Diversification and Expansion of International Law, U.N. Doc. A/CN.4/L.682 (April 13, 2006)
U.N. S.C. Resl. 827, International Tribunal for the Prosecution of Persons Responsible for Serious Violations of International Humanitarian Law Committed in the Territory of the Former Yugoslavia since 1991 (May 25, 1993)
U.N. 56 th Sess., International Law Commission, Report of the International Law Commission on the work of its fifty-third session: Draft articles on Responsibility of States for Internationally Wrongful Acts, with commentaries, U.N. Doc. A/56/10 (August 10, 2001), reprinted in the Yearbook of the International Law Commission Vol. II, Part Two (2001)
Commission of Experts, Final Report of the Commission of Experts Established Pursuant to Security Council Resolution 780, (1992) U.N. Doc. S/1994/674, (27 May 1994)
Reports James Crawford, First Report on State Responsibility, U.N. Doc. A/CN.4/490 and Add. 1–7, reprinted in Yearbook of the International Law Commission, Vol II (1) (1998)
Dušan BERIĆ and Others against Bosnia and Herzegovina, Application nos. 36357/04, 36360/04, 38346/04, 41705/04, 45190/04, 45578/04, 45579/04, 45580/04, 91/05, 97/05, 100/05, 101/05, 1121/05, 1123/05, 1125/05, 1129/05, 1132/05, 1133/05, 1169/05, 1172/05, 1175/05, 1177/05, 1180/05, 1185/05, 20793/05 and 25496/05, (16 October 2007), ECHR Admissibility Decision, available at http://hudoc.echr.coe.int/sites/eng/pages/search. aspx?i=001-83109#{“itemid”:[“001-83109”]},
Solomou and Others v Turkey, Application No 36832/97, Judgment of 24 Jun 2008 available at http://hudoc.echr.coe.int/sites/eng/pages/search. aspx?i=001-87144,
Prosecutor v. Tadić, ICTY Appeal Chamber Judgment Case No IT-94-1-A (July 15, 1999)
Prosecutor v. Delalic, Mucic, Delic and Landzo (Celebici), ICTY Appeals Chamber Judgment, Case No. IT-96-21-A (February 20, 2001)
Military and Paramilitary Activities in and against Nicaragua (Nicaragua v United States of America), Merits, Judgment, I.C.J. Reports (1986)
Loizidou v. Turkey, European Court of Human Rights, (Judgment) Application No 15318/89 (18 Dec 1996) ECHR Rep 1996-IV, 2216 (1996)
Corfu Channel (United Kingdom v Albania) (Merits) I.C.J. Rep 9, (1949)
Cases /Mahkeme karararı Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro), Judgment, I.C.J. Reports 2007
Yoram Dinstein, The Principle of Distinction and Cyber War in International Armed Conflicts, J.Conflict & Sec L. Vol. 17 No. 2, 261–277 (2012);
Tom Dannenbaum, Translating the Standard of Effective Control into a System of Effective Accountability: How Liability Should be Apportioned for Violations of Human Rights by Member State Troop Contingents Serving as United Nations Peacekeepers, Harv. Int’l. L. J. 51 (1), 113-192 (2010)
Stephanie A. Barbour & Zoe A. Salzman, The Tangled Web: The Right of Self- Defense Against Non-State Actors in the Armed Activities Case, N.Y.U. J. Int’l L. & Pol. 40, 54-106 (2008)
Stephan Talmon, The Responsibility of Outside Powers for Acts of Secessionist Entities, I.C.L.Q. 58, 493-517 (2009)
Scott J. Shackelford, State Responsibility for Cyber Attacks: Competing Standards for a Growing Problem, Geo. J. Int’l L. 42, 971-1016 (2011)
Rüdiger Wolfrum, State Responsibility for Private Actors: An Old Problem of Renewed Relevance, in Maurizio Ragazzi (ed.), International responsibility Today: Essays in memories of Oscar Schachter, 423, 423-434 (2005)
Russel Buchan & Nicholas Tsagourias, Cyber War and International Law, J. Confl. & Sec. L. Vol. 17 (2), 183 (2012)
Russell Buchan, Cyber Attacks: Unlawful Use of Force or Prohibited Interventions, J. Confl. & Sec. L. Vol. 17 (2), 211 (2012)
Rosalyn Higgins, A Babel of Judicial Voices? Ruminations from the Bench, I.C.L.Q. 55, 791-804
Oona A. Hathaway, Rebecca Crootof, Philip Levitz, Haley Nix, Aileen Nowlan, William Perdue and Julia Spiegel, The Law of Cyber-Attack, 100 Calif. L. Rev. 817, (August 2012)
Olivier De Frouville, Attribution of Conduct to the State: Private Individuals, in James Crawford; Alain Pellet, Simon Olleson & Kate Parlett (eds.), The Law of International Responsibility, 257-280 (2010)
Nicholas Tsagourias, Cyber Attacks, Self-defence and the Problem of Attribution, J.Conflict & Sec L. Vol 17 No 2, 229-244 (2012)
Nikolas Rajkovic, On ‘Bad Law’ and ‘Good Politics’: The Politics of the ICJ Genocide Case and Its Interpretation, Leiden J. Int’l L. 21, 885-910 (2008)
Milan Plücken & Joern Griebel, New Developments Regarding the Rules of Attribution? The International Court of Justice’s Decision in Bosnia v. Serbia, Leiden J. Int’l L. 21, 601-622 (2008)
Michael N. Schmitt, Cyber Operations and the Jus Ad Bellum Revisited, Vill. L. Rev.Vol. 56, 570-600 (2011)
Michael N. Schmitt, Classification of Cyber Conflict, J. Confl. & Sec. L. Vol. 17 (2), 245–260 (2012)
Michal Gondek, Extraterritorial Application of the European Convention on Human Rights: Territorial Focus in the Age of Globalization? Nethl. Int’l. L. Rev. 52, 349-387 (2005)
Mathew C. Waxman, Cyber Attacks and the Use of Force: Back to the Future of Article 2(4), 36 Yale J. Int’l L. 421, (2011)
Mary Ellen O’Connell, Cyber Security without Cyber War, J. Confl. & Sec. L. Vol. 17 (2), 187 (2012)
Marina Spinedi, On the Non-Attribution of the Bosnian Serbs’ Conduct to Serbia, J. Int’l Crim. Just., 5, 829-838 (2007)
Marko Milanovic & Tatjana Papic, As Bad As It Gets: The European Court of Human Right’s Behrami and Saramati Decision and General International Law, I.C.L.Q. 58, 267–286 (2009)
Marko Milanovic, State Responsibility for Acts of Non-State Actors: A Comment on Griebel and Plücken, Leiden J. Int’l L. 22 (2), 307-324 (2009)
Marko Milanovic, State Responsibility for Genocide, Eur. J. Int’l L., 17 (3), 553- 604 (2006)
Maarten Den Heijer, Issues of Shared Responsibility before the European Court of Human Rights, Amsterdam Center for International Law Research Paper, Shares Series 4, (January 26, 2012) available at http://www.sharesproject. nl/wp-content/uploads/2012/01/Den-Heijer-Maarten-Issues-of-Shared- Responsibility-before-the-European-Court-of-Human-Rights-ACIL-2012-041. pdf (visited March, 2017)
Kuba Macák, Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors, J. Confl. & Sec. L. Vol. 21 (3), 405-428 (2016)
Kristen E. Boon, New Directions in Responsibility: Assessing the International Law Commission’s Draft Articles on the Responsibility of International Organizations, Yale J. Int’l L. Vol. 37 (Spring, 2011)
Kjetil Mujezinovic Larsen, Attribution of Conduct in Peace Operations: The ‘Ultimate Authority and Control Test’, Eur. J. Int’l L. 19, 509–522 (2008)
Jutta Brunnée, International Legal Accountability through the Lens of the Law of State Responsibility, Netherlands yearbook of International Law, Vol. 36, 3-38. (2005)
Jan Arno Hessbruegge, The Historical Development of the Doctrines of Attribution and Due Diligence in International Law, N.Y.U. J. Int’l L. & Pol. 36, 265-305 (2004)
James Crawford, The System of International Responsibility, in James Crawford; Alain Pellet, Simon Olleson & Kate Parlett (eds.), The Law of International Responsibility, 17-24 (2010)
Gordon A. Christenson, The Doctrine of Attribution in State Responsibility, in Richard. B. Lillich (ed.), International Law of State Responsibility for Injuries to Aliens, 322-360 (1983)
Frank Hoffmeister, Cyprus v. Turkey, Am. J. Int’l L. Vol. 96 (2) (2002)
Frank Hoffmeister, Loizidou v. Turkey Case Report, Am. J. Int’l L. 96 (2), 445- 452. (2002)
Emily Crawford, Unequal before the Law: The Case for the Elimination of the Distinction between International and Non-international Armed Conflicts, Leiden J. Int’l L. 20, 441-465 (2007)
Dermot Groome, Adjudicating Genocide: Is the International Court of Justice Capable of Judging State Criminal Responsibility?, Fordham Int’l L.J. 31 (4), 911-989 (2007)
Davis B. Tyner, Internationalization of War Crimes Prosecutions: Correcting the International Criminal Tribunal for the Former Yugoslavia’s Folly in Tadić, Fla. J. Int’l L. 18, 843-885 (2006)
Daniel Bodansky & John R. Crook, Symposium: The ILC’s State Responsibility Articles: Introduction and Overview, Am. J. Int’l L. 96, 773-787 (2002)
Christopher Leck, International Responsibility in United Nations Peacekeeping Operations: Command and Control Arrangements and the Attribution of Conduct, Melb. J. Int’l L. Vol. 10 (2009)
Christian Tomuschat, The Responsibility of Other Entities: Private Individuals, in James Crawford; Alain Pellet, Simon Olleson & Kate Parlett (eds.), The Law of International Responsibility, 318-329 (2010)
Christine Byron, Blurring of the Boundaries: The Application of International Humanitarian Law by Human Rights Bodies, Va. J. Int’l L. 47, 839-896 (2007)
Claus Kress & Luigi Condorelli, The Rules of Attribution: General Considerations, in James Crawford; Alain Pellet, Simon Olleson & Kate Parlett (eds.), The Law of International Responsibility, 221-235 (2010)
Cedric Ryngaert & Holly Buchanan, Member State Responsibility for the Acts of International Organizations, Utrecht L. Rev.Vol. 7, 131-146 (2011)
Caitlin A. Bell, Reassessing Multiple Attribution: The International Law Commission and the Behrami and Saramati Decisions, N.Y.U. J. Int’l L. & Pol. Vol 45, 501 (2010)
Bernard H. Oxman & Beate Rudolf, Loizidou v. Turkey case report, Am. J. Int’l L. 91 (3), 493-517 (1997)
Aurel Sari, Jurisdiction and International Responsibility in Peace Support Operations: The Behrami and Saramati Cases, HRLR 8:1, 151-170 (2008)
Antonio Cassese, The Nicaragua and Tadić Tests Revisited in Light of the ICJ Judgment on Genocide in Bosnia, EUR. J. INT’L L. 18 (4), 649-668 (2007)
André Nollkaemper & Dov Jacobs, Shared Responsibility in International Law: A Conceptual Framework, Mich. J. Int’l L. 34 (2), 359-438 (2013)
Andre De Hoogh, Articles 4 and 8 of the 2001 ILC Articles on State Responsibility, the Tadić Case and Attribution of Acts of Bosnian Serb Authorities to the Federal Republic of Yugoslavia, Brit. Y.B. Int’l. L. 76, 255-292 (2011)
Alison Elizabeth Chase, Legal Mechanisms of the International Community and the United States Concerning State Sponsorship of Terrorism, Va. J. Int’l L. 45 (Fall), 41-137 (2004)
Alexander Kees, Responsibility of States for Private Actors, in Rudiger Wolfrum (ed.), Max Planck Encyclopedia of Public International Law, 959, 959-964 (2011)
Articles/ Makale Ademola Abass, Proving State Responsibility for Genocide: The ICJ in Bosnia v. Serbia and the International Commission of Inquiry for Darfur, Fordham Int’l L.J., 31 (1), 871-894 (2008)
Rudiger Wolfrum (ed.), Max Planck Encyclopedia of Public International Law, (2011)
Roger Carole Poirier, The Breakup of Yugoslavia and the War in Bosnia (1998)
Richard Holbrooke, To End a War (1998); Amantha Power, A Problem from Hell: America and the Age of Genocide (2002)
Richard. B. Lillich (ed.), International Law of State Responsibility for Injuries to Aliens (1983)
Michael N. Schmitt (ed.), Tallinn Manual International Law Applicable to Cyber Warfare (2013)
Maurizio Ragazzi (ed.), International responsibility Today: Essays in memories of Oscar Schachter, (2005)
Marko Milanovic, Extraterritorial Application of Human Rights Treaties: Law, Principles, and Policy (2011)
James Crawford; Alain Pellet, Simon Olleson & Kate Parlett (eds.), The Law of International Responsibility (2010)
James Crawford, State Responsibility: The General Part (2013)
Ian Brownlie, State Responsibility (System of the Law of Nations) (1983)