[THESIS DEFENSE] Coline Boniface - "The attribution of cyber attacks: a sovereign state power?"

The emergence of a new "cyber ecosystem" based on the principles of dematerialisation, anonymity, ubiquitous access and instantaneous communications has made it more difficult to apply certain principles of international law, which are usually used to guarantee security in the physical world. However, it is essential to observe these principles in cyberspace, which has also become, in the words of Guillaume Poupard, a "geopolitical space where war is waged". It is a place where states compare and contrast with each other, and engage in discrete, invisible conflicts whose effects are felt in the physical world. Although the term "cyber war" is not universally accepted today, the threat is very real and is reflected in the media reports of large-scale computer attacks capable of impacting strategic sectors. These attacks may be carried out by state or non-state actors, but they may be state-controlled or in response to state objectives. To put an end to the malicious act it has suffered, the State must engage the international responsibility of the State that committed the illicit act by referring to the customary law of international responsibility. While its application to cyberspace has been established since 2015 by the work of the Group of Governmental Experts on Developments in Telecommunications, we are now seeking to determine the modalities of this application. The specific characteristics of cyberspace seem to limit the sovereignty of States in this area.
This raises technical issues relating to the examination of elements derived from the analysis of networks and infected machines, as well as those derived from human intelligence work. For some years now, this expertise has mainly been in the hands of private actors who are developing investigative skills, as evidenced by reports from computer security firms. States, for their part, are seeking to use the process for strategic and political ends, and are publicly naming the person responsible, but are not taking the path of international law.