Non-state actors, ungoverned spaces and international responsibility for cyber acts

This article examines the question of whether states can be held responsible for the malicious cyber activities of non-state actors operating from ungoverned spaces. After examining relevant rules of the law of state responsibility, it concludes that there is a responsibility deficit. For this reason, it puts forward a proposal for holding non-state actors that exercise effective power over territories and people directly responsible for their malicious cyber activities. In this respect, it considers the scope of their obligations, issues of attribution as well as issues concerning the implementation of their responsibility. It however acknowledges that many non-state actors including ‘virtual’ groups still remain outside legal regulation.