By: Dr. Alaa Aridi, Associate Professor at Vilnius University
The ongoing armed conflict in Ukraine and rise of hybrid incidents across Europe have revived fears of a larger war in which NATO and Russia would confront each other directly. Nothing we are seeing now fully excludes this scenario, especially given the increase in operations on NATO’s eastern flank and Arctic region, where the border with Russia is vast. Alongside this, we have all heard of the hybrid threats that circulate among officials, military circles and the media. When Frank Hoffman introduced the term, he first considered calling it multi-dimensional warfare before settling on “hybrid warfare.” His focus was the 2006 war between Israel and Hezbollah in southern Lebanon. Much has changed since then. The annexation of Crimea brought the term back into focus, this time for operations that remain below the threshold of an armed attack, conducted by actors well aware of the consequences of state responsibility for wrongful acts and of any overt act that would violate Article 2(4) of the UN Charter. What concerns us most is what states and non-state actors rely on when using hybrid threats, primarily, the plausible deniability of their actions. This deniability has found great refuge in new technologies such as cyberattacks, proxy warfare and, most importantly, in lawfare, or the use or misuse of law as a weapon.
So why is plausible deniability crucial? Simply because of attribution, which is required for a state to be held responsible for actions that harm the interests of other states, if the act is attributable to a state under international law, and constitutes a breach of an international obligation, according to Articles on State responsibility for wrongful acts (ARSIWA) 2001. This is what most states struggle with: how to attribute an attack directly to a state or entity when the attack was designed from the start not to be attributed. Many instances over the last decade have made lack of attribution a central issue. Examples include the massive wave of DDoS attacks against Estonia in 2007; the role of the little green men in the annexation of Crimea; the sabotage of undersea cables in the Baltic Sea; and the weather balloons launched from Belarus into Lithuania. The drone rigged with a detonator and explosive material at Leipzig/Halle Airport is another key case that has brought the issue of attribution to light.
Finnish President Stubb argued that Western governments must not hesitate to formally name and shame Russia for its grey-zone operations. He strongly praised Germany’s public attribution of the attempted drone attack at Leipzig Airport to Russia, citing it as the right blueprint for countering covert operations. This is what we call political attribution. It is usually easier to announce than legal attribution, which is currently constrained by the “effective control” test of the ICJ in Nicaragua case, and the “overall control” test of the ICTY in Tadić. In a recent interview, Stubb indicated that attributing hybrid attacks in order to hold a state legally responsible is difficult, because it raises the question of where the limit of attribution lies: what is the level of attribution or percentage of certainty?
Legal attribution in the era of hybrid warfare is not easy. The effective control test introduced by the ICJ in Nicaragua set a high threshold: a state must prove that the sponsoring state directed or enforced the specific operations carried out by non-state actors. Proving that those actors were trained, funded or otherwise supported is not enough on their own. In the cyber context this is even harder, because hybrid adversaries mask the identity of the actors. Even when an attack can be technically traced, it remains difficult to determine who issued the orders or supported these activities. And that highlights too the technical attribution.
Stubb’s concern is therefore legitimate: how much proof is enough to establish attribution? Do we require the three types of attributions “technical, political and legal” to overlap so we have higher success in attributing such actions?
And what about principle of due diligence, can it be a remedy to tackle the plausible deniability of hybrid threats, if we consider constructive knowledge is enough to legally attribute wrongful actions?
Many of these questions are not new, but their answers lie in legal loopholes, the very grey zone in which hybrid threats flourish.
Deniability as design:
As explained above, deniability is how states avoid responsibility for internationally wrongful acts under the rules codified in the ARSIWA. These rules codified customary international law and are widely regarded as authoritative in delineating the principles governing internationally wrongful acts and their attribution to states. The prohibition of the threat or use of force between states in Article 2(4) of the UN Charter, widely regarded as a peremptory norm (jus cogens), has limited states’ ability to conduct overt operations or wage war by conventional means. Russia’s shadow fleet is a clear example of this. A collection of up to 1,000 aging vessels with opaque ownership structures, it sails under flags of convenience to export sanctioned Russian goods, particularly oil. Since October 2023, the fleet has been linked to at least eleven cable disruptions in the Baltic Sea. When sabotage is carried out by commercial or civilian vessels, proving intent and state responsibility becomes much harder. This was reflected in the well-known Eagle S case. The Helsinki District Court ruled that it lacked jurisdiction and that Finnish criminal law could not be applied. The Helsinki Court of Appeal later overturned that judgment, holding that the alleged crimes were committed in Finland because the damage and its effects on the country’s power and telecommunications supply occurred there. The case shows the layers that complicate attribution: a flag of convenience, hidden ownership, a crew of third-country nationals and an “accidental” anchor. Each layer makes plausible deniability a successful tactic.
Hybrid threats rely on tactics and means that remain below the threshold of direct confrontation or armed attack. This allows them to operate in a legal grey zone under the law on the use of force. That law permits states to use force under only two narrow exceptions: in self-defense against an armed attack under Article 51 of the UN Charter, or with the authorization of the UN Security Council under Chapter VII to maintain or restore international peace and security. States targeted by an accumulation of lower-threshold operations, carried out through different means, may therefore be unable to respond with force.
Similarly, the lack of attribution challenges the applicability of the international humanitarian law (Jus In Bello) that applies only during armed conflicts. For example, the classification of an armed conflict between a state A that controls a proxy and a state B fighting against that proxy will depend on the degree of control that state A has over its proxy. For an armed conflict involving proxy actors to be classified as an international armed conflict (IAC), the proxies must be under the overall control of a foreign state, as the ICTY held in Tadić. Only then does the law of IAC apply, as triggered by Common Article 2 of the Geneva Conventions, and Additional Protocol I. For example, the conflict to qualify as an international armed conflict between states A and B, the proxy’s acts must be legally attributable to state A. That does not mean they are left in a legal vacuum. The principles of international law are clear: even operations that do not reach the level of an armed attack equivalent to a kinetic one may still breach international law by violating the principle of non-intervention or the territorial sovereignty and integrity of the victim state. However, the law requires these acts to be clearly attributed before a state can be held responsible. This brings us to the three different types of attribution.
Technical attribution:
In simple terms, technical attribution is the forensic and intelligence work that tries to answer the question “who did it, and how they did it?”. In the case of a cyberattack, it is the process of assigning technical responsibility for the incident. Investigators examine the tactics, techniques and procedures (TTPs) used by the attackers and, on that basis, deduce where the incident came from.
The same logic applies to physical hybrid operations. In the Leipzig case, investigators relied on the drone’s components, its triggering mechanism and DNA traces, rather than on code. Lithuanian police investigators found that its highly specific design, including identical stamped indentations made by the exact same machine, matched hidden explosive caches recovered by police in Lithuania between 2024 and 2025. Technical attribution based on digital fingerprints, such as IP addresses, malware signatures or coding styles, remains very important, and states are investing heavily in cybersecurity not only to intercept attacks but also to trace them back and identify who is behind them. However, hybrid adversaries tend either to hire proxy actors to conduct these operations or to use multiple spoofing techniques to mask the origin of an attack. This can lead to misattribution or a response to a false flag. In that case, the state that was initially the victim may itself become the aggressor, by responding against a state that was not behind the attack. Therefore, technical attribution, even if successful, is not enough alone to provide confidence for state to attribute the wrongful acts legally. It serves as the evidentiary substrate upon which legal and political assessments are often constructed but does not itself establish legal responsibility.
Political attribution:
Political attribution, on the other hand, is when a state publicly declares that another state or actor is behind an operation or attack. It is a political decision that, in many instances, comes before technical attribution is complete and, of course, before legal attribution. Political attribution is a tool used by states’ officials to highlight that they consider the attributed activity inappropriate, deter similar activities in the future, and raise awareness about threats. For example, in the Leipzig case, Germany publicly attributed the attack to Russia and declared that Germany will be severed consequences for the incident and that the federal government is making the perpetrators of hybrid attacks pay a price. Yet Germany waited weeks before declaring the political attribution and clearly stated that political attribution differs from a judicial determination Legal attribution, that is being investigated. Therefore, political attribution is necessary but not sufficient, it can publicly name the potential aggressor, but only legal attribution can hold the aggressor responsibility under international law.
Legal attribution:
According to ARSIWA, a violation of a rule of international law which constitutes internationally wrongful act, must be attributed to a state or a group of identified individuals operating on behalf or under the direction of a state. While hybrid adversaries tend to rely on covert and indirect means through the use of asymmetrical warfare and cyber means, that leads to legal gray zone and potential misattribution or what is so called “false flag.” The two control tests introduced by ICJ “Effective control test” requiring proof of direct control by the state over specific operations that includes detailed instructions or guidance for the act, and the ICTY “overall control test” that lowered the threshold by allowing attribution when a state exerts general control including financing, training and planning the activities, shows that there is no unified regulatory mechanism that applies to current threats. The uncertainty between the two tests in the era of threats formed to protect the identity of the perpetrator, is the core issue in President Stubb question, what is enough to prove attribution?
Due diligence:
This concept, widely established and still developing in international law, refers to a state’s obligation to take all reasonable measures to prevent harm originating from its territory, or from entities under its control, that directly affects the territory or interests of other states. The concept is widely accepted in international environmental law and is developing under international humanitarian law (IHL). The International Tribunal for the Law of the Sea (ITLOS), in its advisory opinion, also stated that the United Nations Convention on the Law of the Sea (UNCLOS) obliges the flag state to take the steps necessary to ensure that every vessel flying its flag is not involved in illegal activities. The International Law Commission (ILC, 2001) clarified how due diligence works as a legal standard. This is what makes the concept a potential remedy for the plausible deniability and lack of clear attribution that hybrid threats create.
Following the 2007 cyberattacks on Estonia and the development of the Tallinn Manuals on the international law applicable to cyber operations, it was clearly identified that states have a duty of due diligence: they must take appropriate measures to prevent cyber operations originating from their territory when these operations can cause serious harm to other states.
Yet the main issue remains the question: what level of knowledge is needed to trigger this obligation? The 2015 UN GGE report on cybersecurity defined the harm involved as including both physical and non-physical effects, but it set no clear threshold of knowledge. In such instances, knowledge is divided into actual knowledge, meaning direct awareness of the harmful activity, and constructive knowledge, meaning the information was available and accessible, so the state should have known. Therefore, due diligence is achieved and does not incur responsibility on a state just because it failed in preventing a specific event, but if a state failed to take all measures needed, which were within its power, to prevent the event from occurring.
Proving actual knowledge is a real challenge in the context of hybrid threats, which rely on deniability and masked operations, especially since the burden of proof falls on the victim state. This holds even though due diligence focuses on responsibility for inaction rather than responsibility for the wrongful act itself. For this reason, the concept of constructive knowledge of harmful activity has developed. For example, in the Corfu Channel case, the ICJ accepted that a state’s knowledge could be inferred from circumstantial evidence. Similarly, the Tallinn Manual 2.0 affirmed through majority of experts that due diligence applies where states knew, or should have known, of cyber operations causing serious adverse consequences.
In practice, if a cyberattack was launched from a government office, the territorial state may be held responsible even if it had no actual knowledge: constructive knowledge, that the state should have known what was happening on its own infrastructure, may be enough to establish a breach of its due diligence obligation. The situation could differ if the same attack was launched from a residential building, where it would be much harder to argue that the state should have known.
From this brief opinion, we can conclude that attribution is the central issue in today’s hybrid threats, and the source of the so-called legal grey zone. Political and technical attribution are each valuable on their own, but neither is sufficient to establish legal responsibility.
It should be noted that due diligence raises its own legal and ethical considerations, linked to human rights, state sovereignty and the risk of false flags. These, however, fall outside the scope of this brief opinion.
Conclusion
Given the difficulty of producing clear evidence of state responsibility for wrongful acts under the current effective control and overall control tests, due diligence based on constructive knowledge can remedy this lack of attribution. It allows states to be held responsible for failing to prevent harm they should have known about. This route still requires technical and political attribution. Taken together, these three elements, with constructive knowledge as the legal remedy, can be sufficient in such instances. The answer to President Stubb’s question, therefore, is not how much proof is enough, but how the interplay of these three elements can together be sufficient to hold a state legally responsible under international law.
Sources:
- Corfu Channel Case (United Kingdom v Albania) [1949] ICJ Rep 4.
- Military and Paramilitary Activities in and against Nicaragua (Nicaragua v United States of America) (Merits) [1986] ICJ Rep 14.
- Prosecutor v Duško Tadić (Judgment) IT-94-1-A (15 July 1999).
- Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro) (Judgment) [2007] ICJ Rep 43.
- Helsinki District Court, Judgment in the Eagle S case (3 October 2025).
- Helsinki Court of Appeal, Decision in the Eagle S case, R 16/2025 (27 August 2026).
- International Law Commission, Draft Articles on Responsibility of States for Internationally Wrongful Acts, with commentaries (12 December 2001) UN Doc A/RES/56/83.
- UNGA, Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security’ (22 July 2015) UN Doc A/70/174.
- Michael N Schmitt (ed), Tallinn Manual 2.0 on International Law Applicable to Cyber Operations, CUP 2017.
- Al-Aridi, A. (2019) “Legal Complexities of Hybrid Threats in the Arctic Region”, Teisė, 112, pp. 107–123.
- Alaa Al Dakour Al Aridi, ‘The Problem of Hybrid War in International Law’ (PhD thesis, Vilnius University, 2023. )
