STATE RESPONSIBILITY IN STATE-SPONSORED CYBER OPERATIONS: THE CASES OF STUXNET AND SOLARWINDS

This paper investigates the evolving framework of state responsibility in state-sponsored cyber operations, focusing on two emblematic cases: Stuxnet and SolarWinds. Through the lens of the Articles on State Responsibility for Internationally Wrongful Acts (ARSIWA), the study evaluates attribution mechanisms for both direct and indirect state involvement in cyberspace. Stuxnet, attributed to U.S. and Israeli state agencies, illustrates a rare instance of direct state attribution under ARSIWA Article 4, meeting the threshold of state organ conduct and possibly constituting a prohibited use of force under Article 2(4) of the UN Charter. In contrast, the SolarWinds attack,linked to Russia’s SVR through non-state actors (APT29), reveals attribution ambiguities under Article 8 and highlights the insufficiency of existing legal thresholds in indirect cyber involvement. The analysis emphasizes the normative and practical limitations of the Tallinn Manual 2.0 in addressing covert and hybrid cyber threats. The paper also explores the constraints of individual complaint mechanisms, including the ECtHR’s limited jurisdiction post-Zakharov v. Russia and the evidentiary burdens under Article 8 of the ECHR. At the international criminal level, it assesses the potential of qualifying cyberattacks as crimes against humanity under the Rome Statute and examines their intersection with international humanitarian law through attacks on Ukrainian civilian infrastructure. Finally, the study advocates for a multi-stakeholder governance model that redefines corporate accountability and empowers civil society actors. It evaluates initiatives such as Microsoft's "Digital Peace" proposal, cloud provider ethics, Citizen Lab’s forensic methodologies, and OSINTbased documentation practices. The conclusion calls for binding international norms that incorporate digital neutrality, enforce due diligence obligations for private actors, and integrate human rights protections into cyber governance to close accountability gaps in the digital battlefield.