Sovereignty in Fragments: Jurisdiction-Sharded Cyber Operations and the Attribution of Omissions

The law of State responsibility asks whether private conduct is attributable to a State and, separately, whether the State breached an obligation of its own. Cyber discourse frequently confuses the two: failure to suppress an attacker is treated as a weaker substitute for proving that the State directed him. Evelyne Schmid and Ayşe Özge Erceiş have shown why omissions require their own attribution analysis and why due diligence must be treated as a primary obligation whose breach is the State's failure to take required measures, not as a means of laundering private conduct into State action. This paper adopts that insight and applies it to a harder technical fact. A hostile operation may be intentionally divided so that no territorial State sees an intelligible attack. Objective and target identity are held in one jurisdiction; discovery in another; model inference in a third; credentials in a fourth; transient execution in a fifth; funds, command and benefit elsewhere. Each State may secure the fragment within its territory to a reasonable standard and remain unable to infer the whole. It is then untenable to argue that the victim was injured because every host failed to "prevent its citizens" from acting. No host possessed the puzzle which the controller deliberately broke. The paper calls this jurisdiction by design: the purposeful allocation of people, code, data, payments and compute amongst legal territories in order to delay attribution, prevent evidential aggregation, exploit inconsistent thresholds and cause every compulsory process to arrive after the relevant state has expired. Ordinary cloud distribution, privacy engineering and resilience are not wrongful. The relevant indicia are common hostile purpose, task-aware placement, ephemeral retention selected against known procedures, identity fragmentation, subcontracting without operational need and internal reference to deniability or legal dilution. Due diligence should remain relative to knowledge, capacity, risk and reasonableness. A State is not internationally responsible merely because one encrypted inference ran upon a server within it. Duties strengthen after authenticated notice and where public authorities control or knowingly tolerate high-risk infrastructure. The principal duty of correlation should fall upon the State, PMSC or commercial orchestrator which possesses the operation map. Domestic law should require an attribution manifest; international cooperation should permit federated queries and rapid preservation; and intentional fragmentation should support adverse evidential inference against the controller without lowering the international threshold for attribution to an innocent host. The result is stronger than indiscriminate host liability. It places responsibility where visibility was designed, preserves Schmid and Erceiş's analytical distinction, and prevents the architect of opacity from receiving the legal benefit of the opacity he purchased. Publication edition, revised October 2026; not yet peer reviewed.