Ukraine Symposium – State Responsibility for Non-State Actors’ Conduct

The conflict in Ukraine is international in character, but it nevertheless involves numerous private individuals and groups. These include Ukrainian civilians acting to protect their homeland, foreign fighters, military contractors, and private hackers conducting operations in cyberspace.

Some of these non-State actors may have acted in a way that violates the law of armed conflict (LOAC). For instance, reporting indicates that members of the Wagner Group played a leading role in the killing of civilians at Bucha. Other reports suggest that the group caused the explosion that killed at least fifty Ukrainian prisoners of war in late July 2022.

Alternatively, consider the actions of Ukraine’s “IT Army” in launching offensive cyber operations against Russian websites. Individual hackers may have acted in a way that violated LOAC by targeting Russian civilian infrastructure such as banks and retailers. These operations could amount to unlawful attacks against civilian objects if they are reasonably expected to cause injury or damage, or they might otherwise breach the duty to take constant care to protect civilians and civilian objects.

Other posts in this symposium have addressed the legal status of the non-State actors engaged in the Ukraine conflict. This post considers their involvement in the hostilities from a different perspective, namely whether their conduct in potential breach of LOAC is attributable to Russia or Ukraine.

The Issue of Attribution

When a private individual or group acts in a way that violates LOAC and the relevant conduct is attributable to a State, that State bears international responsibility for the breach. Certain consequences then follow under the law of State responsibility. These include an obligation on the responsible State to cease its harmful conduct and to make reparation for any damage or injury caused.

For a State to bear international responsibility, two criteria must be satisfied. First, the conduct must breach an international obligation that is binding on the State. Second, the conduct must be attributable to that State. To determine whether Russia bears international responsibility for the Wagner Group’s harmful conduct, therefore, it is necessary to assess each incident of concern to establish whether these two conditions are met. Regarding the explosion at the prison camp, for instance, there is little doubt that intentionally causing the deaths of prisoners of war violates the LOAC protections afforded to such individuals under the Third Geneva Convention. So, the more difficult question relates to attribution. Assuming that it can be established as a matter of fact that members of the Wagner Group caused the explosion, when would the law of State responsibility attribute such conduct to Russia?

Similarly, if members of Ukraine’s “IT Army” violated LOAC by conducting harmful cyber operations against the Moscow Stock Exchange, for example, when is such conduct attributable to Ukraine?

Organs of State

The first question to ask when addressing the issue of attribution is whether the individuals concerned are integrated into the State under the terms of the State’s domestic laws (Article 4 of the International Law Commission’s Articles on State Responsibility (ASR)). A State’s armed forces fall within this category, meaning that if soldiers, sailors, or airmen act in a way that violates LOAC, their conduct is always attributable to the State. This is the case even if the individual concerned acts in disobedience to orders (Article 7 ASR). It is clear, therefore, that Russia bears international responsibility for the many LOAC violations committed by its armed forces in Ukraine.

The State organ categorization extends further than a State’s conventional forces. Many Ukrainian citizens joined the Territorial Defence Force, which is a branch of Ukraine’s armed forces under Ukrainian domestic law. Members of this organisation, therefore, are State organs of Ukraine, meaning that all their conduct performed in an official capacity is attributable to the State. The same is true of foreign nationals who travelled to Ukraine to fight as part of the “international legion.” Cyber operators who are integrated into the State also meet this classification, such as members of Russia’s military intelligence. In each case, the position on attribution is clear. The conduct of members of these groups is attributable to the State to which they belong. If they violate LOAC when performing their official functions, their actions engage the State’s responsibility.

The respective States’ domestic laws, however, do not designate all the individuals participating in the conflict as organs of State. It is likely that some of the Ukrainian citizens acting to protect their homeland did not join the Territorial Defence Force. Many of the cyber operators acting on behalf of Russia or Ukraine do not fall into this category. And Russian law does not categorize members of the Wagner Group as State organs.

Nevertheless, it is possible that these individuals and groups could qualify as State organs due to their factual relationship with the State, rather than their status under domestic law. The International Court of Justice (ICJ) affirmed this de facto State organ status in its Paramilitary Activities (para 109-112) and Bosnian Genocide (para 391-94) judgments. But the test the ICJ formulated is stringent. An entity qualifies as a de facto State organ only if it exhibits “complete dependence” on the relevant State, and that State exerts “strict control” over the entity’s entire range of activities. In other words, the entity must act with no real autonomy of its own and rely wholly on the State in all its areas of activity.

It is challenging from an evidential perspective to prove that these demanding thresholds are met. Regarding the Wagner Group, for example, it may prove difficult to satisfy these tests in view of the funding the group receives from foreign governments, the role private oligarchs play in managing the group’s contracts and recruiting, and the degree of impunity with which its members appear to act.

Delegation of Public Functions

If an individual or group does not qualify as a State organ, the second enquiry when addressing the issue of attribution is whether the entity concerned was legally empowered to perform public functions on the State’s behalf (Article 5 ASR). This requires an assessment, first, whether the entity was performing public functions at the relevant time and second, whether the State delegated those functions to the entity in accordance with its domestic laws.

On the first question, the combat functions performed by the Wagner Group and by the Ukrainian citizens acting to defend their homeland are clearly public in character. Fighting on behalf of a State is an inherently governmental act. Cyber operations linked to the conflict may also qualify as public acts due to their close nexus to the hostilities. For instance, hackers linked to Moscow conducted hostile cyber operations against the satellite company, Viasat, timed to coincide with Russia’s military invasion. However, the status of other cyber operations, with weaker links to a State’s kinetic activities, is less clear.

Assuming the acts concerned can be classified as public rather than private, it is next necessary to assess the steps the relevant State may have taken to authorize the private entity to perform such functions on its behalf. In its extensive work on the law of State responsibility, the International Law Commission concluded that attribution on this basis is appropriate only if the State empowers the entity to act in a manner that accords with its domestic laws. Thus, the State must either enact legislation, or delegate its governmental functions to the entity through another means that complies with its domestic law, such as via contract.

As I have written previously, this “empowerment by law” requirement is a key limiting factor that reduces the rule’s effectiveness in holding States to account. When States empower individuals or groups to perform public functions on their behalf, they frequently do so via informal means, rather than via their internal laws. For example, States’ relationships with non-State actors operating in the cyber domain are rarely formalized in law. Thus, although a Ukrainian government minister announced the creation of the “IT Army,” the precise links between the organization and the Ukrainian government remain unclear, including whether the group is properly empowered to act on the State’s behalf in accordance with Ukraine’s domestic law.

The same issue hinders the attribution of the Wagner Group’s conduct in violation of LOAC to Russia. Far from receiving legal authorization to act, private military companies remain illegal under Russia’s domestic law. This means that even if Wagner Group fighters are clearly performing public functions on Russia’s behalf and their conduct is endorsed by the State, in the absence of legal empowerment this rule of attribution does not apply.

Instructions, Direction, or Control

In the event that an entity does not qualify as an organ of State and it is not empowered by law to perform public functions on a State’s behalf, its conduct could nevertheless be attributable to a State if it acts under that State’s instructions, direction, or control (Article 8 ASR). This rule of attribution focuses on the State’s influence over the specific operation during which the potential international law violations occur, rather than the wider relationship between the entity and the State.

The rule’s narrow focus is replicated in its effects, as it attributes to the State only those acts that are performed under the State’s instructions, direction, or control. Any unauthorized conduct that is not directly influenced by the State remains private in character and does not lead to State responsibility. In other words, if the non-State actor contravenes the State’s instructions or otherwise acts in a way that goes beyond the mission it is performing for the State, the rule of attribution does not apply.

The instructions element of the rule is relatively clear. If a State instructs a private entity to perform an act that violates the State’s international legal obligations, that act is attributable to the State. To illustrate, consider the actions of Ukraine’s “IT Army.” Reporting indicates that members of the group receive “clear online instructions” explaining key targets and offering software they should use for a coordinated strike. If State officials provide those instructions and they command the group to launch harmful attacks against civilian targets, the group’s actions when following the instructions, in potential violation of LOAC, are attributable to Ukraine.

The direction and control elements of the rule are more ambiguous. These are commonly considered together but international courts and tribunals have reached divergent views regarding their meaning. On one view, the test for determining attribution is identical to the test for deciding when a conflict is internationalized through a State’s support to a non-State actor. This overall control test (para 116-145) applies only to hierarchically organized groups and looks to the level of support the State provides to the entity as well as the State’s involvement in the coordination and planning of its activities. The test is relatively loose and includes no requirement for the State to plan or direct the particular private conduct that violates its international legal obligations. Given the significant links between Russia and the Wagner Group, therefore, this test could lead to the attribution of the group’s harmful conduct in Ukraine to Russia.

There is, however, a more authoritative test for the purposes of determining attribution. In its Bosnian Genocide judgment (para 396-406), the ICJ rejected the overall control test and reaffirmed the test of effective control it had previously articulated in Paramilitary Activities (para 115). This is a much stricter test, which requires the State to exercise a detailed or tactical level of control over the specific acts that violate international law.

Given its specificity, the effective control test must be applied to non-State actors’ conduct on a case-by-case basis to determine whether State officials exerted the requisite level of control over the individuals’ activities at the time they committed the potential LOAC violations. This requirement creates significant evidential hurdles for injured States that have suffered harm due to a non-State actor’s conduct. Often, the precise State involvement in an activity remains unclear. Thus, even if Ukraine has intelligence to indicate that members of the Wagner Group were “working closely” with Russian intelligence agencies when they destroyed the building housing prisoners of war, Ukraine might find it difficult to prove that Russian officials exercised a detailed level of control over Wagner Group fighters at the time the operation occurred.

Other Rules of Attribution

In addition to the rules of attribution previously discussed, there are three other grounds on which private conduct could be attributed to a State. These, however, have a limited scope of application and are unlikely to apply to the conduct of private actors operating in Ukraine.

The first relates to conduct carried out in “the absence or default” of the official authorities (Article 9 ASR). It applies to the actions of individuals who step in to perform public functions when the official authorities cannot do so due to an armed conflict or other emergency. For instance, if Ukrainian citizens used their hunting rifles to fight against the invading Russian forces and fired expanding bullets, which are commonly used as hunting ammunition but widely prohibited in armed conflict, the rule could attribute this conduct in potential violation of LOAC to Ukraine. It would only do so, however, if all the rule’s requirements are satisfied, including a finding that the individuals’ actions were “called for” in the circumstances. In essence, this means that the private conduct must have been necessary in the circumstances, to fulfil an essential public function that would otherwise not be performed due to the absence of the official authorities.

The second rule of attribution is not relevant to the conflict in Ukraine. This relates to the conduct of successful insurrectional movements and applies when a rebel group takes power and becomes the State (Article 10 ASR). It might have been applicable, therefore, had rebels in the Donbas succeeded in establishing a new State in part of Ukraine’s territory.

Finally, the third rule applies when a State “acknowledges and adopts” private conduct as its own (Article 11 ASR). To illustrate, if a Ukrainian official made a clear statement endorsing and accepting responsibility for a harmful cyber operation launched by members of the “IT Army,” the rule might attribute that conduct to Ukraine. In practice, however, it is rare for States to assume responsibility for private actors’ conduct. Indeed, one of the reasons States choose to act so frequently via proxy is to benefit from the ambiguity and plausible deniability that it offers.

Conclusion

This post outlined the six different grounds on which private conduct can be attributed to a State, thereby leading to State responsibility. All but one of these rules could apply to the conflict in Ukraine. But in reality, if the entity concerned is not designated as a State organ under the terms of the State’s domestic law, attribution is often a challenge. This is due, in part, to the strict interpretation of the rules of attribution by the ICJ and by the International Law Commission. The very high attribution thresholds raise severe evidential difficulties for injured States. Moreover, they fail to reflect the realities of States’ interactions with private individuals and groups in contemporary conflict.

***

Jenny Maddocks is an Assistant Professor in the Department of Law at the United States Military Academy, West Point.

Photo credit: Unsplash