By Rebecca Hatt

            Charles Tilly famously said that “war made the state, and the state made war.”^[1] Whatever the limitations of the war-making theory of state formation may be, it articulates an enduring truth: states need resources to exercise sovereignty.^[2] Historically, a state had to be able to extract revenue to raise armies, secure her borders, and govern the territory. In the modern world fiscal capacity is just as essential, but the threats to it are no longer as straightforward. Increasingly threats to the fiscal capacity of a government can come from states, criminal organizations, corporations, individuals, and even AI bots that are not actively controlled by a human, all organized outside of the country’s sovereign space and designed to leverage unwilling host infrastructure around the globe.

International law has not yet adapted to this shift. Traditional frameworks use rules that purport to govern state responsibility and countermeasures by relying heavily on the concepts of identifiable states, identifiable conduct, attribution, and conventional ideas of injury.^[OG1] [3] Cyberattacks quickly frustrate those frameworks by obfuscating actors and actions and ultimately [OG2] producing unique injuries. It is no longer necessary to create physical damage to seriously impair and harm a state. Furthermore, cyberspace allows private actors to mount increasingly sophisticated attacks against civilian and state targets. The ease of moving virtual currency relatively anonymously provides a powerful profit motive that incentivizes top minds to keep improving their black hat skills. [OG3] The ability to route attacks through otherwise unconnected third parties also creates additional opportunities to avoid detection or enforcement actions[OG4] .

These types of issues become particularly severe when cyber operations threaten a state’s fiscal institutions. Because fiscal capacity is an important component and even a prerequisite of effective sovereignty, international law should meaningfully address threats against this capacity and allow for substantial deterrence efforts. The fluidity of cyber threats allows any number of state, non-state, or AI actors [OG5] to cross borders in cyberspace and inflict untold international damage and nonetheless evade traditional attribution rules. This reality increasingly demands that states act collectively to address sophisticated threat actors.

Fiscal Capacity is Key to Sovereignty

A state cannot govern effectively without the ability to raise and deploy resources. Margaret Levi’s work explains the idea that states survive because they extract resources and that in doing so they balance relationships between coercion, legitimacy, compliance, and capacity.^[4] Because successful taxation is one of the defining characteristics of an effective state, fiscal capacity is itself a mechanism and an exercise of sovereignty. Douglas North’s institutional theory further suggests that taxation is a part of the political and economic architecture that structures state authority and shapes economic performance.^[OG6] [5] Strong governments can tax predictably because their citizens trust governmental institutions.^[6] Making credible commitments thus expands fiscal capacity. Michael Mann similarly distinguishes the power of rulers from the “infrastructural power” of state institutions to implement decisions throughout society.^[7] Modern scholars like Besley and Persson have treated fiscal and legal capacity as foundational components of state capacity.^[8] International organizations like the OECD [OG7] increasingly reflect similar ideas, describing financial capacity as central to resilience, emergency response, and governance.^[9] NATO has also incorporated financial resilience and critical infrastructure into its concept of security[OG8] .[10]

            The Montevideo Convention on the Rights and Duties of States defines statehood through assessments of permanent population, defined territory, government, and capacity to enter relations [OG9] with other states .^[OG10] [11] Fiscal capacity does not appear on that list,[OG11]  however, each of those attributes relies on the state’s ability to raise and deploy resources.[12] Without a practical ability to raise, control, and distribute capital, formal sovereignty may persist, but there is minimal capacity to exercise and protect that sovereignty.^[13]

Cyberattacks produce exactly this type of harm without triggering any of the options normally available to a country under attack in accordance with international law. The 2022 ransomware attack against Costa Rica serves as an important example. Multiple institutions and government ministries [OG12] were attacked simultaneously, which impaired tax collection, customs, international trade, healthcare, government administration, and other public services until resolved, and ultimately led to a declaration of national emergency.^[14] Some scholars have called this a “data disaster,” a new category of risk to sovereignty that demonstrates that relying on physical damage in international legal frameworks overlooks [OG13] the most serious modern threats[OG14] .^[15]

The Limitations of Current Countermeasures

If cyber operations can meaningfully impair sovereignty without producing conventional physical destruction, then what does international law permit states to do to combat such measures?

S[OG15] tates have increasingly viewed legal [OG16] countermeasures as a mechanism for enforcing international obligations[OG17] , and this tactic could serve as a possible solution to the problem at hand. International law lacks a centralized mechanism of enforcement authority to resolve every interstate issue and to subsequently compel compliance. Instead the international arena is made up of a relatively loose collection of relationships between nations with varying degrees of formality and organization. This structure, or absence of structure, makes countermeasures [OG18] an effective tool to deter aggression and encourage compliance by allowing an injured state to take limited actions against the state to which the attack has been attributed that would otherwise violate their international obligations. The International Law Commission’s Articles on Responsibility of States for Internationally Wrongful Acts (“ARSIWA”) provide the principal framework and explain that the injured state is limited to countermeasures that are proportionate and designed to induce compliance rather than inflicting punishment.^[16]

This structure makes sense when State A commits a physical wrongful act against State B. Acts in Cyberspace are rarely so straightforward. A ransomware attack may be committed by a criminal organization operating from State A, routed through infrastructure in State C, and directed against government or “too big to fail” private financial institutions in State B. The “home state” of the attackers may support but not control the hackers, knowingly allow them to operate, lack the investigatory or enforcement capacity to address the issue, or have no knowledge of them whatsoever. This makes traditional attribution difficult if not impossible.

Costa Rica is again a good example. The attacks that crippled portions of the government were financially motivated professional operations from a hacker group not technically affiliated with their host state. While this makes attribution impossible under current law, it does little to change the perception that Costa Rica was the victim of another state’s attempt to extract their resources. The absence of a flag does not defray the harm.

Resolving the Ambiguity Around Collective Countermeasures

            In addition to the attribution problem, whether uninjured states are allowed to participate in countermeasures on behalf of another, and to what extent, is not settled law.^[17]

ARSIWA acknowledges that certain obligations are owed to the international community as a whole, particularly regarding serious breaches such as genocide and violations of other erga omnes[OG19]  obligations. In these cases, other countries should be able to invoke responsibility despite the harm being indirect.^[18] However, Article 54 does not address measures taken by states other than the injured state(s).^[19] Conversely, collective retorsions, merely unfriendly acts, are generally uncontroversial. Nevertheless, given the severity of the threat and the prevalence of non-state actors retorsions are unlikely to be a sufficient deterrent.

Cyber threats make resolving this uncertainty around collective countermeasures increasingly important. A smaller or less technologically sophisticated state may lack the capacity to identify and defend against an attacker operating on its networks.^[20] Malicious operations may also pass through third states without their knowledge. In those circumstances, international cooperation can provide technical expertise, intelligence, and resources that the affected state otherwise does not have access to. Under existing sovereignty principles, however, states assisting another state’s territory or networks, and possibly transiting or working in others, must remain vigilant and diligent to ensure compliance with the requirements for consent and their own international obligations.^[21]

            Another ambiguity that must be addressed by international law arises when a state knows that serious malicious cyber activity originates from its territory but is unwilling or unable to address it. What obligations, if any, should the state have to prevent their territory or infrastructure from being used for cyber operations that cause harm abroad? How would this fit with 0 person companies where it becomes possible for an independent AI to be created in State A, and choose to operate without human input from compromised networks in State B, resulting in the ransom of private or public entities in States C, D, and E? The threat actor is functionally international and independent with the possibility to strike indiscriminately and simultaneously wherever and whenever it identifies an exploitable vulnerability. This reality favors collective countermeasures simply because that is the only way to attempt to match the structure of the threat itself. There are not clear borders in cyberspace, and the threat actor is not constrained by the limits of sovereignty. Thus new structural solutions such as collective countermeasures must be contemplated to address the novel form and nature of the opponent.^[22] [OG20] 

Attribution is Only Getting Harder

            Attribution requires tracing an act to a human being and then up to the state they were acting on behalf of. In cases with traceable actors and physical actions it is still often impossible to gather sufficient evidence to show that the state is legally responsible for the person’s actions[OG21] . Layers of autonomous systems become far removed from a person or a state; yet the damage an AI agent can do is no less real. Neatly mapping responsibility will become increasingly impractical as technology continues to evolve.

            The obligations and responsibilities of each state that served as a host, knowingly or unknowingly, during the creation and operation of the AI agent are open and urgent questions. Furthermore, there is a practical imbalance between states with varying levels of expertise and resources in this area. This reality counsels against an overly strict standard and makes it challenging to consistently defend against increasingly sophisticated attacks that may have an international ripple effect.^[23]

[OG22] 

Adapting to the Threat

            Traditional frameworks of international law do not have to be entirely discarded  to deal with the uncertainty in cyberspace. Caution is advisable to avoid mistakes that might escalate tension between states.[OG23]  However, the traditional safeguards can and must evolve to effectively reconcile the realities of modern statehood with the fluidity of the threat. Fiscal institutions are parts of the infrastructure through which modern states exercise sovereignty. Their importance must be acknowledged. When cyber operations threaten fiscal capacity, even if there is no physical damage, there must be a legal and effective method of deterrence under international law. Simultaneously, the multiparty nature of cyber operations makes bilateral countermeasures increasingly impractical.^[24] While the legality of collective countermeasures remains contested, this area of the law demands more attention and a set of rules specific to engagements in cyberspace. Those rules must balance the benefits of collaborative countermeasures and preventative measures with both a state’s right to sovereignty and an individual citizen’s right to privacy during interventions.[OG24] [OG25] 

---

^[1] Charles Tilly, Coercion, Capital and European States, A.D. 990 – 1992 (1992). 

^[2] Id.

^[3] See Gabčíkovo-Nagymaros Project (Hung./Slovk.), Judgment, 1997 I.C.J. 7, 55–57, ¶¶ 82–87 (Sept. 25).

[4] Margaret Levi, Of Rule and Revenue (1989).

^[5] See Douglass C. North, Institutions, Institutional Change and Economic Performance. (James Alt & Douglass North eds., 1990).

^[6] Barry R. Weingast, The Economic Role of Political Institutions: Market-Preserving Federalism and Economic Development,11 J. L. Econ. & Org.1, 1-31 (1995).

^[7] Michael Mann, The Autonomous Power of the State: Its Origins, Mechanisms and Results, 25 Eur. J. Socio. 185, 185-213 (1984).

^[8] Timothy Besley and Torsten Persson, The Origins of State Capacity: Property Rights, Taxation, and Politics, 99 Am. Econ. Rev. 1218, 1218-44(2009).

[9] OECD, Restoring Public Finances (2025).

[10] NATO, 2026 Resilience Baseline Requirements, Baseline Requirement 1, Objective 1(3) (Sept. 15, 2026), https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2026/09/15/2026-resilience-baseline-requirements

[11] Convention on Rights and Duties of States art. 1, Dec. 26, 1933, 49 Stat. 3097, 165 L.N.T.S. 19.

[12] See id.; Besley & Persson, supra note 8, at 1218–19.

^[13] See François Delerue, Cyber Operations and International Law, Cambridge Univ. Press, 2020.

^[14] See Matt Burgess, Conti’s attack against Costa Rica Sparks a new ransomware era, Wired: Security (June 12, 2022, at 07:00), https://www.wired.com/story/costa-rica-ransomware-conti/ [https://perma.cc/JRQ2-86EF].

^[15] See Tomer Simon & Ben Haklai, Data Disaster – A new threat for sovereignty, 125 Int’l J.  Disaster Risk Reduction 1, 1-9 (2025).

^[16] Draft articles on Responsibility of States for Internationally Wrongful Acts, with commentaries (2001), https://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf [https://perma.cc/M7B3-G69J].

^[17] Alexandra Hofer, Third-Party Countermeasures: Making Custom Out of Ambiguous Practice?, 74 Int’l & Compar. L. Q. 287, 287-317 (2025).

^[18] See Martin Dawidowicz, Third-Party Countermeasures in International Law (Cambridge Univ. Press, 2017).

^[19] Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries, arts. 22, 42, 48–54, [2001] 2 Y.B. Int’l L. Comm’n, U.N. Doc. A/56/10.

[20] Samuli Haataja, Cyber Operations and Collective Countermeasures Under International Law, 25 J. Conflict & Sec. L. 33, 33–51 (2020).

^[21] See Miles Jackson & Federica Paddeu, The Countermeasures of Others: When Can States Collaborate in the Taking of Countermeasures?, 118 Am. J. Int’l L. 231 (2024).

^[22] See Michael N. Schmitt,  ‘Below the Threshold’ Cyber Operations: The Countermeasures Response Option and International Law, 54 Va. J. Int‘l L. 698, 698-730 (2015).

[23] See Jeff Kosseff, Collective Countermeasures in Cyberspace, 10 Notre Dame J. Int’l & Comp. L. 18 (2020).

^[24] See Michael N. Schmitt & Sean Watts, Collective Cyber Countermeasures?, 12 Harv. Nat’l Sec. J. 373, 373–411 (2021).