This article is written by Beckswhite Justice Chukwujiukah, University of Jos.
Introduction
On 8 October 2026, the FBI and agencies from six other countries published a joint advisory on hackers linked to Integrity Technology Group, a company based in China. The advisory says the hackers have broken into networks since at least January 2021 and stolen email from government, law enforcement, healthcare and religious organisations in Southeast Asia, while also targeting organisations in Africa and North America. It adds that they run a web application giving third parties access to stolen email. On the same day, the FBI and the Department of Justice announced the seizure of two scanning and phishing tools, Microscan and FishHub. The company was sanctioned by the United States in January 2025 and
by the United Kingdom in December 2025, and it has rejected the accusations.
The legal interest lies in
Who is accused?
The advisory describes a for-profit company with links to the Chinese government, uses a single label for the company and the hackers it enables, and does not say which of them carried out each intrusion. Earlier debate asked whether peacetime spying is lawful. This episode asks a prior question: when a private contractor spies, whose conduct is it in law?
My argument is that the lawfulness of
The intelligence aim must be separated
from the lawfulness of the method. Entering foreign government mailboxes without consent exercises power in another state’s territory and may breach its sovereignty. But a victim state can claim a remedy from another state only if the conduct is attributable to that state. The contractor model operates in that gap. To the African countries whose institutions were mentioned as targets in the advisory, the divide is practical, not theoretical. The paper first establishes the decisions which outline the criteria for attribution before applying them to the advisory case and finally looking at the options available to the victim state.
Case Laws
S.S. ‘Lotus’ (1927) and Corfu Channel (1949): The Sovereignty Baseline
Lotus holds that a state may act as it pleases unless a rule forbids it, but also that, without a permissive rule, a state may not exercise its power in the territory of another state. In Corfu Channel, the United Kingdom swept mines in Albanian waters without consent to secure evidence.
The Court held that this violated Albanian sovereignty and rejected the evidence-gathering purpose as an excuse.
Applied here, copying mailboxes from a government server abroad
is an exercise of power on foreign territory, whatever the intelligence purpose.
France and the African Union treat sovereignty as a binding rule in cyberspace,
while the United Kingdom treats it only as a principle informing other rules.
I prefer the rule-based view, because Corfu Channel found a violation without asking whether Albania had been coerced.
Tallinn Manual 2.0 takes the same view,
treating a cyber operation that infringes territorial sovereignty as a breach even without coercion.
Corfu Channel also carries a second holding: a state must not knowingly
allow its territory to be used for acts contrary to the rights of other states.
That due diligence duty matters later, because it does not depend on proving who directed an operation.
Nicaragua v United States (1986): The Effective Control Test
According to the ILC Articles on State Responsibility, Article 8, the actions of private individuals
can be imputed to the State
if those individuals act upon instruction or under the direction or control of the State. According to the Nicaragua case,
the US was not liable for the acts of the Contras although it financed and armed them,
unless it exercised effective control over the operations where the alleged breaches took place. Funding and general support were not enough. Article 5 offers another route, covering persons or entities empowered by a state’s law to exercise governmental authority. A commercial hacking firm is unlikely to fit unless a state’s law
actually conferred that authority, which the advisory does not allege.
Bosnia v Serbia (2007) and Tadić (1999): Rejecting Overall Control
The ICJ reaffirmed effective control and rejected the looser “overall control” test of the ICTY
Appeals Chamber in Tadić as a basis for state responsibility, since that test stretches responsibility too far.
The practical effect is that a victim must show control over the particular operation,
not merely a close relationship between the state and the actor.
Applying the Tests to the October 2026 Advisory
The advisory shows why this is hard. The agencies describe a company whose employees build tools for use and sale, host infrastructure, and break into networks.
Former FBI Director Christopher Wray said in 2024 that the company’s chairman had
publicly admitted collecting intelligence for Chinese government security agencies. That points to a relationship, but under Nicaragua and Bosnia, a relationship is not control of a specific operation.
The advisory also merges the company and the hackers under one label,
and says the same hackers may do work unrelated to the company.
The portal giving third parties access to stolen mail suggests resale of access,
which cuts against the idea that every operation was directed by a state.
A tribunal applying effective control would probably demand evidence the advisory does not supply.
The advisory is also a statement by government agencies, not a judicial finding,
and much of the underlying proof sits in intelligence files that governments rarely disclose.
An alternative route is the 2015 norm that states should not knowingly allow their
territory to be used for internationally wrongful ICT acts,
which does not depend on proving direction of each operation, although it is voluntary. It echoes the binding due diligence principle recognised in the 1949 judgment.
United States v. Netyksho (2018) and United States v. Su Bin (2016): Domestic Prosecution
The United States has long answered state-linked hacking with indictments. In Netyksho, twelve Russian military intelligence officers were charged over the theft and release of emails in 2016. In Su Bin, a Chinese businessman pleaded guilty to conspiring with hackers in China to take data on military aircraft from American contractors. The October 2026 seizure of seven domains tied to Microscan and FishHub, under a warrant from the Western District of Pennsylvania, follows this pattern, since it disrupts tools and targets a company without asserting a claim against a state. Sanctions on the company are retorsion: unfriendly but lawful, and needing no attribution to a state, so they suit contractor cases. Countermeasures against a state, by contrast, require an internationally wrongful act attributable to it, and must be proportionate and preceded by a call to comply.
Conclusion
The October 2026 advisory shows that the main legal difficulty in modern cyber espionage is often attribution, not the rule being broken. Entering foreign government systems without consent can breach sovereignty, and I have argued for the rule-based reading of sovereignty. But the effective control test, confirmed in Nicaragua and Bosnia, makes a contractor ecosystem hard to attribute to a state. The result is that victims turn to sanctions, indictments and tool seizures, which are lawful but do not hold a state to account.
For Nigeria and other African states, which the advisory says were among the targets, the Common African Position gives a rule-based reading of sovereignty. That does not remove the evidential burden of attribution. Nigeria’s Cybercrimes Act 2015 (as amended 2024) and the Malabo Convention criminalise unauthorised access, but they reach private offenders, not foreign officials or companies abroad.
Until the law adapts, the contractor model gives states a practical form of deniability: the more a state outsources, the less any victim can prove. Three steps would help: states should publish when a commercial hacking firm counts as acting under their direction or control for Article 8; the UN processes on ICT security should clarify due diligence for states that host such firms; and states should share technical evidence so that attribution is not the main obstacle to a remedy.
FAQs
1. What happened on 8 October 2026?
The FBI and agencies from six other countries issued a joint advisory on hackers linked to Integrity Technology Group, and the FBI and Department of Justice announced the seizure of scanning and phishing tools used by the group.
2. Is stealing government email unlawful under international law?
No treaty bans espionage as such, but entering another state’s systems without consent may breach its sovereignty, depending on whether sovereignty is treated as a binding rule.
3. Can China be held responsible for a private company’s hacking?
Only if the conduct is attributable under Article 8 of the ILC Articles, which requires the state’s instructions, direction, or control over the specific operation.
4. What can a victim state lawfully do?
It can impose sanctions or expel diplomats (retorsion), prosecute individuals, and take countermeasures if a wrongful act is attributable to a state.
5. Why does this matter for Nigeria?
The advisory says African organisations were among those targeted. Nigeria’s domestic law criminalises unauthorised access but cannot reach foreign actors abroad, so attribution and diplomacy matter.
