B. Difficulties in Establishing State Responsibility for Cyber-Attacks

While the application of international law to cyberspace was the object of some controversies in the past,Footnote ²⁰ it is now undisputed that the principles of sovereignty, non-intervention, the prohibition on the use of force and other general rules of international law apply to states’ cyber activities as they do in the analogical world.Footnote ²¹ Yet, it is still far from clear how traditional principles of international law need to be transposed in the cyber domain.Footnote ²² In truth, there seems to be a general trend among States to refrain from establishing rigid legal frameworks in the area of cyber operations, also in light of the fast technological development.Footnote ²³ Many States have chosen to adopt a policy of silence and ambiguity about how international law applies in cyberspace.Footnote ²⁴ As stated by former US Department of State Legal Advisor Brian Egan, the international community is currently faced “with a relative vacuum of public State practice.”Footnote ²⁵ This uncertainty pertains both to the very qualification of malicious cyber operations as breaches of international law (i.e. to whether any primary norm is actually breached), but also to the difficult exercise of attributing cyber-attacks to a specific State actor (i.e. whether the conduct can be imputed to a specific subject of international law).Footnote ²⁶

Starting with the first issue, not all malicious cyber activities – including those defined as cyber-attacks under Decision 2019/797 - constitute breaches of international law. There are different categories of cyber activities that could be defined as “malicious”, including cyber crime or cyber espionage. Cyber-crime, for instance, does not call necessarily into question the international responsibility of States because it is a form of crime that may be carried out by non-state entities. The most important multilateral Treaty in this area is the Council of Europe “Budapest Convention” of 2001,Footnote ²⁷ which has 66 Parties, including 26 EU Member States.Footnote ²⁸ This Treaty imposes on its Parties obligations to criminalize a wide range of conducts.Footnote ²⁹

Cyber espionage, however, involves cyber activities that are carried out with the objective of obtaining information. It is a form of cyber-crime because it amounts to an illegal access to a computer system. Some of the activities against which the EU has imposed restrictive measures might fall under this category. The Tallin Manual 2.0 defines cyber espionage as “an act undertaken clandestinely or under false pretences that uses cyber capabilities to gather (or attempt to gather) information with the intention of communicating it to the opposing party.”Footnote ³⁰ However, many experts contend that there is no prohibition in international law on espionage per se,Footnote ³¹ and on cyber espionage in particular. The experts working on the Tallin Manual 2.0, for instance, could not reach a consensus as to whether remote cyber espionage violated international law. While the majority believed that the exfiltration of data violated no rule of international law, a few believed that at some point the data breach might be so severe as to make it illegal.Footnote ³² Similarly, the experts did not agree on the legality of close-access operations, such as operations where an individual in the territory of the target state inserts a USB drive into a government system to steal or alter data. Clearly, there is a lack of a shared understanding among States on what is allowed and what is proscribed in the cyber domain. This makes the determination of an objective breach of international law a rather complex task.

Turning now to the issue of attribution, one of the biggest challenges for a State that finds itself a victim of a hostile cyber operation is ascertaining who was behind it. Even if a certain cyber-attack is considered to represent a breach of state sovereignty, without clearly identifying who is responsible for the hostile cyber activity it is difficult to take any targeted action in response. The problem of attribution in the context of cyber activities has generated a great deal of discussion among scholars.Footnote ³³ The Tallin Manual 2.0 addresses the issue by echoing Articles 4 and 5 of the Articles of State Responsibility,Footnote ³⁴ accordingly to which cyber operations conducted by state organs are generally attributable to the state. Even though this approach reflects international law in non-cyber situations, its application to cyber activities is not without controversy. For example, the experts noted that traditionally the use of government assets such as tanks or warships was a near irrefutable indication that such activity should be attributed to a that state. The same cannot be said of cyber activities. Indeed, given the ability to capture or spoof cyber infrastructure, including where the cyber activities might originate from, “the mere fact that a cyber operation has been launched or otherwise originates from governmental cyber infrastructure, or that malware used against hacked cyber infrastructure is designed to “report back” to another State’s governmental cyber infrastructure, is usually insufficient evidence for attributing the operation to that State.”Footnote ³⁵ Moreover, even if the actual material source of a specific cyber activity has been ascertained, “identifying the persons, organizations, or states that are legally responsible for the cyber-attack remains challenging.”Footnote ³⁶ As some scholars claim, “although legal attribution relies on forensic evidence produced by technical attribution in order to make determinations and justify legal action in the form of indictments, sanctions or countermeasures, forensic evidence needs to be interpreted and assessed according to legal criteria.”Footnote ³⁷ In other words, the technical attribution is a precondition for the legal attribution to an individual state organ but is not sufficient in itself to legally ascribe the conduct to a given State.

The challenge, however, is not simply with the law. As with other forms of hostile activity, there are technical, political and diplomatic considerations in publicly attributing hostile cyber activity to a State, in addition to whether the legal test is met. Such political considerations concern the question of whether to attribute and when; whether attribution will be public or private; and what will be attributed and to whom.Footnote ³⁸ This predominantly political process may lead to action “such as diplomatic demarches, public denunciations or restrictive measures,”Footnote ³⁹ but leaves open the question of the exact legal responsibility originating from the cyber-attack. As will be shown, the complexity of the legal and political issues involved has even more important ramifications when an attribution process needs to be conducted within a supranational organization such as the EU.

C. The EU’s Reluctance to Rely on State Responsibility in the Context of the Cyber Restrictive Measures

It is submitted that the existence of evidentiary and legal hurdles in the process of attribution contributes to explain the absence of an explicit reference to third countries in the list of addresses of cyber sanctions as well as the clause in Recital n. 9. The EU is free to target the authors of the attack (natural persons or other non-state entities) on the basis of the technical attribution.Footnote ⁴⁰ In contrast, the right to trigger the rules on the responsibility of the State is reserved to individual Member States. The implicit reference is to the State(s) whose territory/ies has or have been affected by a cyber-attack. In some cases EU members have the capacity to attribute a cyber-attack to a certain third country. Yet, not all EU Members may have the necessary capability to do so.Footnote ⁴¹ In case one EU member is not affected by the cyber-attack and does not have the capacity to verify the forensic evidence provided by the State target of the attack, it may refrain from triggering state responsibility.Footnote ⁴² This is because there may be a lack of trust between the European national authorities if only some of them have the capacity to identify the authors of a cyber-attack. Probably, it is because of this situation and of intelligence activities gaps that the EU Council opted to specify that the EU does not attribute the cyber activity to a state and left the decision to trigger state responsibility to each Member state. In the Draft Council Conclusions on a Framework for a Joint EU Diplomatic Response to Malicious Cyber Activities (Cyber Diplomacy Toolbox) the Council remarks: “The EU reminds that attribution to a State or a non-State actor remains a sovereign political decision based on all-source intelligence and should be established in accordance with international law of State responsibility. In that regard, the EU stresses that not all measures of a joint EU diplomatic response to malicious cyber activities require attribution to a State or a non-State actor.”Footnote ⁴³ At the same time, the Commission and the High Representative of the Union for foreign affairs and security policy have stressed that currently there is limited mutual cooperation between Member States and no operational mechanism between the latter and EU institutions, agencies and bodies is in place, in the event of a large-scale, cross-border cyber incidents or crisis.Footnote ⁴⁴

In sum, it seems that the reasons why the clause is included in Recital n. 9 is that the EU, as a subject of international law, intended to refrain from invoking state responsibility. Member States’s representatives in the Council probably preferred to reserve this decision for themselves. As mentioned in Section A, in principle, Member States have the primary responsibility to protect their internal security and they may react to cyber-attacks on their own.

Another possible reason explaining the EU’s decision to leave to Member States the choice to invoke state responsibility is that the organization has started to exercise its competence in the area of cyber activities quite recently. The first Directive in the field of cybersecurity was enacted in 2008Footnote ⁴⁵ on the basis of the “implicit powers” provisions (the then Article 308 of the Treaty on the European Community) and its scope was limited.Footnote ⁴⁶

At the moment, there are no harmonized evidentiary standards on how to identify authors of cyber-attacks which could be taken into account by national authorities. Therefore, in case these events occur the EU has self-imposed a restriction on engaging state responsibility of the third State in which the authors of the attack operated and has also limited the range of possible measures that can be taken when those actors carry out a cyber-attack. The EU has confined itself to make it possible for the Council to freeze the assets of (or to impose admission restrictions on) natural or legal persons and has listed individual state organs,Footnote ⁴⁷ relying on the intelligence provided by the Member States,Footnote ⁴⁸ without triggering state responsibility.

Turning to the practice, the EU has made a modest use of cyber-sanctions. So far, these measures were imposed in response to only three distinct episodes: the first one concerned a single Member State while the second one affected a group of them; the third one was an attempted cyber-attack directed against an international organization located in one EU Member State. As mentioned above, the target of the first attack was the German Bundestag in 2015.Footnote ⁴⁹ Being a state organ, this is a sensitive target. MPs received bogus emails containing a link that led to the installation of malware on their computers. The malware was able to spread and eventually infiltrated the networks of the Parliament and allowed hackers to access internal confidential communication data, schedules, and other sensitive data.Footnote ⁵⁰ The attack was linked to the hacker group APT28, an actor believed to be associated with the Russian military intelligence.Footnote ⁵¹ The second attack (2016-2017) was dubbed “Operation Cloud Hopper” and was directed at managed service providers located in at least fifteen States, including five EU Member States.Footnote ⁵² The hackers installed malware and hacking tools to access systems and steal data,Footnote ⁵³ causing significant economic loss. The operation was conducted by cyberespionage group APT10 which is allegedly sponsored by the Chinese government.Footnote ⁵⁴ The last attack was an attempt by Russian intelligence agents to infiltrate the Wi-Fi network of the Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague.Footnote ⁵⁵ While conducting the operation, the attackers had been observed and were subsequently arrested by the Dutch military intelligence and no concrete damage was caused. The arrest facilitated the attribution process as all four operatives were clearly linked to the Russian military intelligence service. Five states (Australia, Canada, the Netherlands, New Zealand and the United Kingdom) coordinated accusations that the latter was responsible for a series of cyber operations including the one at the OPCW.Footnote ⁵⁶ Notwithstanding the involvement of Russian and Chinese State agents, the EU refrained from attributing legal responsibility to either of the sending States, thereby restating its unwillingness to engage in this exercise.

D. The Perils of the Reluctance to Agree Common Standards on the Attribution of Responsibility to a State for Carrying out Cyber-Attacks

Clearly the current state of affairs with respect to the rules on the attribution of responsibility for malicious cyber activities is not satisfactory. The lack of a more settled legal framework potentially entails huge economic costs.Footnote ⁵⁷ But the possible damage is not only of economic or financial nature. The reputational harm caused by cyber-interferences with electoral processes, for instance, is difficult to quantify but has the potential to undermine the political stability of entire countries.Footnote ⁵⁸ Even more worrying is the prospect that a cyber-attack crosses the threshold required to be considered a “use of force” under Article 2(4) of the UN Charter and trigger the right to individual or collective self-defense foreseen by the Charter and customary international law.Footnote ⁵⁹

While the practice of States and international organizations is only beginning to clarify how cyber operations must be addressed under the jus ad bellum,^{Footnote 60} there is widespread consensus among States and scholars that a cyber-attack can amount to a violation of the prohibition of the use of force. As is known, the International Court of Justice (ICJ) has stated that Articles 2(4) and 51 of the UN Charter, apply to “any use of force, regardless of the weapons employed.”^{Footnote 61} Thus, if a computer network is used instead of a traditional kinetic weapon this will not prevent the classification of the cyber operation as a “use of force.” According to the majority view, the decisive factor to distinguish a cyber operation that qualifies as “use of force” from less serious breaches is the scale and severity of its consequences.Footnote ⁶² This stance is reflected in the Tallin Manual 2.0, according to which “[a] cyber operation constitutes a use of force when its scale and effects are comparable to non-cyber operations rising to the level of a use of force.”Footnote ⁶³ It is beyond the scope of the present Article to examine the different factors that might influence the assessment at hand; yet, it is worth emphasizing that attacks on critical infrastructure – such as the ones listed in Decision (CFSP) 2019/797 - have a higher probability of reaching the “use of force” threshold.Footnote ⁶⁴ The idea that cyber-operations may breach the prohibition on the use of force and that the consequences of the attack are decisive in this assessment is also supported by the national positions of several States, including Australia,Footnote ⁶⁵ Germany, Footnote ⁶⁶ Italy,Footnote ⁶⁷ and the US.Footnote ⁶⁸ Moreover, particularly severe cases of “use of force” may qualify as “armed attacks” and therefore entitle the victim State to lawfully use force in self-defense.^{Footnote 69} The type of force employed by the injured state is not necessarily limited to taking measures by cyber means as it can make resort to kinetic means, as long as the response is necessary, proportionate and in accordance with other provisions of international law.Footnote ⁷⁰

The lack of commonly agreed standards on the attribution of responsibility to a State for carrying out cyber-attacks bears important risks. There seems to be agreement that a State may use kinetic force in response to a cyber-attack that meets the definition of “armed attack” under the jus ad bellum, and yet the uncertainty that surrounds the issue of attribution opens the way to dangerous mistakes. Brazil’s position paper on the application of international law to cyberspace underlines that “technical, legal and operational challenges to determine attribution might make it impossible to verify potential abuses of the right of self-defense, which in turns creates the risk of low impact persistent unilateral military action undermining the collective system established under the Charter.”Footnote ⁷¹ In the absence of any reliable verification mechanism, when a cyber-attack amounts to a “use of force” or to an “armed attack,” the target State will find itself in a problematic condition of uncertainty. Ultimately, the state (or the International Organization) concerned will either not be able to protect its security or risk to use force against a State without being certain that it was at the origin of the cyber-attack. A real need for a clearer legal framework exists, as the current lack of certainty might lead to arbitrary unilateral reactions. As Wright notes, “if we accept that the challenges posed by cyber technology are too great for the existing framework of international law to bear, that cyberspace will always be a grey area, a place of blurred boundaries, then we should expect cyberspace to continue to become a more dangerous place.”Footnote ⁷²

Considering the challenges highlighted above and the specific rules laid down in Recital n. 9 of the EU Decision on cyber sanctions, it is necessary to examine whether there is a special attention within the EU towards the setting up of a verification mechanism. In principle the EU should be particularly sensitive to this problem because it shares with its Member States the competence to address cyber-attacks and in case of an armed attack there is a special mutual defense clause in the EU TreatyFootnote ⁷³ requiring Member States to assist the victim of the attack. It is therefore interesting to review the terms of the discussion on the setting up of a verification mechanism in this context.

E. The Strengthening of EU Powers to Attribute a Cyber-Attack: A Way Forward?

In Section C, we have seen that the EU’s interest in cybersecurity is relatively recent. However, the number and the quality of EU-derived obligations for Member States has constantly grown since 2008. Several strategies were developed in 2013, 2017 and 2020 to tackle these security threats. Various instruments were deployed by EU to boost Member States’ response capacity.Footnote ⁷⁴ The most important is Directive (EU) 2016/1148Footnote ⁷⁵ which was adopted in order to harmonize the security requirements of network and information systems (‘NIS’) against which cyber-attacks might be directed. This piece of legislation laid down minimum harmonization requirements and introduced obligations concerning security measures and incident notifications across sectors which are vital for the economy and society.Footnote ⁷⁶ The objective of this measure was to achieve a high common level of security of network and information systems and was designed to enhance strategic and operational cooperation between Member States. The rationale for the adoption of Directive 2016/1148 was to prevent that cyber-attacks could have serious disruptive effects affecting more than one Member State, thus hampering the functioning of the internal market.Footnote ⁷⁷ Yet, this legislation was too limited. This is why in 2020 the Commission proposed to expand the harmonization requirements of the NIS Directive and to increase the number of sectors subject to it.Footnote ⁷⁸

At the same time, in December 2020, an amendment to the “ECI” DirectiveFootnote ⁷⁹ was also put forward. The proposed new rules are aimed at increasing resilience of “critical entities”Footnote ⁸⁰ by extending the application of the Directive, which initially covered the energy and transport sectors, to banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, and space. The proposed rules seek to “enhance the resilience of entities in the Member States which are critical for the provision of services which are essential for the maintenance of vital societal functions or economic activities in the internal market in a number of sectors underpinning the functioning of many other sectors of the economy of the Union.”Footnote ⁸¹ The idea behind the new rules is that considering the increased interdependency between services provided using critical infrastructure in the sectors mentioned above, a disruption in one Member State may have implications in other EU members or the whole EU. The divergence of regulations at national level is a factor that obstructs the functioning of the internal market and makes the Union more vulnerable in terms of security. Harmonizing the security requirements, which should be respected by critical entities providing essential services, is necessary. The proposed directive sets up a procedure for Member States to identify critical entities using common criteria on the basis of a national risk assessment and sets out a number of obligations on Member States.

The EU is clearly enhancing the security requirements that the mentioned infrastructure should respect and will continue to do so in the future, considering that the effects of cyber-attacks may either hamper the functioning of the internal or undermine the security of the Member States, that of the Union and international security. Given the unique level of integration of the EU and the specific solidarity mechanisms amongst the Member States, provided for by the EU Treaties,Footnote ⁸² the EU has an interest in addressing the lack of capacity of several of its members to identify and respond to cyber-attacks. In addition, the dependency on the intelligence of the US and United Kingdom (UK) as far as the attribution to third states of a cyber-attack is problematic. In this context, it is submitted that the EU could contribute to address the “special attribution problems” created by cyber-attacks, thus identifying an attribution mechanism enabling the organization, as a subject of international law, to trigger state responsibility in the event a cyber-attack targets the territories of one of its Member States. It may be wondered whether the EU has also the ability to carry out this task. In principle the answer is positive. Indeed, on the one hand, the EU has strengthened its research and technological capacities to secure network and information systems, and in particular to protect critical network and information systems because this is in the Union’s strategic interest.Footnote ⁸³ On the other hand, the EU institutional set up was reinforced. In 2019 a specific body, the European Union Agency for Cybersecurity (ENISA),Footnote ⁸⁴ which was created in 2013, was entrusted amongst other tasks, to assist the Member States and the EU institutions to prevent, detect and improve their capabilities to respond to cyber threats and incidents.Footnote ⁸⁵ The Agency also plays an important role in assisting national authorities to develop strategies on the security of network and information systems and, broadly speaking, in implementing Directive 2016/1148.Footnote ⁸⁶ In principle, this body does not have an autonomous capacity to make the technical determination necessary to attribute a certain cyber conduct to a given threat source.

The mentioned EU organ assists both the Member States and the EU institutions and is considered as “a centre of expertise on cybersecurity by virtue of its independence, the scientific and technical quality of the advice and assistance it delivers, the information it provides.Footnote ⁸⁷” The Agency may, at the request of one or more Member States, “provide support in relation to ex-post technical inquiries regarding incidents having a significant or substantial influence within the meaning of Directive (EU) 2016/1148.”Footnote ⁸⁸ It is submitted that these powers could be used and further expanded through a change of the Regulation instituting this agency to develop, in cooperation with national authorities, an attribution mechanism of cyber-attacks to a third state. If this were to happen, the EU would achieve a double purpose: on the one hand, it would address the problem of those EU members that lack capacity and expertise in this area; on the other hand, it could provide a model for technical attribution to be adopted or adapted by the international community.

Yet, there are a number of legal and political obstacles to the expansion of the EU Cybersecurity agency’s tasks. Indeed, the delegation of powers to agencies is subject to the constraints of the Meroni Footnote ⁸⁹ case-law: first, agencies may be delegated only executive powers while discretionary powers have to be exercized by the delegating authority; second, the latter cannot delegate broader powers than it enjoys itself. While the technical attribution of responsibility may be seen as an executive power, it is not clear whether the EU would have the competence to attribute state responsibility to a third country. This is the reason why the Agency could not be given powers to define an attribution mechanism. Yet, the legal framework is uncertain. It could be counterargued that given that the requirements of the “Meroni doctrine” have been made less stringent by the Court of Justice with the ESMA ruling,Footnote ⁹⁰ it is possible to enshrine on the Cybersecurity Agency more powers, provided that the latter are clearly defined, as required by the ECJ.Footnote ⁹¹ Therefore, the legal obstacle to expanding EU Agency’s powers would be overcome; it goes without saying that Member States would have to agree on taking such a step and this is a political decision.

At the same time, other platforms could be equipped with powers to attribute cyber-attacks. In this respect, it is interesting that the Commission recommended to build the Joint Cyber Unit and to set it up in a 4-step process that will include the identification of the EU available operational capabilities, the preparation of incident and crisis response plans at national and EU levels, and expansion of activities to establish cooperation with private entities. The operationalization of the Joint Cyber Unit is expected to be completed by 30 June 2023.Footnote ⁹² It should be noted that in an annex to the recommendation on building a joint cyber unit, it is envisaged that this unit may be used “by the cyber diplomacy community to align public communication. The platform may allow participants to contribute to political attribution as well as attribution within the criminal justice framework employed at police and judicial level.Footnote ⁹³” In addition, it may facilitate recovery and allow for structured synergies with national and cross-border monitoring and detection capabilities that participants to coordinate public communication and contribute to political attribution, as well as attribution in the context of the criminal justice. However, in the EU's Cybersecurity Strategy for the Digital Decade it is also confusingly stated that this platform “would not be an additional, standalone body, nor would it affect the competences and powers of national cybersecurity authorities or EU participants.”Footnote ⁹⁴ Be as it may, should the organization be able to make the decision to extend ENISA’s powers or to set up the new cyber unit, the decisions on attribution of cyber-attacks would be recognized by the EU Member States but certainly not by third countries. This is an important limit. Therefore, developing the powers of new Union bodies would serve to enhance the ability of the Member States to attribute cyber-attacks and to take a common decision within the EU. Yet, it would not provide a universally acceptable verification mechanism.

F. Final Remarks

Because States are reluctant to establish a comprehensive legal framework to counter cyber-attacks, this hints at a tendency of informalization and flexibility of regulation that one can observe in other areas related to digitalization as well. This also happens in the EU context. The organization is ready to impose cyber sanctions on individuals, including de jure state organs, but not to trigger the rules on international legal responsibility. We consider that the main reason for the inclusion of the clause in Recital n. 9 is that there is a reluctance by Member States to let that the EU engage state responsibility. However, the choice of the Council may also be due to the inherent difficulties in attributing a cyber-attack to a given actor, which prompted its explicit decision to leave this task to Member States. Significantly, in other cases of restrictive measures addressing non-digital threats, the Union had never openly affirmed that legal attribution should be left only to Member States.

To address the challenges posed by malicious cyber activities some have proposed to set up a widely accepted attribution mechanism.Footnote ⁹⁵ Yet, at the moment, EU Member States (but more broadly the international community) do not seem to have an interest towards the establishment of a technical verification mechanism which could only be fully legitimized if all main state actors would agree to its establishment and possibly contribute to its running. Major cyber actors, notably China, have shown little enthusiasm for this initiative and suggest (rather opportunistically) that “attribution is nearly impossible.”Footnote ⁹⁶ Without China and its allies on board the credibility of the independent entity would be severely undermined.

At the same time, it was suggested that more specific rules of attribution of conduct and responsibility that would apply to the cyber domain should be developed (or are indeed emerging from State practice).Footnote ⁹⁷ According to this proposal, States should be able to attribute unlawful cyber operations of non-State actors to States, even in the absence of evidence demonstrating clear State direction and control. While such a special regime would technically be possible under the law on State responsibility,Footnote ⁹⁸ there seems to be little state practice upon which these special rules should rest. States are only now beginning to set forth their views on how international law governs cyberspace, but too few of them have made their approach clear and they are still overshadowed by the number of States that are reticent to do so. As evidenced above, so far States have not been inclined to develop public and shared rules for attributing cyber-attacks and prefer to take advantage of a regulative gap that allows them to react to cyber incidents as they see fit (and perhaps to carry out hostile cyber operations themselves).Footnote ⁹⁹ The EU itself has never advocated for structural changes of international law as far as the attribution mechanism of cyber activities is concerned.Footnote ¹⁰⁰

However, the idea of concluding binding agreements of a more limited scope to regulate State behavior in the cyber domain should not be entirely abandoned.Footnote ¹⁰¹ While a treaty on general rules of conduct would require a political will that is currently lacking, steps forward could be made on banning or regulating specific areas, such as commercial cyber espionage or malicious cyber-activities against critical infrastructure.Footnote ¹⁰² The prospect of having to cope with huge financial and reputational costs might pave the way for the adoption of more specific treaties which could also establish rules and procedures regulating issues of attribution and responsibility that could serve as models for other similar exercises. Meanwhile, it is to be hoped that the severity of hostile cyber operations remains under the threshold of what could be regarded as an armed attack, as otherwise the described normative ambiguity could dramatically backfire.