Attributing Cyber Attacks

TLDR

Attribution, essential for protecting human lives and state security, is a notoriously difficult problem in computer network intrusions, largely dependent on forensic evidence and raising questions about its practical usefulness. The article argues that attribution is defined by what states make of it. The authors introduce the Q Model, framing attribution as a tri‑level uncertainty‑minimisation exercise—tactical, operational, and strategic—that requires diverse skills, careful management, and effective communication. The abstract opens with the questions “Who did it?” and “But is it?”.

Abstract

Who did it? Attribution is fundamental. Human lives and the security of the state may depend on ascribing agency to an agent. In the context of computer network intrusions, attribution is commonly seen as one of the most intractable technical problems, as either solvable or not solvable, and as dependent mainly on the available forensic evidence. But is it? Is this a productive understanding of attribution? — This article argues that attribution is what states make of it. To show how, we introduce the Q Model: designed to explain, guide, and improve the making of attribution. Matching an offender to an offence is an exercise in minimising uncertainty on three levels: tactically, attribution is an art as well as a science; operationally, attribution is a nuanced process not a black-and-white problem; and strategically, attribution is a function of what is at stake politically. Successful attribution requires a range of skills on all levels, careful management, time, leadership, stress-testing, prudent communication, and recognising limitations and challenges.