Publicly attributing cyber attacks: a framework

Figures & data

Figure 1. The public attribution framework.

Table 1. Spectrum of state responsibility conducting cyber operations.

Spectrum	Description
State-integrated	The national government conducts operations using integrated third-party proxies and government cyber forces.
State-executed	The national government conducts the operation using cyber forces under their direct control
State-rogue-conducted	Out-of-control elements of cyber forces of the national government conduct the operation.
State-ordered	The national government directs third-party proxies to conduct the operation on its behalf.
State-coordinated	The national government coordinates third-party attackers such as by ‘suggesting’ operational details.
State-shaped	Third parties control and conduct the operation, but the state provides some support.
State-encouraged	Third parties control and conduct the operation, but the national government encourages them as a matter of policy.
State-ignored	The national government knows about the third-party intrusions but is unwilling to take any official action
State-prohibited-but inadequate	The national government is cooperative but unable to stop the third-party operation.
State-prohibited	The national government will help stop the third-party operation.

Table A1. Overview questions related to the goals pursued through public attribution.

Category	Factor	Questions
Goals	Norm-setting	Does it promote norm-setting? Is the aim to humiliate and shame the nation-state supporting the group?
	Coercion	Does it dissuade or compel adversaries?
	Counter-threat	To what degree does the public attribution cause friction in the actor’s operational activity?
	Prevention and defence	Does the public attribution lead to an enhanced defensive posture?
	Community building	How does the public attribution contribute to defensive cybersecurity? Does it help to create a community of network defenders and a coalition of attribution states?
	Legitimacy and reputation building	Does it enhance domestic and/or international legitimacy of involved actors? What is the influence of the public attribution on public relations?

Table A2. Overview questions enablers and constraints for public attribution.

Category	Factor	Main Question	Sub-questions
Intelligence	Certainty	What is the level of certainty we have about the actor’s (type of) responsibility of the cyber operation or campaign?	What is the actor’s relationship to the state? What is the chance the actor has acted against the state’s interest?
	Intel gain-loss	What is the information gain and loss following public attribution?	Which entry points for intelligence collection will likely be lost following public attribution? How will the adversary likely adapt to a public disclosure? Will the adversary likely find out how they were detected?
	Information control	How much is it able to control the flow of information about the threat actor it considers to publicly attribute?	Who’s expected to simultaneously track the intruder? (How) will other actors publish attribution information about the intruder? What media pressure is expected related to the incident?
	Types of TTPs	What are the tactics, techniques and procedures (TTPs) used by the intruder?	What are the resources the intruder has likely invested in the operation? Are publicly available tools used? Will public disclosure ‘burn’ previously unknown exploits and tools part of an advanced operation?
Incident Severity	Operational Effect	What’s the (intended) effect of the cyber operation?	Is the operation geopolitical relevant enough to publicly attribute? Is the operation part of a broader campaign? What are the short- and long-term effects of the operation? Was there likely collateral damage?
	Actor Legitimacy	What is the impact of public attribution on the intruder’s legitimacy?	What is the impact on the legitimacy and status of the attacker? Can the actor be ‘shamed’? Is the cyber operations conducted with the strategic aim of being publicly attributed by the victim?
	Actor Motivation	What is the motivation behind the intruder’s cyber operation?	Does it strengthen the intruder’s self-image and legitimacy? Does the disclosed information contradict an actor’s identity constructions?
Geopolitical Situation	Context	What is the geopolitical context of the public attribution act?	How does the disclosure influence the domestic politics of the accused country? What is the historical relationship with the state? In which networks was activity observed? Was the intrusion previously discussed in private? Is public attribution expected to lead to a ‘tying the hands’ effect?
	Timing	What is the geopolitical timing of the public attribution act?	Has the intelligence value of observing the intruder been maximized? What impact does public attribution have on the right to a fair trial?
Handling and follow-on actions	Type of Actor & Audience	How does it affect the actors’ behavior and legitimacy when their cyber activity is publicly attributed?	How are the actor’s operational practices influences by public attribution? How does public attribution legitimize its use as a tool of statecraft?
	Response options	Does public attribution enable potential follow-on policy or military responses?	Is public attribution legally necessary to implement a follow-on response? What are the tools available to respond? Will public attribution make it easier to rally support from allies for military or other responsive measure? Does public attribution create a focal point for malicious activity? Is it expected to lead to a counter response?
	International Cooperation	How does public attribution influence international cooperation?	Is there a joint public attribution procedure in place? How much does international coordination delay the attribution process?