How and why does the attribution of an incident become the responsibility of the executive rather than the judiciary? How do the processes of attributing a criminal incident and attributing a national security incident differ? This chapter offers a two-pronged model for attribution, based on the nature of the process either as criminal or as a threat to national security. Criminal cases rarely rise to the level of "national threat," and are mostly dealt with by law enforcement agencies and subsequently by judiciary organizations. Several cases, based on certain criteria, fall within the remit of the executive rather than the judiciary, because government officials regard them as threats to national security. This transfer has several consequences. First and foremost, the question of knowing the full name of the attacker becomes less relevant than knowing who the enemy is and who the sponsors are; for instance, a state actor or a terrorist organization. Second, a national security incident usually implies broader investigative powers, especially those of intelligence services, which can use secret methods bordering legality.