Pick Your Poison: The Attribution Paradox in Cyberwar

Certainty matters in cyberspace. The so-called attribution problem can impede deterrence, making cyberattacks more likely. But attribution problems can also limit conflict escalation, keeping nations safer. Using a discrete choice experimental design, this article quantifies the scope of the attribution problem for both deterrence and escalation. The results suggest that the attribution problem is really only a problem for deterrence and actually helps limit conflict escalation by reducing support for more severe retaliatory options.

ADDRESSING THE AUTHORSHIP ATTRIBUTION PROBLEM FOR DIFFERENT SEGMENTS OF THE INTERNET

The purpose of this study is to evaluate the possibilities of authorship attribution methods for different segments of the Internet. We focus our efforts on Russian-language content. Since texts in different segments of the Internet have various features and characteristics, we collected datasets from different sections, such as channels messengers, blogs, news reviews and literary works.

The Bumpy Road to a Meaningful International Law of Cyber Attribution

Attributing computer network intrusions has grown in importance as cyber penetrations across sovereign borders have become commonplace. Although advances in technology and forensics have made machine attribution easier in recent years, identifying states or others responsible for cyber intrusions remains challenging. This essay provides an overview of the attribution problem and its international legal dimensions and argues that states must develop accountable attribution mechanisms for international law to have practical value in this sphere.

The Attribution Problem and Cyber Armed Attacks

In late 2018, the U.S. Secretary of Homeland Security suggested that “cyber-attacks now exceed the risk of physical attacks.” Yet the law has not kept pace with this reality. In particular, identifying who is responsible for a cyberattack makes it difficult to regulate this conduct. A state often cannot practically respond to a threat unless it knows from where the threat emanates and potentially who is responsible. Attribution of cyber conduct is critical from a legal perspective because the unlawful act must be attributable to another state for state responsibility to be engaged.

The Politics of Attributing Blame for Cyberattacks and the Costs of Uncertainty

Attribution is one of the most serious challenges associated with cyberattacks. It is often difficult to determine who launched an attack and why, which hinders efforts to formulate appropriate responses. Although the attribution problem has been discussed extensively in research on cybersecurity, it is generally approached as a technical challenge for security professionals and politicians. I contend that it is vital to take the attribution problem beyond this elite focus by considering how attributional challenges can interfere with the public’s efforts to understand security challenges and evaluate government actions. Faced with uncertainty and the confusion of attempting to understand novel cyber threats, citizens frequently lack the information they need to reliably identify the culprits behind attacks—or sometimes even to know whether an attack has taken place. I show that attributional uncertainty immediately following cyberattacks encourages dependence on a narrow range of elite frames and the assignment of blame to familiar enemies. Over time this promotes conspiratorial thinking and poses a risk to democratic accountability. When seen in light of these broader costs, the attribution problem becomes a vital political concern with implications that reach beyond the scope of elite-focused cybersecurity research.

THE ATTRIBUTION PROBLEM AS A TOOL OF LAWFARE

International law prescribes conditions for attribution of private persons' conduct to a state. If those conditions are not met, the state shall not be responsible for actions of individuals. This attribution problem may be misused by states for denial of their responsibility. The following article approaches this phenomenon by using the concept of lawfare. Lawfare describes misuses of international law as a weapon to achieve military advantage. The article assesses legal and factual, short-term and long-term responses to counter this practice.