Publicly attributing cyber attacks: a framework

When should states publicly attribute cyber intrusions? Whilst this is a question governments increasingly grapple with, academia has hardly helped in providing answers. This article describes the stages of public attribution and provides Public Attribution Framework designed to explain, guide, improve decision making by states. Our general argument that highly complex process which requires trade-offs multiple considerations. Effective not only necessitates clear understanding attributed operation threat actor, but also broader geopolitical environment, allied positions activities, legal context. implies more always better. carries significant risks, are often badly understood. We propose maker’s attitude towards be one ‘strategic, coordinated pragmatism’. – as part strategy can successful if there consistent goal, whilst avenues for potential negative counter effects assessed on case-by-case basis.