Stateless Attribution: Toward International Accountability in Cyberspace

Cyber Attribution: Technical and Legal Approaches and Challenges

“…There are many blueprints for such an agency ranging from an agency with purely privatesector membership, an agency with private-public membership and a purely intergovernmental agency. 75 For its proponents, an international agency that centralizes and streamlines attribution determinations and processes will engender trust in attribution against the current state of decentralized, often inconsistent and methodologically obscure determinations. It will also lead to the standardization of attribution by establishing its own attribution methodology, rules of evidence, and decision-making process.…”

Private Sector Attribution of Cyber Incidents: Benefits and Risks to the U.S. Government

“…For instance, Microsoft has proposed the creation of a public-private organization 80 while others have argued that a new attribution organization would be most credible and transparent if it was composed entirely of private sector and non-government organizations. (Davis et al, 2017) Despite interest in further exploring these proposals, our interviewees noted that the extensive disagreement between governments and the divergence of approaches among private sector companies create doubts that any of the existing proposals would resolve the standardization, transparency, and credibility challenges with public attribution.…”

“…In addition, other scholarship has addressed particular strategic, legal and ethical issues that arise when entities seek to attribute cyber events (Anderson, 2018;Eichensehr, 2017;Guerrero-Saade, 2015;Edwards et al 2017). The current state of affairs is complicated enough that there have even been numerous proposals to standardize attribution reports or even create new international or private-sector led organizations whose mission is to attribute malicious cyber activity (Davis et al, 2017;Microsoft's Cyber IAEA 9 ; Atlantic Council Attribution Council 10 ). Others have also developed analytic models to help frame attribution procedures.…”

From Agency-Enhancement Intentions to Profile-Based Optimisation Tools: What Is Lost in Translation

“…It is thus perhaps unsurprising that many of the initiatives proposed on regulating technologies tend to side-line the role of the state and instead emphasize the role of the private sector. Whether through the multi-stakeholder model proposed by Microsoft for an international attribution agency in which states play a comparatively minor role (Charney et al 2016), or in a proposal by RAND corporation which suggests that states should be completely excluded from such an attribution organisation (Davis II et al 2017). In fact, states and their regulatory instruments are increasingly portrayed as a problem rather than a solution.…”