Attributing Cyber Attacks
Open accessAbstract
Who did it? Attribution is fundamental. Human lives and the security of the state may depend on ascribing agency to an agent. In the context of computer network intrusions, attribution is commonly seen as one of the most intractable technical problems, as either solvable or not solvable, and as dependent mainly on the available forensic evidence. But is it? Is this a productive understanding of attribution? — This article argues that attribution is what states make of it. To show how, we introduce the Q Model: designed to explain, guide, and improve the making of attribution. Matching an offender to an offence is an exercise in minimising uncertainty on three levels: tactically, attribution is an art as well as a science; operationally, attribution is a nuanced process not a black-and-white problem; and strategically, attribution is a function of what is at stake politically. Successful attribution requires a range of skills on all levels, careful management, time, leadership, stress-testing, prudent communication, and recognising limitations and challenges.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In contrast to conventional terror attacks, the motivation of cyberattackers often remains unknown.
“Furthermore, we note that in contrast to conventional terror attacks, the motivation of cyberattackers often remains unknown (Rid and Buchanan 2015).”
From Public Opinion and Cyberterrorism (2023) · cites this paper as Rid and Buchanan 2015
In contrast to kinetic attacks, the identities of cyber-attackers often remain unknown because cyberspace allows actors to obfuscate their identity.
“But, in contrast to kinetic attacks, the identities of cyber-attackers often remain unknown since the particular characteristics of cyberspace allow actors to obfuscate their identity (Rid and Buchanan 2015).”
From Public Opinion and Cyberterrorism (2023) · cites this paper as Rid and Buchanan 2015
Cites
Rid, T. (2012) · Journal of Strategic Studies · doi:10.1080/01402390.2011.608939 · Cited by 716 · see citing works
Self-citationThe Cyber Attack on Saudi Aramco
Bronk, C., & Tikk-Ringas, E. (2013) · Survival · doi:10.1080/00396338.2013.784468 · Cited by 160 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Moustafa, N., Koroniotis, N., Keshk, M., Zomaya, A. Y., & Tari, Z. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3280465 · Cited by 266 · see citing works
Cyberattacks, Cyber Threats, and Attitudes Toward Cybersecurity Policies
Snider, K. L. G., Shandler, R., Zandani, S., & Canetti, D. (2021) · Journal of Cybersecurity · doi:10.1093/cybsec/tyab019 · Cited by 70 · see citing works
Warring from the virtual to the real: Assessing the public’s threshold for war over cyber security
Kreps, S., & Das, D. (2017) · Research & Politics · doi:10.1177/2053168017715930 · Cited by 18 · see citing works
Public Opinion and Cyberterrorism
Shandler, R., Kostyuk, N., & Oppenheimer, H. (2023) · Public Opinion Quarterly · doi:10.1093/poq/nfad006 · Cited by 14 · see citing works
- Authors
- Rid, T., & Buchanan, B.
- Affiliations
- King's College London (GB)
- Venue
- Journal of Strategic Studies
- Publisher
- Informa UK Limited
- Published
- 2014-12-23
- Volume
- 38
- Issue
- 1-2
- Pages
- 4-37
- ISSN
- 0140-2390 (ISSN-L)
- 1743-937X
- OpenAlex
- W1993595248
- Cited by
- 639
- References
- 2
- Citations by year
- 2026: 66 · 2025: 46 · 2024: 57 · 2023: 87 · 2022: 79 · 2021: 50 · 2020: 106 · 2019: 54 · 2018: 32 · 2017: 33 · 2016: 22 · 2015: 7
- FWCI
- 134.13
- Type
- journal article
- Language
- en
- Open access
- green
- figshare.com
- Licence
- cc-by
- Locations
- Journal of Strategic Studies (publishedVersion)
- Figshare (submittedVersion, cc-by)
- Research Portal (King's College London) (submittedVersion)
- Figshare (cc-by)
- Topics
- Social Sciences › Political Science and International Relations › Cybersecurity and Cyber Warfare Studies
- Social Sciences › Political Science and International Relations › Intelligence, Security, War Strategy
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- attribution of cyberattacks, Q model, uncertainty reduction, digital forensics
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
