The Attribution Problem following Cyberattacks

It is usually relatively easy to determine who is at fault for kinetic attacks. Conventional military operations are typically launched by enemies that can be identified and targeted for retaliation. Belligerents sometimes attempt to interfere with attribution, as Germany did in 1939 by dressing its soldiers in Polish military uniforms to stage a fake assault on a radio station at Gleiwitz in the hope of presenting its invasion of Poland as an act of self-defense. However, blame shifting in interstate warfare rarely succeeds. The trail back to the perpetrator and the underlying strategic thinking are usually too obvious to generate serious doubt. More confusion emerges when multiple belligerents are operating in a single area and there is disagreement about responsibility for a specific attack, which has happened several times during the ongoing war in Syria.^{Footnote 11} Nevertheless, the pool of potential culprits is limited to those acting in the battlespace and some physical evidence is usually available, so the level of attributional uncertainty is low. Terrorism may leave more room for speculation, as evidenced by conspiracy theories about who was responsible for 9/11,^{Footnote 12} yet such attacks also have fairly clear and widely agreed on official explanations against which the alternative views can be classified as conspiratorial. With each of these types of kinetic violence a relatively accurate account of events can emerge quickly to frame information as the public is initially attempting to make sense of it.

Cyberattacks offer much less attributional certainty. First, cyberattacks do not take place within a clear battlespace and rarely arrive from an identifiable source. Network attacks are usually routed through servers that are located in third-party locations—potentially even third-party locations that provide a convenient scapegoat. “The IP address therefore does not present the attacked state with a physical location to blame or even attack in response. The discovered server could be located in a neutral, friendly, or even your own country.”^{Footnote 13} Brenner says of an attack’s point of origin that “almost invariably that server was merely the last of several through which the attackers passed in order to hide.”^{Footnote 14} This makes discovering attackers far more difficult than simply tracing IP addresses or other digital signatures.

Even when attacks are introduced to an air-gapped system that is closed off from external networks—attacks that require the physical presence of an attacker—the malicious code may be identified long after its introduction, when it may be impossible to discover who planted it. Moreover, the person introducing the infection could be an unwitting participant who is ignorant of the infected hardware. The Stuxnet worm that damaged Iranian nuclear centrifuges in a secret facility at Natanz is a prime example of this. It was probably delivered through a USB drive by someone working inside, but investigators could not discover who was responsible or whether that person knew about the attack.^{Footnote 15}

Second, investigating attacks is time consuming and expensive. Sheldon says that “the forensics of attribution can rarely, if ever, give immediate results and can take days if not weeks to provide solid technical evidence.”^{Footnote 16} It took a team of investigators working across multiple security companies around seven months to reverse engineer the Stuxnet worm and arrive at some sense of who might have developed it.^{Footnote 17} The effort was nearly abandoned on several occasions, and only prevailed because the novelty of the threat and presence of multiple zero-day exploits (previously unidentified software vulnerabilities) motivated an inordinate investment of resources in the research. Even then investigators only tentatively linked the attack to the United States and Israel until leaked information substantiated this account. Worse still, some cyberattacks are asynchronous, only being detected long after they are launched and when the evidence is deteriorating.^{Footnote 18} Stuxnet operated for at least two years and inflicted physical destruction before it was uncovered. Investigatory delays interfere with attribution and prolong the sense of uncertainty even if the attacker is ultimately discovered. This leaves more time for speculation about the source of attacks and for opinions to form without evidentiary support.

Third, investigation is a complex process that must be done collectively. “Attribution is almost always too large and too complex for any single person to handle; attribution is likely to require a division of labour.”^{Footnote 19} This not only makes the process long and expensive but also means that the final outcome must be judged “against competing evidence in front of a decision authority.”^{Footnote 20} Disagreements between investigators or conflicting evidence that is uncovered may interfere with efforts to convince audiences that the attribution was made correctly. Partisan and nationalistic biases could also shape the causal accounts developed, as well as influencing which narrative is endorsed by interested political actors.

Finally, cyberattacks raise the “many hands” problem of determining specific individuals’ contributions. They are complex assemblages of software developed collectively, with elements being borrowed from those who are not actually involved in attacks. Some exploits are developed and then sold online, meaning that the developer and the actual user might have little in common. The end result is still more confusion about who is behind the attacks and what degree of blame they should have if they are identified. Farwell and Rohozinski ask: “is the responsible party a Russian hacker living in New Zealand who may have contributed part of the code used for the rootkit? Or is it an intermediary that may have passed the code onto a state-based military intelligence actor?”^{Footnote 21} Even in an ideal scenario in which code can be traced to specific developers, there is often residual doubt about who actually launched the attack and which elements of the code were appropriated from unwitting collaborators. The many hands problem and the routing of attacks through false addresses ensure that cyberattacks come with an abundant supply of circumstantial evidence that can help to sustain some degree of plausible deniability.

The Politics of Attribution

The attribution problem is a central issue in research on cybersecurity. Eun and Aßmann argue that “determining the real aggressor is impossible unless the aggressor admits to it.”^{Footnote 22} Rid characterizes the attribution problem as a unifying characteristic of cyberattacks and says that this “feature of digital conflict represents a fundamental, and in many ways disturbing, change when compared to political confrontations in earlier, analogue times.”^{Footnote 23} Lindsay makes the more modest claim that attribution is difficult, but that important systems have stronger mechanisms for locating the source of attacks and countering the intruders, with more resources also being devoted to investigations.^{Footnote 24} With this in mind, we should be cognizant that the type of attack and target may influence the extent of uncertainty following an attack and particularly attentive to how attributional problems arise when systems are inadequately protected.

This existing research on attributing cyberattacks is invaluable, yet it is limited by a focus on elite decision-making processes like deterring future attacks, retaliating against aggressors, and building more effective defenses. To develop a stronger grasp of cyberattacks’ political consequences, it is essential to go beyond the elite focus to consider how responsibility attributions affect citizens’ perceptions of security issues. Elite responses to cybersecurity threats are constrained by public opinion. In exceptional cases the attacks may themselves become central to partisan disagreements, as evidenced by the ongoing debate over who was responsible for the cyberattacks during the 2016 U.S. presidential election.

Before considering the potential consequences of the attribution problem with reference to cyberattacks specifically, it is useful to reflect on some of the reasons why responsibility attributions are generally important. At the most basic level, responsibility attributions matter because they are vital for making sense of political phenomena. Iyengar explains that “individuals tend to simplify political issues by reducing them to questions of responsibility and their issue opinions flow from their answers to these questions.”^{Footnote 25} Similarly, Atkesan and Maestas argue that “causal attributions form an important link in a chain that runs from citizens’ receipt of information (for example, from mass media, elites, friends, or personal experiences) to their issue opinions, political evaluations, and, ultimately, political choices.”^{Footnote 26} Divergent political values and policy preferences are affected by divergent perceptions of who deserves praise or blame for events, and voters’ ability to hold elected officials accountable depends on how they perceive causal processes and identify those responsible.^{Footnote 27}

How members of the public assign blame for transgressions affects their moral judgments. Kühne, Weber, and Sommer report that “whether individuals hold an actor responsible or not for a negative event affects their anger response, which, in turn, predicts the evaluation of the actor.”^{Footnote 28} They find that responsibility attributions increase anger and support for punitive actions while ambivalent ones tend to dampen these feelings. This has important implications when it comes to security, indicating that blaming an adversary will fuel a sense of indignation and increase the likelihood of retaliation. Emotional responses related to blame are also apt to influence subsequent evaluations of the transgressor, which can cause a rush to judgment in future disagreements.^{Footnote 29} This is potentially disastrous in a security context in which escalation can spiral out of control.

Being able to blame someone for serious transgressions helps to satisfy a sense of indignation on the part of victims. Walker argues that publicly assigning culpability is vital to alleviating this emotional turmoil and repairing the sense of moral wrongness that arises from it.^{Footnote 30} As she points out, one way that communities constitute themselves is through a collective enforcement of norms. Above all, this depends on being able to clearly point to those who have transgressed the norms. When punishment is impossible, assigning blame can at least restore a sense of moral certainty and confidence in the norms and the security they are supposed to provide. “To fail to reprove wrongdoers or to fail to hold responsible those to whom responsibility reasonably falls is to cast doubt on the authority of norms . . . or to indicate that wrongdoers are beyond the reach of the community or its norms.”^{Footnote 31} When seen from this perspective, there is a risk of persistent cyberattacks undermining state authority and generating a sense that attackers can violate norms with impunity.

Attribution is also vital for building international solidarity and support for major policy changes. The attacks on Charlie Hebdo and the Bataclan Theater in Paris caused international outrage and created an ideal context for French President François Hollande’s successful call for the United Nations Security Council to support the strikes against Islamic State.^{Footnote 32} This recalled the pro-American sentiment following the 9/11 attacks and the Bush administration’s success in using these to promote the invasion of Afghanistan. Victims of aggression benefit from goodwill that they can channel into retaliation or other shifts in security policies, yet blame frames impose limits on how that support may be directed. The U.S. decision to invade Afghanistan received considerable support, while the invasion of Iraq based on tenuous links to terrorism and weak evidence of Weapons of Mass Destruction was markedly less popular.^{Footnote 33} When the attributional links are less clear or more contentious, policymakers may struggle more to reach a consensus.

Predictable and routine events can be mapped onto existing perceptions about who to praise or blame, imposing modest cognitive demands on the public. By contrast, unexpected events shake public confidence, triggering efforts to explain the events and restore a sense of security. People are rarely content with ambiguity when information is not forthcoming, especially if there is a perceived threat. Maestas and Atkinson find that there is a psychological need to have explanations for unexpected threatening events.^{Footnote 34} Thus, one consequence of shocking events is that people must search for an explanation that can restore some sense of certainty and rehabilitate their shaken political evaluations. Security threats prompt the same search for causal explanations as other unexpected crises, yet when it comes to cyberattacks the attribution problem compromises citizens’ abilities to draw reliable conclusions. The lack of a clear source, involvement of multiple actors, and time delays all conspire to hinder the formation of any clear causal account. If time-consuming forensic work is ultimately successful in identifying the culprit, the explanations will arrive long after the event was initially publicized—after people have drawn their own conclusions about the event and when the damage of misattribution may have already been done.

Over the following sections I consider four consequences of the search to assign blame without the requisite information: increased reliance on information framed by a relatively small number of elites, blame feedback loops, conspiratorial thinking, and a decline of democratic accountability. These mechanisms have been uncovered in research on attribution in other contexts. My goal is to show that the prevalence and depth of uncertainty when it comes to cyberattacks make the public’s perceptions an important political consideration.

Opportunities for Elite Framing

The first and most immediate effect of the attribution problem is to increase the public’s dependence on a narrow range of elite sources of information that can dominate public discourse without having to contend with strong counter-narratives. Lacking not only the facts needed for deciding who to blame but also the technical expertise for understanding the nuances of how an attack was carried out and by whom, the public must draw conclusions from reports that are offered by a small number of policymakers and security professionals involved in the investigation. This gives those actors considerable power over the causal narrative, especially in the immediate aftermath of an attack when there is a rush to explain an event, but investigators have not had time for careful forensic work. This is an ideal context for “strategic portrayal of causal stories” by elites to create perceptions of responsibility that can be expedient for advancing policies that might otherwise be more controversial.^{Footnote 35} In most cases, alternative frames tend to come from disagreement among elites or independent blame-frames.^{Footnote 36} However, the effects of cyberattacks are largely invisible and the relevant information is not widely accessible, narrowing the number of elites involved and limiting the range of alternative viewpoints.

When information is scarce, journalists tend to aggregate it and have few opportunities for fact checking that requires reliable alternative sources. Dependence on elite gatekeepers has been well documented following other shocking events, such as natural disasters, and increases elites’ control over how issues are framed.^{Footnote 37} With air time and columns to fill, journalists respond to attributional uncertainties, first, by resorting to a less critical acceptance of information from politicians and other experts, and second, by engaging in rampant speculation about events.^{Footnote 38} The former process intensifies the power of elite frames and the likelihood that these will persist without being contradicted, while the latter can lead to blame frames that are poorly supported by the available evidence. Thus, the framing opportunities following cyberattacks derive from the limited number of actors involved, their ability to control information flows, and the inability of journalists to provide adequate fact checking, which collectively prevent the formation of strong counter-frames.

Information relating to kinetic attacks is also subject to framing and is frequently manipulated to advance strategic goals, but there is a critical difference in the extent of this opportunity compared to cyberattacks. Framing typically occurs because elites emphasize certain parts of an issue or selectively present information.^{Footnote 39} Frames related to kinetic attacks generally have to compete with counter-frames arising from opposing perspectives, and such competition makes people less susceptible to a single frame by giving them choices about what to believe.^{Footnote 40} When it comes to cyberattacks, competition between frames is restricted by a lack of information that limits access to counter-frames. For example, the Bush administration’s expansive framing of responsibility throughout the War on Terror shaped U.S. policy and helped to mobilize support for the invasion of Iraq in 2003, but it had to compete against some opposition that had access to counterevidence coming from reliable sources like UN investigators.^{Footnote 41} When it comes to cyberattacks, the information is often simply unavailable beyond those actors who are directly involved in the investigation, leaving them solidly in control of the narrative and with greater capacity to prevent dissenters from evaluating the evidence.

The unfamiliarity of cyberattacks compared to kinetic attacks poses additional challenges. People with more knowledge of a topic are more able to resist external frames and more inclined to search for alternative sources of information.^{Footnote 42} The complexity of cyberattacks limits the size of the audience that is in a position to evaluate frames. When victims may be ignorant of an attack for months or even years (as in the case of the Stuxnet, Flame, Duqu, and Gauss worms) because of the technical expertise required for identifying the malicious code in the first place, there is little hope of the general public being in a strong position to evaluate the frames used once reporting begins. Furthermore, technical challenges hinder the public’s ability to judge the plausibility of attributional claims. The evidence used to assign blame for specific attacks is often drawn from patterns identified in previous attacks, and explaining the nuances of forensic work to the public is not an easy task.

We can get a sense of the framing opportunities by looking at how long victims are able to conceal major attacks when it suits their goals. Hackers stole private information on around 57 million users and 600,000 drivers from Uber in 2016, which the company managed to conceal for more than a year by paying the hackers a $100,000 ransom.^{Footnote 43} The theft of 143 million Americans’ private information from Equifax in 2017 was hidden for four months.^{Footnote 44} These were massive breaches, but the effects were only visible to a small number of senior officials in the affected organizations, which gave them control over the relevant information. The Equifax hack has been loosely attributed to North Korea, but concealment of the attack delayed investigation, extending the time needed to determine whether this was an act of aggression by a foreign state. Even third-party investigators may have good reasons for restricting information about an attack, at least initially, as this is sometimes vital for preventing news of software vulnerabilities from circulating before they can be patched.^{Footnote 45} Because kinetic attacks are more visibly destructive, similar cover-ups are extremely rare and more alternative news frames are available.

Further evidence of the power of framing comes from the number of false alarms provoked by a handful of security experts. A series of power outages affecting around 50 million Americans in 2003 were widely blamed on Chinese hackers. The reports came from unnamed government sources, yet they had a sense of plausibility given the wave of hacks that had been recently attributed to China. Subsequent investigations found that the outages were more likely caused by trees.^{Footnote 46} Brazil suffered several major power outages throughout 2005, 2007, and 2009. In each case dozens of news agencies linked these to cyberattacks, often using the story to highlight the potential for more serious destruction to follow. Once again, the sources were unnamed American security experts who lacked any hard evidence to substantiate the claims.^{Footnote 47} Investigations later showed that the outages were probably caused by technical faults, yet by then the events had taken root as examples of Brazil’s vulnerability to cyberattacks and the destruction that hackers may inflict. In these instances, the framing was probably more due to sensationalism than a deliberate attempt to mislead the public. However, it is revealing that journalists reported these incidents as attacks because they are heavily dependent on information from a few unidentified sources. Kinetic attacks trigger fear and speculation, but it is uncommon for ostensible attacks to be purely imaginary and sparked because of how unintentional destruction is framed.

When attacks are confirmed and widely reported, victims continue to retain greater control over the framing of effects than they would following kinetic attacks. Once again, this is due to the limited number of actors involved and lack of evidence available for opposing voices attempting to develop counter-frames. Cyberattacks rarely inflict physical damage—it is usually information that is compromised—but efforts to protect the information persist in the aftermath. In those rare instances that do cause physical damage may be limited to secretive facilities that lack public oversight, such as the Iranian nuclear facilities damaged by Stuxnet. Admitting to the extent of an attack could trigger a follow-up strike by anyone hoping to capitalize on the moment of weakness, or compromise the careers of officials in the victim state’s government.

Thus, victims remain largely in control of what costs are officially acknowledged and how these are characterized. Israel claimed that attacks linked to Anonymous in 2013 only inflicted modest financial damage.^{Footnote 48} Iran likewise claimed that although Stuxnet showed Western aggression, it was ineffective and caused little damage. Later independent investigations would introduce counter-frames that put the costs higher,^{Footnote 49} yet the official accounts clearly have privileged access to the relevant details. It is difficult to mobilize strong counterevidence from the outside. Other estimates have emerged in these and other cases, but come from outside and without the ability to gain the level of accesses needed for investigative work. Framing the costs of attacks in self-serving ways calls the accuracy of information into question and adds to public uncertainty about cyberattacks.

Blame Feedback Loops

The well-publicized cyberattacks against the United States that I discussed at the outset were widely attributed to China, Russia, and North Korea, revealing the extent to which attributional uncertainty is resolved by holding existing adversaries responsible. Victims of cyberattacks as well as third-party investigators tend to initially explain these in terms of existing enmities before solid evidence is forthcoming.^{Footnote 50} Some commentators even advocate this strategy as one of the best for identifying attackers. In speaking about the continued relevance of geography in cyberattacks, Sheldon argues that fault can often be ascertained by considering the geopolitical interests involved.^{Footnote 51} The temptation to blame the most obvious rival is apt to be especially strong soon after an attack when there is a rush to attribute responsibility and to shore up defenses, but before investigations have ended. The problem is that this helps to entrench initial frames and promotes confirmation bias, with new information being melded to the existing frame rather than being used to introduce alternative explanations. Blame feedback loops occur when attacks are explained in terms of existing hostilities and then become accepted as evidence of those hostilities that may influence subsequent threat perceptions. The risk here is that attributional uncertainty could promote a kind of path-dependency in threat perception.

Kinetic attacks may also trigger a rush to judgment, which can lead to divergent narratives between those seeking to blame a familiar enemy and those who are taking new evidence into account. However, as I showed in the previous section, when it comes to cyberattacks the evidence is more difficult to grasp and attribution is more ambiguous, limiting the strength of counter-frames, especially at that critical moment when the shock of an event prompts a search for answers. Studies have shown that novel and traumatic events offer a moment for novel frames to arise and question existing biases.^{Footnote 52} Initial attributions based on existing threat perceptions tend to become the dominant frame throughout the lengthy investigative process, and that the tenuous attributional evidence that is forthcoming will have to compete against that initial frame.

The recurrent attacks on Russia’s rivals provide some of the clearest examples of the tendency to explain attacks with reference to geopolitical conditions. Distributed denial of service (DDoS) attacks directed against Estonia for three weeks in 2007 were initially attributed to Russia, especially because they came after Estonia decided to remove a Soviet memorial. But even with a clear motive and the attacks originating in Russia, many cybersecurity experts later questioned this explanation, and even representatives of NATO were reluctant to say that Russia was at fault.^{Footnote 53} The Russian government fueled this speculation with claims that the attacks could have come from someone within the Russian government who was acting without orders. What initially seemed to be a fairly clear case of aggression by the Russian state gradually became more complex with disagreement over whether the attackers were officially sanctioned government operatives, rogue spies, or nationalistic criminals, third parties attempting to build animosity between rival states. Each of these explanations continues to circulate years after the attack but it continues to serve as an example of Russian aggression in cyberspace that subsequent attacks are judged by. It is highly likely that Russia launched this attack. However, there is a danger in using an ambiguous case like this to identify perpetrators in the future.

Definitive cases of misattribution based on biased threat perceptions are uncommon, but this is partly because definitive attribution is rare. The cases of confirmed misattribution that are available illustrate how easily mistakes can occur when investigators initially explain attacks by looking at what seem to be the most obvious adversaries. In February 1998 the U.S. Department of Defense came under a series of network attacks that it initially blamed on Iraq. This attribution appeared logical at the time, given the heightened tensions that ultimately led to a US bombing campaign. National Coordinator for Security Richard Clarke said that “for days, critical days, as we were trying to get forces to the Gulf, we didn’t know who was doing it. We assumed therefore it was Iraq.”^{Footnote 54} Deputy Secretary of State John Hamre briefed President Clinton about the possibility that it could be “the first shots of a genuine cyber war” coming from Iraq.^{Footnote 55} It took three weeks to discover that the attack actually came from a group of teenagers in California, Canada, and Israel, who had no relations with Iraq. The obvious explanation was incorrect, but still had ample time to contribute to the narrative of a growing Iraqi threat that was used to justify U.S. air strikes.

The true source of the Conficker worm that was first discovered in 2008 remains unknown, but that did not stop initial reports from assigning blame. 60 Minutes linked it and other recent attacks to Russia and showed pictures of ostensible suspects, who turned out to be Finnish students with no involvement.^{Footnote 56} Some cybersecurity researchers claimed that the virus was the work of the U.S. and Israel because of similarities with Stuxnet.^{Footnote 57} Subsequent investigations indicated that it may have come from Ukraine or China. In 2015 investigators from Trend Micro blamed Khalid Samraa for an attack on Israeli government systems. As a resident of Gaza with loose connections to the attackers’ control server, he was an obvious suspect and investigators made efforts to link him with anti-Israeli groups. Samraa denied the accusations, prompting further investigations that uncovered mistakes in the initial attribution.^{Footnote 58}

In 2013 an attack on France’s TV5 attempted to physically destroy their computer infrastructure. An Islamic State affiliate called Cyber Caliphate claimed responsibility, and the attackers left jihadist propaganda on the station’s website. This version of events was widely accepted because it came soon after the Charlie Hebdo killings and seemed to make sense in light of trends in kinetic terrorism. Investigations found that the attack more likely came from Russian hackers taking advantage of the perceived threat from Islamic State.^{Footnote 59}

As forensic research advances, this strategy of masking attacks behind plausible threats may also gain ground. Cybersecurity researchers have found evidence of attackers concealing themselves by using foreign languages and components of previous malware linked to other actors, most commonly relying on materials associated with countries that are frequently blamed for cyberattacks: Russia, China, Iran, and North Korea.^{Footnote 60} Existing animosities also facilitate attacks by third-party states and non-state actors. For example, tensions between Russia and the United States mean that the countries are unlikely to cooperate fully during investigations, which makes Russia an ideal conduit for anyone attempting to attack the United States without being investigated. Thus, attackers may take advantage of existing rivalries to compound the attribution problem, and in doing so perpetuate blame feedback loops.

It may usually be accurate to explain attacks with reference to existing rivalries or conventional conflicts, but this is a dangerous strategy to pursue when publicly identifying an attacker. It may have been correct to link the attacks against Estonia and Georgia to Russia, but such claims intensify hostilities with Russia and foreclose alternative possibilities when Russian government responsibility was far from certain. Assigning blame based on past relationships and assumptions about strategic interests reifies the relations of enmity between states, creating a blame feedback loop. It constrains us to interpreting novel events in terms of past events, entrenching hostilities even when they might otherwise subside and obscuring emergent threats. Each unidentifiable attack can be assigned to an existing enemy, and each attack assigned to that enemy reinforces the perception that it is indeed an enemy and encourages blame to be attributed to that enemy in the future.

Regardless of their true source, attacks can usually be given a convincing explanation by appealing to strategic interests and existing hostilities. We can predict with a high degree of certainty that the next major attack against the United States or its NATO allies will be linked back to Russia or China. An attack on Russia, China, or Iran would probably be linked to the United States. The concern is that this will happen regardless of where the attacks appear to come from or whether it is impossible to trace them back to a particular source. Past attacks and expectations of future conflicts inform judgments of unattributed attacks, fitting these into patterns of behavior that are used to interpret rivals’ actions. The imperfectly attributed attacks then form part of the body of evidence by which future attacks are judged, slowly building a sense of precedent even though the specific incidents that comprise that precedent may be plagued by their own attributional doubts. Assigning blame in this way appears obvious and therefore threatens to draw the public into a false sense of certainty. It is all too easy to instinctively blame the usual suspects without sufficient evidence, but looking beyond them and considering new potential culprits requires the kind of clear evidence of responsibility that is unlikely to be forthcoming—or that will at least take extensive forensic work to assemble.

The tendency to explain attacks in terms of the most prominent existing rivalries invites efforts by lesser rivals or non-state actors to trigger hostilities. As the risk of being caught diminishes, the costs of attack decrease and the potential benefits become even more attractive, lowering the threshold for conducting cyber operations and allowing actors that could not compete in conventional conflicts to launch strikes. Eun and Aßmann argue that “states are more likely to conduct cyber-attacks as the risk of severe consequences are considerably lower than with conventional forms of attack—particularly as the event and the aggressor are evident in physical attacks.”^{Footnote 61} The relatively low cost of cyberattacks, both in terms of resources and in terms of the low likelihood of being blamed, makes these more appealing for marginal rivals and incentivizes them to strike when they are low in the hierarchy of potential suspects. States, terrorists, and criminals who are not part of the entrenched relations of enmity that tend to structure explanations of fault for cyberattacks may exploit the opportunities offered by blame feedback loops to launch attacks at a reduced chance of detection or to incite disagreement between the rivals that will reproach each other in the aftermath. This compounds the attribution problem by increasing the number of actors that could potentially be involved and making it difficult to even determine the nature of an attack—whether it was war, espionage, terrorism, theft, or a purposeless display of malice and technical expertise.

Cultivating Conspiracies

When cyberattacks are first identified, the limited information available is highly susceptible to elite framing and to being fit into blame feedback loops. Alternative frames may become available once investigations have run their course, but this leaves time for the initial attributions to gain traction and dominate the initial media coverage. The tendency to blame obvious culprits may also prevent the alternative frames from developing, as investigators have limited resources and may not invest them when the source of an attack appears to be obvious or when there is a low chance of success.^{Footnote 62} Any attempts to alter the initial attributions must therefore take the form of corrective frames that arise later, rather than competing frames that are contemporaneous with the attack. Studies have shown that corrective information is rarely able to counteract misperceptions and that persuasion can exacerbate them by repeating the incorrect information.^{Footnote 63} It is difficult to update beliefs once they have been accepted even under the ideal circumstances when compelling information is uncovered,^{Footnote 64} and when it comes to cyberattacks the corrective information may simply be a different perspective that is not conclusive.

The long-term consequence of framing attack attributions based on inconclusive evidence, especially at the critical junctures immediately after shocking events when existing biases are more susceptible to change, is persistent misperception about cyberattacks that can develop into conspiratorial thinking. As Oliver and Wood point out, popular conspiracy theories are heavily guided by elite discourses and acceptance of previous conspiratorial frames. “Like ordinary public opinion, conspiracist opinion is highly influenced by encounters with elite discourse, in this case the conspiracy narratives.”^{Footnote 65} Surprisingly, they find that people with a high level of political knowledge can be susceptible to conspiracy theories because they are responsive to elite frames and adept at interpreting new information to fit existing beliefs. The higher initial dependence on elite frames when it comes to cyberattacks indicates a higher likelihood of conspiratorial thinking compared to kinetic attacks.

Of course, there is more to conspiracy theories than attributional uncertainties and elite framing. Conspiratorial thinking is widespread, affecting virtually every issue area, including kinetic attacks for which there is clear evidence pointing to the attackers. The 9/11 truth movement demonstrates the persistence of conspiracy theories against corrective information. Multiple studies have shown that certain predispositions can make people more susceptible to conspiracies.^{Footnote 66} This helps to account for conspiratorial thinking when evidence is available and multiple frames exist.

Predispositions clearly matter, but their influence is felt in conjunction with the available information. Zaller argues that “every opinion is a marriage of information and predisposition: information to form a mental picture of the given issue, and predisposition to motivate some conclusion about it.”^{Footnote 67} Garrett argues that rumour “spreads among a group of people because it promises to resolve uncertainty or provide new insight into important social or political phenomena.”^{Footnote 68} Miller, Saunders, and Farhart find that “however far-fetched the theory might be, tying up confusing events with a simple, neat conspiratorial bow fulfills the individual’s need for order and reduces concomitant anxiety.”^{Footnote 69} And Konkes and Lester argue that conspiracies tend to emerge over time when information is not forthcoming and audiences develop a sense that something is being hidden. Moreover, some of the relevant predispositions relate to how information is processed.^{Footnote 70} Swami et al. find that people who are less disposed to conspiratorial thinking tend to show a more analytical thinking style that is characterized by careful attention to the available evidence, while those predisposed to conspiratorial thinking tend to rely more heavily on intuition that does not account for the available evidence.^{Footnote 71} With this in mind we should expect that when limited information is available and heavily shaped by elite gatekeepers, intuitive thinking will become the default mode of processing.

One of the predispositions that correlates strongly with conspiratorial thinking is prior acceptance of conspiracy theories,^{Footnote 72} and this raises another challenge beyond the shortage of information. Many people have factually inaccurate perceptions of kinetic attacks, but it is usually possible for researchers to identify these inaccuracies and to label them as conspiratorial based on the kinds of explanations being posited. For example, Swami and Furnham define conspiracy theories as “a subset of false beliefs in which the ultimate cause of an event is believed to be due to a plot by multiple actors working together with a clear goal in mind, often unlawfully and in secret.”^{Footnote 73} With fewer facts available, it is more difficult to say whether frames related to cyberattacks are conspiratorial in the sense of being false. Uscinski et al. define a conspiracy theory as “a proposed explanation of events that cites as a main causal factor a small group of persons (the conspirators) acting in secret for their own benefit, against the common good.”^{Footnote 74} In other contexts this is an excellent definition, but it would cover virtually every cyberattack. By both of these definitions, publicly available information about cyberattacks will likely seem conspiratorial regardless of whether it is accurate. In a sense, we must accept explanations that have some characteristics of conspiracy theories to understand cyberattacks and must therefore develop some predispositions towards conspiratorial thinking.

Consider the Stuxnet attack for example. It was launched by a still unidentified group of clandestine American and Israeli operatives, concealed itself from system administrators, and relied on forged authentication or stolen documents. Related worms were found capturing computer screenshots, recording audio, and accessing webcams in foreign government offices in at least seven countries.^{Footnote 75} Investigators and leaks have established these points with a high degree of confidence, but the attack still embodies defining characteristics of conspiratorial thinking based on the given definitions. Accepting that such an attack happened (as we should) lures us towards a predisposition to accepting similar conspiratorial accounts in the future.

Conspiratorial thinking is sometimes accurate, but it is dangerous in a security context because it fosters a tendency to misidentify threats. Libicki notes that “if events in the real world are indicative, the popular tendency will be to assume that any spectacular computer failure resulted from hostile action.”^{Footnote 76} One of the most famous suspected cyberattacks arguably falls into this category. In 1982 the Urengoy-Surgut-Chelyabinsk natural gas pipeline in Siberia exploded. Former CIA agents later claimed to have caused this by installing infected software that was set to malfunction.^{Footnote 77} Rid challenges this story with contradictory reports and contends that it was technically impossible at the time. This leaves the nature of this event, which would be the deadliest cyberattack in history, in doubt.^{Footnote 78}

That incident is symptomatic of the ambiguous threats that are continually emerging in cyberspace. In July and August 2016, Iran’s oil and natural gas infrastructure was struck by a series of explosions. Iranian officials said that they were investigating the possibility that these were triggered by a cyberattack.^{Footnote 79} Thus far, research indicates that this account is incorrect and that mechanical faults were the cause, but with worms like Stuxnet disguising themselves as mechanical errors, there are certain to be lingering doubts. Those involved in Stuxnet hoped for this outcome, predicting that their strike would spread paranoia about critical infrastructure threats.^{Footnote 80} From the attacker’s perspective, building a predisposition towards conspiratorial thinking may be a key objective that imposes ongoing costs associated with misattribution and fear.

It is difficult to find any genuine cases of cyberattacks causing infrastructural damage aside from Stuxnet, and as I pointed out previously, there is a pattern of power outages being misidentified as cyberattacks.^{Footnote 81} The apparent cyberattacks that turned out to be trees seem laughable in hindsight, but they are difficult to distinguish from genuine threats. A series of power outages in Ukraine in 2016 were blamed on Russian hackers. Based on the available evidence, these attacks appear to be genuine.^{Footnote 82} However, it is disconcerting that genuine attacks so closely resemble the many preceding false alarms, and this will likely support future claims of infrastructure attacks before all the evidence is in. The ultimate cost of conspiratorial thinking may be an increased incidence of false alarms, growing doubt for official explanations of real attacks resembling those false alarms, and increased difficulty in forming a consensus about the presence or absence of threats to national security.

The Threat to Democratic Accountability

Thus far, I have dealt with attribution as a challenge related to correctly identifying the perpetrator of an attack, but the effects I have described point to another attributional concern: whether citizens are able to hold policymakers accountable for failing to take adequate defensive measures or for poor responses to them. Exercising popular sovereignty presupposes that citizens have relevant information about who is responsible for major events. “Proper blame (and credit) attribution is necessary for citizens in a democracy to hold elected leaders accountable—they must first form an opinion of who should be held responsible for mistakes (and successes) before forming retrospective performance evaluations or casting their ballots.”^{Footnote 83} This is borne out in decades of research in political psychology showing that performance evaluations are not as straightforward as simply judging the available facts.^{Footnote 84}

Drawing on my previous points, it is clear that the attribution problem poses a significant barrier to retrospective evaluations of elected officials’ performance when looking purely at what the facts indicate. If it is difficult to determine when an infrastructure failure is the result of a malfunction or an attack, then the public will likewise struggle to make sense of what it means in terms of leadership performance. If attacks are hidden from view or uncovered long after they initially occurred, then they may not be on the electorate’s agenda at all. If past attacks yield unreliable clues about future threats, then voters could struggle when deciding what security concerns to prioritize. However, situating cyberattacks in their political context requires looking beyond information shortages to consider other influences on opinion formation.

Politicians at all levels have motives for deflecting blame for failed security policies onto others, and routinely demonstrate their skill in doing this.^{Footnote 85} The extent to which they are able to succeed partially depends on the issue at stake and the structure of government institutions involved. Responsibility for economic issues tends to be shared by multiple actors. It is susceptible to diffusion and heavily influenced by partisanship.^{Footnote 86} The security context is somewhat more straightforward. Partisanship still matters there, but “the public tends to view national security policy as the sole domain of the executive.”^{Footnote 87} Cyberattacks fall into the security domain. However, the blame assessment processes may share some characteristics with economic judgments because of the ambiguities these entail. Cybersecurity is also less clearly centralized under executive control than kinetic military power, as much of it comes from the private sector and secretive defense agencies. This, combined with extensive evidence of partisan cues affecting responsibility attributions in other domains^{Footnote 88} is grounds for expecting that partisanship will heavily influence how citizens respond to cyberattacks.

The 2016 U.S. presidential election reveals how partisan framing can compound existing challenges when assigning blame. The Clinton campaign’s failure to take adequate measures to protect e-mail became a central point in the effort to show that she was unfit to become president. Conversely, reports that Donald Trump incited the hacking helped Democrats make the case that he was collaborating with foreign leaders to rig an election.^{Footnote 89} Public opinion polls reveal that acceptance of these narratives is sharply divided along party lines.^{Footnote 90} Trump’s presidency has been marred by accusations of complicity in Russian hacking, with ongoing investigations aimed at uncovering those deeply problematic attributional links. Here the intermingled challenges of identifying attackers and identifying fault among officials join together. Any conclusions investigators reach are certain to be decried by the party they adversely affect, and the vagaries of attribution will assist that narrative.

The election also showed some of the risks associated with voters being able to express their party preferences at the polls. The Federal Bureau of Investigation looked into suspected attacks on electoral computer systems in Arizona and Illinois and said that information from around 200,000 voters was compromised.^{Footnote 91} Donald Trump capitalized on those and other attacks by fueling fears that the election results would be fraudulent and that hackers could tamper with computer systems to make him lose. Insisting that some unnamed source could do this following a series of earlier attacks on electoral computer systems generated a conspiratorial narrative and cast doubt on the election results and consequently on the quality of American democracy. American law enforcement officials cited this as a serious concern and warned that paranoia over a potential cyberattack could make it possible for even fraudulent evidence of hacking to undermine public trust in the electoral system.^{Footnote 92}

Unfortunately, effective cybersecurity may require states to rely more heavily on deception, exacerbating attribution difficulties both in the sense of the public seeing who is responsible for launching attacks and for judging elected officials’ decisions. Gartzke and Lindsay argue that the United States and other countries that come under persistent cyberattacks can find strength in a defensive posture if they are willing to embrace the deception that makes offensive cyber operations so successful.^{Footnote 93} They say that defenders can create “a virtual minefield” that will ensnare intruders by tricking them into downloading malware or accessing misleading information. This is worthwhile advice that may improve security, yet it depends on the elite focus that is so prominent in the literature. For example, the authors say that “deception masks or adds information in order to influence indirectly the beliefs that affect an opponent’s voluntary decisions to act.”^{Footnote 94} They may be right in thinking that deception provides the greatest defensive advantages, but the same actions that mislead opponents are also apt to mislead domestic and international audiences.

Deceptive strategies like producing state-sponsored malware and releasing false information about the extent of attacks could increase public concern over how covert operations are being conducted in cyberspace, just as covert operations have generated criticism of counterterrorism operations.^{Footnote 95} Effective defense may therefore depend on making an already murky security domain more opaque for those citizens who are supposed to be in a position to exercise democratic oversight over government functions. Even if we assume that the deception is in these citizens’ best interests we must confront the inevitable result that denying them information aggravates the challenges associated with blame attribution. The fact that the denial comes at the hands of the government may be especially damaging, as this lends additional credence to the conspiratorial thinking that a small group of elites may be launching secretive attacks and keeping information away from public view.