Thread by @egflo

My paper on “Public Attribution of Cyber Intrusions” was published in the Journal of Cybersecurity (@OUPAcademic). It's open access so everyone can have a read. I summarize the main insights in the thread below:
academic.oup.com/cybersecurity/…

Drawing on the intelligence studies literature, I argue that public attribution is employed to shape the “rules of the game” and thereby shape the normative and operational environment for cyber operations.

I split attribution into sense-making and meaning-making processes: sense-making process refers to the knowledge-generation process that establishes what happened, the meaning-making process to deliberate actions that influence how others interpret a particular cyber intrusion

Theoretically, I embed public attribution in intelligence studies literature (e.g. @carsonaust @AllieCarnegie @RoryCormac). I argue one function of public attribution is to establish and uphold a specific kind of interaction order, often referred to as the rules of the game

By doing so, I position myself in the debate on whether cyber is an intelligence contest or has led to a different type of competition (cc @JoshRovner1 @jonlindsay @Maxwsmeets @harknett_uc)

Empirically I show that in the cases investigated, attribution is normalized and folded into the regular national security policy process, demonstrating that at the strategic level, the attribution process in cyberspace is not unique

I make a three-step argument: 1.States do not deal with cyber intrusions as incident-based decisions, but contextualize them in a broader framework of relations with the intruder, focusing on identifying the strategic intent of adversary campaigns(cyber and non-cyber activities)

2. The political decision whether to attribute publicly is not only signalling to the adversary, but also shapes the future operational environment, particularly when the aim is to establish rules of behaviour, i.e. to establish and stabilize a particular interaction order.

3. Over time, such a norm shaping effect has the potential to exert an independent deterrent effect, irrespective of other consequences being imposed.

I also highlight that public attribution can be used for multiple other purposes. For example, the NSA/FBI disclosures of the GRU tooling is a counter-threat activity, i.e. keeping the adversary busy (CI, retooling), which can be gruelling and costly.

There is much more in the article, including a theoretically based explanation on why states have moved to attribution coalitions (building on @AllieCarnegie & @carsonaust’s explanation of the credibility problem)

As with any academic work, I build on work done by, and conversations I had with, the wider academic & practitioner community, as well as the feedback of the peer-reviewers. Thank you all for your feedback, interest, and engagement!
#ThreatIntel #attribution #intelligence

And, as @Twitter doesnt have an edit button: it's @jonrlindsay that I meant, of course. the one having done great work on deception and attribution, some even in the same journal :-)
academic.oup.com/cybersecurity/…