Florian Profile picture
15 Sep, 13 tweets, 6 min read
My paper on “Public Attribution of Cyber Intrusions” was published in the Journal of Cybersecurity (@OUPAcademic). It's open access so everyone can have a read. I summarize the main insights in the thread below:
Drawing on the intelligence studies literature, I argue that public attribution is employed to shape the “rules of the game” and thereby shape the normative and operational environment for cyber operations.
I split attribution into sense-making and meaning-making processes: sense-making process refers to the knowledge-generation process that establishes what happened, the meaning-making process to deliberate actions that influence how others interpret a particular cyber intrusion
Theoretically, I embed public attribution in intelligence studies literature (e.g. @carsonaust @AllieCarnegie @RoryCormac). I argue one function of public attribution is to establish and uphold a specific kind of interaction order, often referred to as the rules of the game
By doing so, I position myself in the debate on whether cyber is an intelligence contest or has led to a different type of competition (cc @JoshRovner1 @jonlindsay @Maxwsmeets @harknett_uc)
Empirically I show that in the cases investigated, attribution is normalized and folded into the regular national security policy process, demonstrating that at the strategic level, the attribution process in cyberspace is not unique
I make a three-step argument: 1.States do not deal with cyber intrusions as incident-based decisions, but contextualize them in a broader framework of relations with the intruder, focusing on identifying the strategic intent of adversary campaigns(cyber and non-cyber activities)
2. The political decision whether to attribute publicly is not only signalling to the adversary, but also shapes the future operational environment, particularly when the aim is to establish rules of behaviour, i.e. to establish and stabilize a particular interaction order.
3. Over time, such a norm shaping effect has the potential to exert an independent deterrent effect, irrespective of other consequences being imposed.
I also highlight that public attribution can be used for multiple other purposes. For example, the NSA/FBI disclosures of the GRU tooling is a counter-threat activity, i.e. keeping the adversary busy (CI, retooling), which can be gruelling and costly.
There is much more in the article, including a theoretically based explanation on why states have moved to attribution coalitions (building on @AllieCarnegie & @carsonaust’s explanation of the credibility problem)
As with any academic work, I build on work done by, and conversations I had with, the wider academic & practitioner community, as well as the feedback of the peer-reviewers. Thank you all for your feedback, interest, and engagement!
#ThreatIntel #attribution #intelligence
And, as @Twitter doesnt have an edit button: it's @jonrlindsay that I meant, of course. the one having done great work on deception and attribution, some even in the same journal :-)

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Florian

Florian Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!