Contested Public Attributions of Cyber Incidents and the Role of Academia

This article argues that public attributions of cyber incidents display a skewed version of cyber conflict. This is because the government and industry actors involved are driven by political and commercial interests as well as legal constraints. In addition, public attribution of cyber incidents takes place in a heavily contested and information poor environment, creating opportunities for actors to promote their narrative on who is responsible for incidents. The article uses three cyber incidents to show how actors cope with this contested information environment: Sony Pictures in 2014, the Democratic National Committee in 2016, and NotPetya aimed at Ukraine in 2017. To address public attribution challenges, the author contends that there is a need for academic interventions in this area. However, this would require interdisciplinary research on all aspects of attribution (not just in cybersecurity) and independent research on the state of cyber conflict.