Conference Proceeding

Modelling Attribution

Guitton, Clement

2013

Overview

This article posits that attribution is better approached as a process than as a problem. Departing from models for attribution emphasising its technical constraints, the article distinguishes between two distinct attribution processes operating in two different contexts and answering two different questions. On one hand, in a criminal context, the attribution process seeks to identify individuals who launched cyber attacks. On the other hand, in a national security context, the process seeks to identify adversaries which may have sponsored cyber attacks. Five elements can serve as determinants to distinguish between the two processes: the type of target, the severity and scale of the damage, the apparent origin of the instigator of the attack, the means of the attack, and lastly the claims by political groups. After reviewing these elements, the article analyses how the constraints and characteristics of the two different attribution processes vary in terms of responsible authority, standard of evidence, stake in play and relevance of timing for attribution. In a criminal context, the collection of digital evidence is of primary importance to be able to reach a high level of judicial proof. However, in a national security context, investigators will likely not have access to evidence but only to intelligence, and the decision of attribution will not be taken within the judiciary but within the executive (e.g. a government). As such, attribution of national security incidents requires a form of political judgement to heed the political context and circumstances of the incidents that courts do not need to consider when examining the guilt of criminals. Political judgement is also required to balance the consequences of attribution on a political level, potentially resulting in a straining of relations with other international actors. As the constraints between the two different attribution processes differ, their requirements for easing the constraints also vary. [PUBLICATION ABSTRACT]

• Publisher: Academic Conferences International Limited
• Subject: Alliances / Attribution / Computer viruses / Computers / Constraints / Corporate sponsorship / Courts / Evidence / Guilt / Intelligence / Interest groups / Internet / Judiciary / National security / Offenders / Political factors / Variables