After the United States blamed China for the Office of Personnel Management intrusion in 2015, China called speculation on their involvement neither “responsible nor scientific.” [1] They subsequently suggested it was “imperative to stop groundless accusations, [and] step up consultations to formulate an international code of conduct...” [2] The US-China exchange raises a critical question: what qualifies as “groundless accusations,” and what would “responsible and scientific” attribution of nation-state sponsored attacks look like? The incident raises another question as well: what is the current US process for attribution, and is it achieving its aims? This paper argues that authoritative attribution of cyberattacks to nation-state actors requires more than purely technical solutions.
Cyber Attribution: Can a New Institution Achieve Transnational Credibility?