The Politics of Attributing Blame for Cyberattacks and the Costs of Uncertainty

Abstract

Attribution is one of the most serious challenges associated with cyberattacks. It is often difficult to determine who launched an attack and why, which hinders efforts to formulate appropriate responses. Although the attribution problem has been discussed extensively in research on cybersecurity, it is generally approached as a technical challenge for security professionals and politicians. I contend that it is vital to take the attribution problem beyond this elite focus by considering how attributional challenges can interfere with the public’s efforts to understand security challenges and evaluate government actions. Faced with uncertainty and the confusion of attempting to understand novel cyber threats, citizens frequently lack the information they need to reliably identify the culprits behind attacks—or sometimes even to know whether an attack has taken place. I show that attributional uncertainty immediately following cyberattacks encourages dependence on a narrow range of elite frames and the assignment of blame to familiar enemies. Over time this promotes conspiratorial thinking and poses a risk to democratic accountability. When seen in light of these broader costs, the attribution problem becomes a vital political concern with implications that reach beyond the scope of elite-focused cybersecurity research.

Cyber Security Responsibilization: An Evaluation of the Intervention Approaches Adopted by the Five Eyes Countries and China

“…As noted by Harknett and Stever (2011, 455–456), the “cyber security problem does not fit conventional or traditional security categories based on individual security responsibilities, economic or corporate security issues, military security problems, as well as domestic versus international problems.” The struggle, in determining the origins and impacts of a cyber attack, is “generally approached as a technical challenge for security professionals and politicians” (Schulzke 2018, 954). Schulzke (2018) argues that attributional challenges can affect a citizen's ability to cognize security challenges as well as evaluate government actions; this ambiguity often leaves citizens repeatedly missing the required information to ascertain dependably the attack perpetrators. Schulzke (2018, 954) presents that “attributional uncertainty immediately following cyber attacks encourages dependence on a narrow range of elite frames and the assignment of blame to familiar enemies.”…”

“…Citing the paradox in the current policy‐making environment (de Bruijn and Janssen 2017), as well as other authors suggesting the murky pitfalls of attribution (Schulzke 2018), recent scholars have called for the framing of cyber security dialogue. Some have raised concerns about the apparent responsibilization of individuals for cyber security, comparing it with stances related to similar societal contagion‐type risks such as disease and fire (Renaud et al 2018).…”

Contested public attributions of cyber incidents and the role of academia

“…More recently, scholars are focusing on public attribution, including whether and how to build an international organization aiding attribution processes (Eichensehr, 2019(Eichensehr, , 2020Finnemore & Hollis, 2017, pp. 475-476, 2019Grindal, Kuerbis, Badiei, & Mueller, 2018;Schulzke, 2018;Solomon, 2018). Reflections on the legal, and naming and shaming aspects of public attribution help to clarify the international normative function of public attribution (Eichensehr, 2020;Finnemore & Hollis, 2019), whilst analysis of institutional policy proposals shows potential ways towards improving transparency and credibility problems (Egloff & Wenger, 2019;Eichensehr, 2019Eichensehr, , 2020Grindal et al, 2018;Solomon, 2018).…”

“…This article focuses mainly on this second part of the process, namely, what happens after an incident is publicly attributed. Schulzke (2018) has suggested some theoretical reasons why we should pay careful attention to the effects of public attribution of cyber incidents. Drawing on psychological research, he argued that people do not like ambiguity when searching for explanations of unexpected threatening events (p. 957).…”

“…In addition, because cybersecurity as policy issue is distributed amongst different stakeholders, responsibility is diffused and susceptibility to partisanship increases. From these four mechanisms, Schulzke (2018) concludes, the public should be sensitized to the problem and to a security context in which blame takes time to establish. It would be prudent for policymakers and journalists to avoid a rush to judge who is responsible for an attack, regardless of how obvious the answer may initially seem.…”