IMHO "Cyber Attribution" (cough) isn't really something you can do in a serious way. Let's be honest and admit that it's essentially "cui bono?" followed by loo

IMHO "Cyber Attribution" (cough) isn't really something you can do in a serious way. Let's be honest and admit that it's essentially "cui bono?" followed by looking at the locations of the first two C&C layers or something like that. Not saying it's not possible, with low-grade attackers it could be quite easy in some instances. But to actually attribute some attack to some entity you need actionable intelligence, not looking at - very likely consciously spoofed - traces left behind. I think we should also consider the standards for "cyber" (cough) evidence in the light of the recent "junk science in courts" articles showing how real-world evidence is often inconclusive or spoofable. We can't possibly think that it's easier, or more clear, with computers, whose default modus operandi is "fail open".