Such a Digital Geneva Convention will be utterly useless, and perhaps even counter-productive, until we have solved the attribution problem.[1] Until that is s

Such a Digital Geneva Convention will be utterly useless, and perhaps even counter-productive, until we have solved the attribution problem.[1] Until that is solved, we risk misuse of a Digital Geneva Convention to impose sanctions against innocent players. Like with the real Geneva Convention, prevention is harder and not that sexy, but leads to much better long-term results: Invest in improving software security, run bug bounties, enforce accountability at least for non-free software. And, of course, resolve the conflict of interests within the state, e.g. by making clear that police and intelligence are going too far when they buy zerodays[2] and spread malware[3]. [1] Right now, attributing attacks to their origin is idle speculation. Every larger attack is initially attributed to the currently popular scapegoats, with "evidence" that is essentially based on coffee grounds reading. [2] Buying zerodays creates an incentive for people to keep the volunerabilities they found secret, instead of publishing and fixing them. Moreover, these create an incentive to insert such "bugs" (backdoors) in the first place. [3] ... or force other to build backdoors into their software, which is in effect almost the same as spreading malware.