> Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn't it?

> Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn't it? Not really, just because attacks come from a certain country domain does not mean that said countries government is sponsoring said attacks. Even the CIA/NSA use hijacked foreign servers for their operations, that's why attribution of this stuff is so difficult. I'd also be interested in how you define "large and coordinated attacks" because if you track by something like Norse Attack Map [0] then your Occam's Razor would suddenly point at the US, at least right now. > Yes, but if no speculation is allowed until after a conviction then how would anyone ever be investigated? We would never be able to accuse anyone of anything! There's a difference between "speculation" and flat out misrepresenting the probabilities. At this point, it should be pretty clear, especially to any expert in the field, that the Internet is a massive force multiplier and the regular rules of "You need big influence to have big impact" have pretty much never applied to it. People need to account for that in their attempts at attribution instead of going the lazy route of blaming "The axis of evil" for it, which this lazy China/Russia/NK attribution basically boils down to. [0] http://map.norsecorp.com/#/ http://map.norsecorp.com/#/