The question should not be "can hacks be attributed by digital evidence alone" of course they can. The question should be, in this specific case: 1. How much e

The question should not be "can hacks be attributed by digital evidence alone" of course they can. The question should be, in this specific case: 1. How much evidence do we have? 2. How hard would it be for the hackers fake this evidence? 3. Are there any signs of forgeries? For instance logs that don't agree, file system artifacts, etc... 4. What were the capabilities of the attacker? The longer a hack goes on and the larger its scale the harder it gets to forge 100% of the evidence. >All of this makes a convincing story for media and laymen, but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any nation/state who's modus operandi are known in hacking circles, no? I would say no, doing that is very difficult and is not trivial to do. All cases I've read up on, such as stuxnet, flame, APT-1 etc..., had clues as to the origin of the malware and such clues were left in the malware accidentally.