I can't see the answers, but I can reasonably fill in the blanks on what questions they'd have asked. If they have HUMINT they're risking their source with any

I can't see the answers, but I can reasonably fill in the blanks on what questions they'd have asked. If they have HUMINT they're risking their source with any public statement of attribution at all: it's obviously not worth burning a source just over making this public. Useful SIGINT will primarily be historic metadata lookups of contact with relevant proxies - which unfortunately has a huge false positive rate, useful really only for tentatively ruling actors out. Ignore that and you could point the finger at just about anyone.