Basically what cyphunk is saying is: how do we know that this was used by the NSA? More precisely: how does Spiegel know to say "clear proof that Regin is in fa

Basically what cyphunk is saying is: how do we know that this was used by the NSA? More precisely: how does Spiegel know to say "clear proof that Regin is in fact the cyber-attack platform belonging to the Five Eyes alliance"? We have something out in the wild (Regin) which contains a component (QWERTY) which was leaked in the Snowden documents, however it is quite possible that both descend from a common non-NSA source (Putative) such that: P (non-NSA) / \ Q R (non-NSA) (NSA) Furthermore it is possible that in fact P = R, and that Q was derived from Regin rather than the other way around. Lots of possibilities are out there. We don't really have proof that P = Q and that therefore R also belongs to the NSA. The issue is that we can attribute malicious attacks to R, and the article seems to be suggesting that therefore we should attribute these to the NSA. The reply by cyphunk is saying that this is a dangerous logical leap.