The Politics of Attributing Blame for Cyberattacks and the Costs of Uncertainty

Abstract

Attribution is one of the most serious challenges associated with cyberattacks. It is often difficult to determine who launched an attack and why, which hinders efforts to formulate appropriate responses. Although the attribution problem has been discussed extensively in research on cybersecurity, it is generally approached as a technical challenge for security professionals and politicians. I contend that it is vital to take the attribution problem beyond this elite focus by considering how attributional challenges can interfere with the public’s efforts to understand security challenges and evaluate government actions. Faced with uncertainty and the confusion of attempting to understand novel cyber threats, citizens frequently lack the information they need to reliably identify the culprits behind attacks—or sometimes even to know whether an attack has taken place. I show that attributional uncertainty immediately following cyberattacks encourages dependence on a narrow range of elite frames and the assignment of blame to familiar enemies. Over time this promotes conspiratorial thinking and poses a risk to democratic accountability. When seen in light of these broader costs, the attribution problem becomes a vital political concern with implications that reach beyond the scope of elite-focused cybersecurity research.