Attribution, delayed attribution and covert cyber-attack. Under what conditions should the United States publicly acknowledge responsibility for cyber operations?

Abstract

Self-attribution is a public declaration of responsibility for the conduct of an operation. It is distinguished from covert operations, where perpetrators provide no such acknowledgement and attempt to conceal their identities. Although self-attribution is always an option, this thesis examines legal and strategic reasons for a nation state to publically acknowledge its role in the conduct of a cyber-operation. The central result is that whereas neither international law nor national policy requires self-attribution, under certain strategic conditions it may be preferred.