Tag Archives: Attribution

Panel on election disruption

Yesterday I attended an online panel organized by the Atlantic Council with government (Matt Masterson of CISA), think-tank (Alicia Wanless of the Carnegie Endowment for International Peace and Clara Tsao of the AC’s DFRLab) and industry figures (Nathaniel Gleicher of FB and Yoel Roth of Twitter) on steps being taken to guarantee the integrity of the electoral process in the US this Fall. The general sense was that the current ecosystem is much less vulnerable to disinformation than the last presidential cycle, four years ago, and this despite the unprecedented challenges of the current election. However, the most interesting panelist, Wanless, was also the least bullish about the process.

Cyberwarfare articles

A couple of scholarly articles read today on cyberwarfare. The first, a long piece by James Shires in the Texas National Security Review, speaks to a long-term thread of interest for me, namely the (imperfect) mapping of real-world alliances with operations in the cyber domain: the UAE, Qatar, and Saudi Arabia, although strategic partners of the US in the Gulf region, nonetheless targeted Hack-and-leak (HLO) operations at the US.

Shires underscores the patina of authenticity that leaks hold, and does a good job of showing how HLOs connect them with Bruce Schneier’s concept of “organizational doxxing”. In describing these HLOs as “simulations of scandal “, he leverages theoretical understandings of the phenomenon such as that of Jean Baudrillard. Standards of truth emerge as a major object of manipulation, but the key stake is whether the public will focus on the hack or the leak as the essence of the story.

The second article, by Kristen Eichensehr at justsecurity.org, reflects on the technical and legal process of attribution of cyberattacks. It argues in favor of the creation of a norm of customary international law obliging States to provide evidence when they attribute acts of cyberwarfare to a State or non-State actor. How to guarantee the credibility of the evidence and of the entity providing it (whether a centralized international body, a government agency, or a think-tank, academic institution, or private company) remains somewhat vague under her proposal.