Many techniques and tools exist to intentionally obfuscate the source of an attack. Furthermore, the most sophisticated assaults are designed to morph with each stage of the deployment so the strategy itself is also hidden. This can be done many ways, but the intent is always the same, to further mask the original target and the method of the offensive attack. That way when the forensic computer scientists come knocking all they will find are empty cyber shell casings, of the most generic type, devoid of any usable digital fingerprints. If there are clues, it’s very likely those were planted to frame a believable third party so that retribution will result in a secondary attack perhaps on the actual intended target. Suppose you whack the biggest bully in school on the back of the head, and quickly your friend assigns blame to your enemy, who also just happens to be standing there. Now you know the bully will deliver a far more destructive attack than you ever could so why wouldn’t you leverage such a strategy. If it’s executed properly only you and your buddy will ever really know what happened.

Why is attribution important? Because the US, and other countries, have publicly stated that given the void of international cyber warfare case law a significant attack in cyberspace will be met with a declaration of war. Attacking nations of the world have been put on notice to expect both a kinetic and a cyber response. Not responding will be seen as a sign of weakness. So what does a country do though when attribution is murky or impossible? Are they justified in launching their own covert stealthy cyber attack?