When Intelligence Agencies Publicly Attribute Offensive Cyber Operations

In January 2021, U.S. intelligence agencies—the Federal Bureau of Investigation, the Office of the Director of National Intelligence, and the National Security Agency—and the Cybersecurity and Infrastructure Security Agency publicly attributed the SolarWinds cyber intrusion to an unnamed “Russian actor.” Four months later, in April 2021, the Biden Administration explicitly named the perpetrator as the Russian Foreign Intelligence Service. This raises the question: Is there a role for intelligence agencies—which traditionally work behind the scenes—in public attribution of offensive cyber operations? If so, what are the features that make these agencies useful in such public announcements? To answer these two questions, this article examines the emerging phenomenon of U.S. intelligence agencies publicly attributing offensive cyber operations and identifies three features that make these agencies effective in public attribution: they send signals below the adversary’s escalation threshold, offer credibility and nonpartisanship, and have partnerships that enable them to succeed in the attribution process. The SolarWinds and the Democratic National Committee intrusions are used as illustrative case studies to examine this phenomenon. This research highlights an attribution path that has been understudied, which serves scholars working at the intersection of cyber operations, intelligence, and decisionmaking and practitioners tasked with determining the appropriate response after an offensive cyber operation took place

Business · Business Intelligence · Computer security · Data mining · Offensive · Operations research · Political science · Computer Science · Cybersecurity and Cyber Warfare Studies · Engineering · Information and Cyber Security · Intelligence, Security, War Strategy