The technical characteristics of attribution: Stimson center webinar

Speakers:

 John Hering, Senior Government Affairs Manager for the Digital Diplomacy team,

Microsoft
 Emma Raffray, Chief Research and Analysis Officer, CyberPeace Institute
 Richard Harris, Principal Cybersecurity Policy and Privacy Engineer, MITRE
Corporation
 The Hon. Christopher A. Ford, Director, Center for Strategic Competition, MITRE
Corporation (Moderator) 
 Moderator: Christopher Ford, MITRE Coorporation

John
to say that. It's a new domain of conflict at this point. But it's newest domain of conflict in
cyberspace and certainly one that we are still reconciling with in terms of how to bring
greater security and stability to that space. And to sort of start to build a deterrence
framework. We can have people respect in and adhere to expectations for responsible
behavior in particular, responsible, State Behavior online. Realize first really hinges on
have incredible attribution. It's not like other domains of conflict where there's sort of a
mutable physical evidence in the wake of an attack. And there needs to be some ability for
Nations to point to an attribution statement, and have both trust and confidence in that
and know that can serve as the basis for consequences in responses, following

that's an important place for the conversation to be but getting to the basics of just what
is a Cyber attack. there's, Some different definitions for this. I think different communities.
Think about these things in different terms. There are many different kinds of cyberattacks
that we can see from all kinds of different actors. And that's probably the best way to
think about it is, there's the attack in the incident itself and then there is the actor that is
responsible. Those attacks, they can Target the ICT supply chain or they can be much more
targeted attacks, you can think about poisoning, The Well of a particular type of
technology so that everybody who is using it may potentially be infected with an attack or
something much more targeted at a particular adversary or some sub-national Target. But
then there's also different kinds of malware. So what are you going to do in your particular
attack is it's a ransomware attack for profit, is this spyware? Is this a waiver? That is purely
destructive in nature or is this, you know, on the other side of the spectrum,

something more based on influence and have sponsoring a propaganda campaign. So I

think I would encourage folks to think about this as having those two different elements.
You've The attacker one side, which ranges from state-sponsored or just government-led
cyber operations. And then on the other end of the spectrum, you have just criminal
organizations we're pursuing profit or other some other illicit end. And then you can think
about the attacks themselves either being destructive or targeting the technology itself,
where you'd be exploiting some weakness in the code or otherwise gaining access to harm
someone's information or data. And then on the other end of that Spectrum you would
have influence operations that are Leveraging Technologies to promulgate false
information or to miss the audiences. And we can see a lot of this activity on display
and folks, probably are familiar with

activity, including all the back to the not catchy attack into referencing Chris, and then
attacks They're already taking place in Ukraine as well. I would just been such a hotbed for
such a long time when we think about attribution and understanding these attacks, a lot
of that is they stop with the pro as techniques tactics and procedures ttp's, this is the
attacker behavior that we will observe, and so I won't get too deep into this. But I think
from a right now, we can build further later, the ttp's, you know, this is what you might
look at from a threat Intelligence Center. So you're sort of looking at the attacker activity
across different platforms. And you try to say, okay, well, hey what hours are these people
working? That might tell you something about the geography where they are existing.
What are some of the common attack? The methods or approaches, they might be using
common code that they might be employing common targets that they might be going
after these types of things, constitute tools, tactics and procedures that are you know,
Defenders both at Microsoft government agencies, other technology companies use to
recognize common types of attacks. So I might leave that here. It's just the opening for a
as to how we think about the threat landscape and why this discussion

Moderator (Chris)
Thank you for the framing of I guess can to some extent. Must feel to me like we at the
vocabulary is not adequate to there so I'm a I'm a lawyer who comes out of the military
National Security world and since 11 attack, you mean very specific things, you know
killing people blowing things up, you know, and there's a framework that automatically
applies. Once you start killing people, blowing things up there, you know, you've got
lawyers, she's been entire careers and law for operational …. and so forth. there are
aspects of this form which that could be true, I suppose. But the the range of challenges If
you point to seems enormously broader and I wonder whether we don't even have a
language to start transcribing, and this is something it's awkward to talk about malicious
cyber Behavior or whatever else, but, you know, I'm not sure how you get more specific
than that. That's fascinating. Thank you for the, for that really helpful framing Ric. How did
we turn to you next and help us understand your take on this? And perhaps to, as I
mentioned, that the Tech framework is as one of the pieces that is often talked of in sort
of adjacent to the attribution World, although it maybe not. The same help us understand
that, if youcould and he'll play, the, the stage here for rest of our discussion.

Richard
Thank you Chris, and thanks for the host. It's a pleasure to be invited to this panel and
have this discussion. I thought I'd start by just kind of building on John, Mark a little bit
from artists particularly regarding ttp's and what that means in the context of the attack
framework. So I want to level set the attack frame with a little bit for those of you who
may not be. Be clear with it. So first of all, in fact, framework stands for adversarial tactics
techniques and common knowledge so it's really a model and a framework that was
established in 2015. Not necessarily to attribute actors but to emulate or identify the
behavior ttp's kind of within and that came within the network and in fact was primarily
built for Network defendants, right? So Network defend, it was to better understand, you
know, the Abilities, and their networks and then the things that they need to do in order
to prevent disruption or prevent attacks against their Network. So as a primarily focus on
the defender, it emphasizes as an outcome of using the attack framework attribution but I
think it's useful to think of attribution in a couple different perspectives. At least I do I
think about technical attributes. Patient's right which is attribution related to the types of
information that attack the heck. Repository can organize and it's organized around
behaviors. It's organized around an attack life cycle and it's organ organized, around
advanced persistent threats like actual act. But then there's a policy at the vision piece
that is different. Some extent, it's supported by technical attributes. But fundamentally I
could use to enforce the policy level or governments is really a political decision. It can be
supported or Not by the technical details. So it's also important to remember. I think at
least for me that attack really is supposed attack. Analysis can be used very valuable
primarily for pre-attack, Preparation and planning for Network dependence. And this post-
attack analysis really occurs Insight Network. So attacks really good like that. Get
identifying. What's going on inside networks? It's less good at identifying. The contextual
aspects that occur outside of a particular node working. Attacked pretty much been
around since 2015 I think that the likelihood that it can be a more or continue to be a tool
and become more effective in contributing the kind of data driven policy. Through its
technical analysis will increase over time as the repository, and the information on actors
has built up, correlated and codified. And that, it's also, I think Important to note that
there has been significant uptake amongst security companies industry in the use of
attack for their own internal analysis, and Chris mentioned insurance. I don't know that
there's a lot of uptake and insurance industry on using a CAC to play out. Kind of risk
scenarios, but I think that's an area that attack has certainly suited for and can contribute
you in the Future. So, thank you for this opportunity to talk and look forward to the

Speaker 3: [00:08:56]
to get us going. Yes, you better. Thank you very much for the opportunity to be here
today. And yeah I think I'm going to take a slightly different Thunder sort of Civil Society
organization perspective and a lot of the work that we do is focused on reducing the harm
on people. And so we're sort of looking at attribution from the accountability perspective.
So, in essence, how can we reach accountability by using attribution as one of the steps in
that process? And how do we through attribution and accountability, then allow for the
remediation of victims or Targets in the context of a Tag. And there's another thing also is,
how could we use attribution in terms of better understanding the threat landscape, a
landscape, to be able to better support victims and targets and within the, the pool of
entities that we're supporting. And so, in terms of the work that we do at the size of these
Institute, we actually have a cool Focus which is on documenting and tracking cyber
attacks against certain Unity is, and we've done this in the context of the health care
sector and also in the context of the ongoing and armed conflict in Ukraine and by
documenting and tracking, not just attacks. But also the attributions that have been done
in the context of these different incidents would be better able to understand how
civilians are actually impacted by these attacks. And who is posing posing the greatest
threats and where are these threats coming from? Are they coming from nation states?
Actors are they coming from cyber criminal groups who are doing? So for financial
motives, and I'm sort of really jumping in here and overlapping with a lot of what John was
saying, and in his introductions that we're seeing different types of attacks. Those other
destructive nature. Those are the destructive nature. Those are weaponizing data and
those that are being used to spread disinformation and and in-built distrust in the
community and Society. So yeah, just a brief introduction. I would say that I'm going to
take a sort of take that angle and today and just Also to clarify that at the Institute we
don't actually do attribution ourselves and really the core of our work is looking at how we
do use information from third parties who are attributed, attacks to be able to complete a
better picture of the threats that are there today.

Speaker 2: [00:11:26]
Thank you very much. But if you mention everything, if you all don't specifically do
attribution, I guess, John you all do. And actually I've got, I did it myself. Thank goodness.
No one wanted me to do that. But when I was at the state department, my last last few
months there, the office of the Cyber coordinator reported to me. And they also did
attribution from a policy perspective, but but we did it somewhat differently in the sense
that we treated sometimes by having intelligence information to turn to and I guess
maybe I'll press you a little bit, John on how it is that cyber sleuths actually do their
attribution work when you don't have This collection to add to the mix, you know. It's it's
one thing if you get lucky and see someone talking about having done an attack or or
they're about to do an attack that that certainly makes the attribution piece somewhat
less complicated, but you all are in a sense. I'd imagine a business of building, I guess, from
a sort of legal perspective, might be thought of his kind of circumstantial evidence that
there's anything wrong with circumstantial evidence cases are closed all the time and
quite properly on the basis of that. But, you know, this is making the jump from the victim
was stabbed with a knife to Jack stabbed the victim with a knife is okay, you know, That's
an important conceptual jump. Love to hear more if you don't mind about how, how you
will do that and how you think people should should think about what is in a sense of
probabilistic call in that regard. And how do we, how do we frame that discussion in a
way? That's really useful. It's a really wonderful question Christ. I think it's a really
important one because there's all kinds of different attributions that take place nowadays
and people should be able to differentiate between what they're what each Community is
able to say. As Emma rightly pointed out, there's different kinds of attributions as it relates
to what you can do and what what you're able to say. So from our perspective, there's you
know, Tactical attributions. There is legal attributions and there's political attributions.
And for Microsoft's part, we're able to see that first liver pretty well. We've got we are
limited to the slice of the internet that we're able to observe but it is a fairly you know,
robust slice, just given the different platforms that Microsoft manages. And so we're able
to do a lot to identify technically speaking so it's not you know speculative it it certainly
grounded. In fact you know what has taken place and where Can we save conclusively that
we see, you know, it can make an attribution to a particular attacker that is different than
being able to take the next political step that government agencies with intelligence
resources can take to say, hey, it was done, you know, by this particular government for
this particular purpose and it needs to be this particular consequence. So, what we're able
to do is just to make that technical determination about where an attacker is located and
sort of what,

Speaker 1: [00:14:13]
You know what broader

Speaker 2: [00:14:14]
context is fixed fits into in terms of their technical activities and how we make those
determinations is based on a combination of three different things. The first is just the
observed, you know, malicious activity matching up with known patterns of behavior. So
again, getting back to that. TTP is those just those tactics, do we see those being replicated
by that thing? By that same factor in other spaces. So these are say okay well that's pretty
consistent and then instead observed activity consistent with the objectives of that.
Hacker group that we previously identify the degree to, which we can make that assertion,
that can be quite compelling. And then finally, in this is quite important. It can, we are
other seeing this the same way? Are others in the community of Defenders, also able to
corroborate the things that we are witnessing on our platforms again because we are
limited in terms of the actual slice of the internet that

Speaker 1: [00:15:02]
we're actually able to observe

Speaker 2: [00:15:05]
is not a perfect science here. In terms of what, how much each of those three elements
needs to be evidenced in each. Case we're making in technical education. But those are
the three components that go into this work from again. From a technology perspective
for us to say, hey, it is a group operating out of X geography, 4X purposes. And then we
would obviously leave it to others to make more specify accusations in terms of who the
actual individuals behind those cakes

Speaker 1: [00:15:34]
work. Right.

Speaker 2: [00:15:37]
And Rick from your perspective of working with the, the motor and Tech framework, a lot
of what you're describing thinking focuses upon ex-ante security and preparedness. I
mean, I don't know whether there's a good analog to this but you know, I think of you
want to make sure you're building is appropriately. Safe for your work. I'm here in a biter
office tower for example. Like I assume that there are fire inspectors and you know, OSHA
occupational inspectors and all sorts of folks who at some point. Another one have
visibility into how things are set up here and that'll that'll go into the calculation of
whether this is a viable way to build a building and put people in it. And so forth. Matter
taxing to be more. It's sort of in that mode would rather than fire steel before in the fire
safety inspection mode then in the mode of being an arson investigator but to what
extent do you think things like attack or Frameworks of this sort can be useful in or used
to support? Ha one of the few that I'm aware of his sort of generally applicable
Frameworks for thinking about these challenges that any, I even went on the website
myself and was looking for the drop-down Windows of effects and remediations and so
forth which mostly didn't need much to me. But for folks who are in this business, you
know, it's Jim that universally accessible as a standard but to what way, you know, what
ways if at all do you think is that framework for things? Like, it can tribute to the
attribution World, helping blue level set, expectations. Understandings across the
attribution Community as it as it is.

Speaker 1: [00:17:09]
Well, I think one of the most important things, thanks for that question. For one of the
most important things about attack is its relative, transparency, right? It's available to
anybody. Many of the contributors are industry themselves. So I think it does a good job
of correlating. What different security vendors are seeing in different networks, kind of
across the ecosystem. Again, it's not perfect because the contributors may not be as a
comprehensive Vision as you like to see them but it does some extent provide this kind of
public forum for the reconciliation of observations about the trackers, how they, and the
techniques that they use. So there's a there's a normalization of Apt numbers and the
naming conventions of different security companies. Use that I think is very useful for
Network owners and operators to understand. And so I think the analogy of the kind of
the analogy of the kind of safety inspector least providing tools for folks to test their fire
alarms and Fest. Their locks is is pretty good from a related that the best practice use of it.
Attack. And and what it does, I think it's just further the knowledge of Defenders and
what's going on with their networks. How they can, how they can best defend them,
there's some limitations right? The, some levels of uncertainty and one of the aspects of
the uncertainty that I think it's really important to the accountability question is that many
of the tactics and techniques identified in the attack life cycle. Can be used for multiple
intents and it's difficult to determine what the intense are. Could be destructive events
that could be intelligence, Espionage intelligence gathered. They could be stealing
intellectual property, it could be just simply establishing a presence for some future
unknown action. So so there are that's the tough part attack helps with that, but it doesn't
have the final answer and hopefully over time that those Beloved uncertainty. And the
ferreting out of kind of intent will be will be more kind of qualitative or quantitative and

Speaker 4: [00:19:47]
qualitative.
Speaker 2: [00:19:52]
Return to Emma for a moment for start to weave in some of the questions that are
coming in from our audience. I was very struck by your coming about working with
communities, that are particularly affected by by cyber Mischief of various sorts and so
forth. I guess like to ask you a capacity-building question there, I mean sensitizing
communities to cyber need is critical and I'm sort of wondering about your thoughts on.

Speaker 1: [00:20:16]
Well,

Speaker 2: [00:20:16]
I'm sorry, they backed us up. One of the things that we were starting to do this. And when
were already doing disintegrate, when I was still, there was a cyber capacity building with
International Partners, helping make them better stakeholders, and sort of better
prepared for cyber challenges and whatever else it may be. That work has been continuing
to pace. And I think is really important in the international Arena, but I guess one could
also think about it much more, broadly. In terms of your perspective, on which
communities, sectors institutions are most in need of help in matching that up against the
areas that are pretentious. The

Speaker 1: [00:20:50]
most harmful

Speaker 2: [00:20:51]
from the perspective of society, and the economy if those needs are on a dress, how
should we be thinking about capacity, building assistance, who should be providing it?
And how do we, you know, what's currently done? Help us think through, the sort of the
remedial side of this from an almost a community organizer perspective, if you will.

Speaker 3: [00:21:09]
Yes. Thank you Chris. That's a good question actually. I mean from our perspective in
terms of the priority communities per se that we that we service the primary one is
humanitarian nongovernmental organizations. So they space particular challenges with
regards to the Cyber threats that they face because of the nature of the data that they
process. But also in terms of the types of activities that they do with the boots on the
ground that they have in a number of different regions of the world. And in the second
one that we Son is the healthcare sector but particularly during the pandemic and the
number of cyber attacks at that help that that sector Feast meant that we needed to look
into. How can we better protect the health care sector from cyber threats. And the third
one that we're looking at is vulnerable communities related to the conflict zones and
really looking at what is happening in the context of the war in Ukraine and in terms of
capacity building, I mean there's a number of different entities who could come into play
here and but what What we are finding is that it's for humanitarian actors. For example,
there is a big gap between what is Affordable in terms of cybersecurity and being able to
increase their cyber resilience and and their internal resources to be able to take in any
recommendations for cyber resilience as well. So as an Institute, we actually provide and
free services to ngos by partnering up with the private sector to be able to ensure that we
can. Increase their resilience and preparedness in the case of an attack. And but also sort
of wanted to jump in on a couple of points and that John, and Rick mentioned around
attribution. Because there's some some things that we're sort of thinking about in terms
of the collection of the data. And I wanted to jump in with John because we are looking
obviously at the technical legal and and the political attribution of attacks, and we've
actually created our own category beyond that, which is Self attribution and it's so threat.
Tractors out there today, notably in the context of Ukraine. But we've been seeing this
with ransomware, for example, for a number of years now is those actors who are quite
happy to go out there and claimed responsibility for an attack. And even though we, there
is a important need for technical attribution to follow from there. There is a very urgent
need for us to be able to capture that information in order to understand the actors who
are off. Rating in that space today and that'll causing harm without waiting. The time, that
it would take for a technical or political attribution to be done, which is something that we
all wear. It can take you, no matter of weeks months and in some cases years. And just to
give you a bit of an idea on the data that we've collected in terms of attacks against
organizations in Ukraine, we've documented 203 attacks to date and 56 of these actually
have technical a Tribution that's been done by different entities beer have identity is be it
certs. And all be even investigative journalists that are coming in now and starting to
conduct and Technical attributions in that respect. But in terms of legal attributions, which
are going to take much much longer, we've only seen two attacks and 74 political
attribution. So there is this notion of, how do we actually look at other classifications of
attribution and this comes back today Nations, right? And the use of terminology, do we
even consider that a type of attribution in terms of when a threat actor claimed? Some
kind of responsibility or is this something different? So just a little something to take up
the conversation as well.

Speaker 2: [00:24:55]
That's fascinating. We've got a number of questions coming in. There's one that is first
came out

Speaker 1: [00:25:01]
on

Speaker 2: [00:25:02]
the institutionalization of the attribution function, but I want to put that on pause, just for
a moment because what you just said, Emma puts me in mind of paper. Owing to another
question that came in first. So, and that's going to be a home to combine a couple here in
the sense that you're coming about self attribution, also raises, which implicitly the
question of Miss attribution. The the idea that one for the Masquerade is someone else or
adopt someone else's ttp's, indeed, you can sort of find out whose ttp's are you know,
what the ttp's are by going to your convenient minor attack framework. I suppose, Rick,
you know, so so how does one deal with any of you? To jump in on this, the challenge of
the masquerading attackers and also the the challenge of proxies where, you know, it
actually is me, it's behind this. But I really think that I would rather have Rick stick his neck
out and go do this so they can have some degree of deniability here. How do you deal
with these issues of? I take your point about self attribution as opposed to the retest
genuine, it makes it easier in that particular narrow case. But I'm sure there's lots of
gamesmanship out here. Repurposing of ttp's and whatever else it may be. How does the
community deal with these challenges? Anybody wants to jump in, please, please do so
and then I'll get back to

Speaker 4: [00:26:17]
institutionalization.

Speaker 2: [00:26:19]
And actually, maybe the response that leads into the other kids to say, first that I think it's
interesting, it's tendency to think about things in cyberspace is being unique, or especially
novel, but the idea of a false flag attack has existed across all domains of conflict and so, it
is not in many ways, hyper unique or specific to cyberspace. In terms of being sure that
you are getting it right? That's where that corroboration case, I think comes, especially
important. And in particular when you start talking about attributing nation-state attacks
and when governments are leaving those attributions, making sure that they're not just
pulling from, you know, their own intelligence and information resources, but like,
corroborating, that with Partners as well. And that's why it's been so encouraging to see.
Think the two biggest Innovations and advancements in government-led, cyber Rapture
attributions. Are these public statements in the past decade have been one speed. Proving
how quickly they do this, you represents the not catchy attack. Chris at the outset here,
it's like eight months to attribute. Compare that to the US, attributing, the recent Irani
attacks against Albania, which was less than eight weeks. So, a lot of improvement that I
think in 2020, we actually gave Advanced attribution of a cyberattack if ever call it. Didn't
ultimately occur. But we actually got some indications that bad things were happening
and there was a multi government statement that we put out sort of saying hey watch out
for this. We think there's something bad coming here. Even advance of of the thing
occurring. And I actually think when we start talking about building credibility behind
attribution statements, that's next in critical, building block is how transparent can you be
with the underlying sources, that, that you're basing? That Dad that I should be should
decision on, and certainly in the run-up to the conflict in Ukraine? Being able to be
transparent about? Hey, here's what we're seeing already. Here's what we anticipate to
see. Do it a lot to, to strengthen, you know, intelligence claims or to undermine any
perceived legitimacy of some of the aggressive actions that was taking place before that.
But your question about, you know, having confidence in these statements. The other big
step forward has been corroboration with other partners over the last few years. And so
while we would have seen previously government say hey we think it was this actor that
was responsible for this. We have high confidence, we have low confidence. Now it's not
just one government coming up and saying that you'll see the u.s. come out and say it and
then a dozen or so other partners. Now I say we will also have have reached this
conclusion as well, which can go a long way to making sure that we're not getting. It
wrong. I want to jump in on that, please feel free and then I'll turn to the other

Speaker 1: [00:28:46]
question. Yeah, thanks. This is just very, very quickly. I think there is masquerading or false
Flags, you know, that can be designed into an attack, right? Or it can be a self-inflicted
wound to some extent talked about, not petya originally, at least, you know, in the public
identified as ransomware attacked became became evident over time. That it was Actually
destructive attack you. So so sometimes the speed and the rapidity of which we want to
engage politically for instance will lead us down potentially erroneous attribution decision.
So there's design masquerade which I think is possible. Given the complicated nature of
the internet connectivity and the common use of TTP by multiple different. Actors. But
then there's also how do we need to keep ourselves from the self-inflicted wound? Miss
have to add tributing certain activities

Speaker 3: [00:29:55]
and just jump in there? I mean, also the dangers of misinterpreting an attribution and
misunderstanding one is you know how quickly that can lead to escalation and in
cyberspace, but also in the real world, right? So a Cyber attack. Leading to a potential
threshold of a breach of international law, can lead to real-world repercussions and very
quickly. So I think that there's it's very important for us to consider in how far along
attribution can also lead to severe severe problematics. And I really hear John also on the
Notions of some of the complexities in in attribution, in relation to what needs to be done
from a cooperation perspective, So one of the things that we're looking at when we
documenting the data in which we've got Associated attributions, for example, we would
call itself attribution at this stage has what other corroborating information is out there.
So looking for example at website monitoring sites that would indicate the downtime of a
website in the tent in the in the sense of a DDOS attack, we'd also be looking at conflicting
information so we seen and different thread actors for Example, publishing data dumps
relating following around somewhere attack, and there are conflicting information. Do
they both have actors who committed? The attacks with these kind of things. Also, very
important for us and understanding and, you know, are there potentially multiple actors
involved in a single attack depending on the phases of when that happened. So one of the
examples that I'm thinking of is is an attack on a psycho Therapy Clinic in Finland where
they was a detour. Reach data was exfiltrated and then a significant amount of time later
that data resurfaced and there was a series of different Ransom demands that were made.
But how do we actually know at this stage that the actors that were involved in the first
stage of exfiltration? And those that actually did The Dumping of the data were actually
one in the same and these sorts of assumptions need to be very clearly laid out and be
very careful around us. Those types of education's.

Speaker 2: [00:32:12]
Especially in the context of clandestine markets for data that's taking in that fashion,
right? The to the degree that the things that are stolen or commoditized, that creates
additional linkages between initial bad actor and ultimate bad after I guess that's
interesting, yeah. So let me ask a question in general, about circuits to channelizing things
and I can give certainty to context. The question came in, in the, in the, in the sense of
asking about what role if any Could Be Imagined for. National institutions, some kind of an
extradition

Speaker 1: [00:32:44]
organ or Forum or

Speaker 2: [00:32:46]
whatever it may be. So like, I want to sort of get your all taken on that, but also to use that
is sort of, second piece of advice from to Pivot to some of the sorts of things that the
questions will help inform this this Stimson Center project moving forward on Cyber
governance and to what degree are there ways to conceptualize in the broadest sense,
common attribution, common sees me coming expectations of best practices and
standards and ways to think about Contribution. So that at least we can level set a
broader community on how to think about this, what constitutes a sort of understood
best practice way to do that. And in a sense, what doesn't right? So any of those any
disasters would be great. But why don't we start with? Just the issue of Institutions per se
and given in the more concrete sense and pivot to the broader question of house. You
institutionalized Frameworks of thought and understandings of what should or could be
done soon? Anybody like jump in?

Speaker 3: [00:33:45]
I can kick start it if you want, it sends of the notion of a body for attribution. I mean its
pros and cons with regards to this debate and Pew that we sort of try to conceptualize. So
one is a significant potential - is that really any kind of body that would be developed. We
need to be mandated by a treaty and you know how much time would it take to to put
that in place and then Associated to that is How do we build capabilities, including the
understanding of geopolitical context related to this where we think again about false
flags, for example, as well as was brought up in the conversation earlier. It's how do we
ensure a wide variety of capabilities are fitting into this particular organization? And then
there's the question of whether States would actually and support an NGO and non-
governmental organization actually taking part. Didn't this with regards to governance
structure and, you know, how how much backing are we likely to get from states to be
able to create this kind of organization? And, and then really, there's also this thought
about if we were to create a an attribute in body of this kind does this body need to
necessarily make the attributions of attacks public and the question around this is you
know the geopolitical sensitivity of a lot of this. And in how far making attribution stations,
public might actually make things extremely difficult from a geopolitical context. But could
there be a middle ground where actually attributions don't necessarily make it into the
public space? I'm and so, that was sort of some of the questions on sort of the negative
side on the positive side. It was certainly build and Independence and transparency in
relation to two attribution. And it would also allow Ow for a body to develop and
standardize and sets of Frameworks or procedures for attribution. That would be
recognized by the member state that body, for example. And then there's also the notion
that it is mandated by treaty, then, that organization called a strong sense of credibility.

Speaker 4: [00:36:06]
So, just

Speaker 3: [00:36:08]
yeah, I know, but someone else you want to follow

Speaker 2: [00:36:10]
up. I thought to be hiding your, if I let your comment and on the other, the implications of
an attribution call is certainly very well taken. And we are the last few days in the
international in the in the kinetic Arena we've seen with the those the explosions that
killed two people in southern Poland in very dramatic questions. Hang issues. Hang on.
Who is responsible for what? And that's you. That can be no different in the Cyber Arena.
I'm sure. I'm also it's not just your political consequences. It's pretty potentially
commercial. - it's like I think I recall reading some place that President Obama. Very
carefully did not describe the Sony Pictures attack as being the an act by the North Korean
government. Even though it would pretty much understood that it was not because he
didn't think it was, but because if he used those words, it might trigger Insurance
exception, liability problems, for Sony Pictures. So there are lots of potential
consequences here in the in the nuclear verification Arena by which I am some Jackson,
professional background, there's a sort of an implied dividing line between what you
people are willing to entrust to a technocratic international body, the iaea for example,
and what they are not and they're willing to entrust very discreet. Technical
determinations as to whether or not these safeguards agreement for Country X is being
adhered to to this body. But in countries have not been willing to entrust bigger, picture,
geopolitical calls about who is in violation of the npt for trying to build nuclear weapons in
violation of It's article to write. So something seemed to work and be in Trust of all to
organizations and some things at least if you take that example or not. So I don't know if
that helps famous at all, this arguing, I did catch you off

Speaker 1: [00:37:53]
my apologies. Oh no worries. I don't have a lot to say on this best practices standpoint
attributing you know some the US has a high bar for determining sanctions that you know
incorporates a lot of both. A lot of information, public and private information on on
attribution whose whose should be held accountable. That's kind of national level. The
international level, you know, you have I think about law enforcement by durable and the,
you know, joint investigations would occur with members of Interpol and identifying
specific actors or cyber criminals in particular. But But it seems to me that a purpose-built
international organization would run into lots of problems, as you just kind of articulated,
but existing organizations. Other current mandates could be configured to at least start
identifying consensus around attribution. I think about the, the G20, for instance, or
multilateral organizations that Nationally, they have the means to identify share
information, and have the means to identify an attribute actors. But then they also have
the kind of political reform to demonstrate the consensus and come out. You know,
identifying actor come out in support of kind of rules of behavior, things like that. So so I
would focus try to focus more, I think on the existing organizations and Weber Leveraging,
their current language.

Speaker 2: [00:39:42]
I actually find myself, you mentioned law enforcement. I mean, despite the conventional
wisdom, that attribution is so terribly challenging. We actually do have law enforcement
folks, make a contribution calls and effects quite frequently indictments from our
department of justice. For example, for against cyber hackers sorts of folks in foreign
government, intelligence services, and things of that nature. And that's in a context in
which at the end of the day they shouldn't and couldn't. And I don't think do they don't
make those calls and issue. Indictments for example, unless they really think that they can
bear the burden of proof, which in the criminal context is very high. So someone thinks
they can make Reasonable Doubt standard with whatever they have brought into their
attribution mix. So they're presumably a very high degree of confidence there and a
willingness to at the end of the day be public about that into subjected to accountability
and cross-examination in a criminal trial in the admittedly unlikely event. That, you know,
Chinese pla officers ordered Russian Gru folks are ever turned over to, to Justice there.
But so have you someone thinks these things work really well? Do we have any? You guys
have any visibility into sort of what the decision calculus is in those kinds of attributions? I
realize I may be asking Their Own Brew non gummies, but that strikes me as a fax any

Speaker 4: [00:40:55]
analogy

Speaker 2: [00:41:01]
And also I want to make sure we don't fail to hear from John on it, on the
institutionalization, if there's something you want to say.

Speaker 4: [00:41:05]
So

Speaker 2: [00:41:06]
- so, nothing on the most recent question, but honest socialization, I might, I might go
most people of what Emma and Richard were saying kiss to put it quickly. I think, do we
need more sources of authority when it comes to attributing attacks? Yes, on a long
enough time line. Let hopefully look like something approximating an iaea for cyberspace
when it comes to nation state, activity online. I think, Thing that is at least replicating at
you know, the responsibilities about organization and that space would eventually make a
lot of sense but I think to put it quite simply it's a pretty small Club of countries that are
currently participating in advanced cyber operations and and they are the countries you
would expect across geopolitical fault lines. And so when you start talking about how to
you know build an immutable International body that might be able to call balls and
Strikes there and that gets pretty tricky what we could do. I think which is what Speaking
to is that working through organizations, like the G20 like other existing institutions to
start at least agreeing

Speaker 1: [00:42:07]
on.

Speaker 2: [00:42:09]
What's the recipe for a good high-quality attribution? You know, what should be included
in that process, you know, how can States work together to make them more robust, you
know what should the expectations of be for that process? So people can have more
confidence in the attribution process, as it currently exists and

Speaker 1: [00:42:26]
start moving towards something that hopefully has a little more robustness to

Speaker 2: [00:42:29]
it. And then also, To, you know, to a point making sure this includes a lot more than just,
hey, you know, here's the actor who did it and here's what the incident was, but capturing
some of that broader context as an expectation and attribution statements around. Well,
who was harmed, know what was the actual impact of of this attack? If it's the same
attacker that's been responsible for previous attacks. Let's talk about a cumulative
distribution for that that particular incident. So that we're having a more complete
conversation at the end of the day. That's what a public attribution. It should do is seek to
inform a broader audience and our governments about what's just happened. And then
most, perhaps most importantly did this violate any International expectations, which is
something we have extremely rarely ever seen included attribution statements has okay,
you attack the thing. Did that violate any expectations that we currently have? And it's
interesting to see

Speaker 1: [00:43:23]
folks stopped short of that, so frequently.

Speaker 2: [00:43:26]
Got it in the process of articulating. My expectations are ex ante is pretty, pretty critical,
right? I mean, that was one of the reasons why I thought it was so useful. I think there was
a un gge in 2015. If I'm not mistaken that articulated a peacetime or over several, the the
one that I thought most interesting was the articulation that hey it's really not cool to
attack civilian. Critical infrastructure in peacetime, which is an additional Step Beyond
simply articulating. What they had in 2013 that the law of Ward. Would apply in a cyber
conflict just as it applies in and kinetic conflict. But, you know, so but you can't complain
that someone has violated an expectation, unless you have had the guts to articulate the
expectation in the first place. So, no I see I take your point. We have about 10 minutes
left. I want to ask one more question and then give each of you all the chance to give any
sort of closing a mark to leave people with, especially with the especially in view of this
broader project of distances engaged in to try to move the ball forward, in some Fashion
on how to approach. Attribution issues and cyber governance issues in general in a more
constructive and productive way. So, a final question, I guess we'll has to do with going to
reframe it, but it came in from a law professor said, I well I don't want to put it in those
terms, but we talked about attribution for the perspective of who the bad actor is, who
did anything, but there are other ways to also be a bad actor, and to be in a sense, a
couple in this context and it by analogy to the kinetic world. I mean, I I might be a nephew
terrorist to attach your country, but I'm not the only one at fault. If indeed the country in
which I am taking Safe, Harbor, and that sort of protects him cobbles. When you were at
least fails to respond to everyone else's entreaties that they rein me in, there could be a
degree of culpability for a failure to prevent as well at least in those contexts to what
degree. Can we talk of that in the Cyber Arena? Let's say everyone attributes. A whole pile
of nasty things to cyber attackers in Russia and So, publicly and diplomats complain about
this and it keeps happening and keeps happening at what point. Even if we can't close the
loop evidentiary linked to the gru or something. Can we say, look, this is a Russian
problem and it's not just a Russians

Speaker 4: [00:45:38]
problem.

Speaker 2: [00:45:43]
Talk about cheap loan consequences. Yeah. There's a there's a lot of irony in that a un
negotiations of a new cyber crime. Treaty were kicked off by a Russian sponsored
resolution. It's just in this past year that's because they hate The Budapest convention
because you talk about things like respect for human rights and the need to cooperate
against endemic cybercrime. Yeah I think there's there's there's a lot of of that and then
there's certainly been concerns from that Community around the Budapest convention.
and but, but to your point, I, I do think.

Speaker 1: [00:46:24]
Also, the threat of the count.

Speaker 2: [00:46:28]
Responsibility to prevent. So it'll actually are you guilty also because you haven't got the
bad at, you have not acted against the Bad actors. The first step here I think is going to be
citing. The expectation that was violated perhaps by a government body or a, or a
government-sponsored organization. So, encouragingly, I think there's been two recent
examples of at least the u.s. started to dip a toe into that space. The first was a remarks
by, by President Biden last year, which was around, Talking about Russia saying they have
do diligence responsibilities under those Norms from the you, and they decided to be
taking responsibility for Bad actors that are operating within their own borders. So when
we see a significant attack that Downs, critical infrastructure in the US or elsewhere,
attributed to actors in Russia, that are identifiable, there's an obligation there. They
should be taking action against those actors whether or not they are directly aligned, or
supported by or have any affiliation whatsoever with the government. The other most
recent example of this was in the most recent us attribution statement from back in
September Or which as I sort of mentioned previously for the first time highlighted which
expectations were violated that had to do specifically with an attack on civilian, critical
infrastructure saying that this attack by Iran on Albania violates, this is this International
norm. And I think that needs to be a precursor to any further step or actions and holding
the the government's themselves responsible when it is a state-sponsored or state
accepted

Speaker 4: [00:47:50]
cyber incident,

Speaker 2: [00:47:55]
I think also that other place.

Speaker 1: [00:47:58]
Yeah, just dump it. Quickly on that, I think it goes back to what you said, which is a
previous thing about circumstantial evidence, right? And a consensus around, who the
around attribution and then the responsibility of the nation of State who is the source
with a culpable or not, is the source of the activity of to actually do something about it,
which the non-binding norms and did you eat actually seem to require so so I think it's
really a matter of what you said earlier, building a consensus around the thresholds for
international organization action statements, as well as National actions and this common
framework and taxonomy for attributing with in doing

Speaker 3: [00:48:52]
something about it, Yeah, I know, she'll just jump in there, really in terms of attribution
and how important it is to identify the actual actors in this context, the type of actor, the
type of attack on the motive of the attack. But when looking at all, this is, how much does
the state control those actors? And it's important to be able to understand the state
control over those individuals, or those groups who are acting out of that, that nation
states. And because that could bring into question. So threshold of an attack on the
international law and the UN Charter which then could bring in a whole other area of
looking into the responsibility of the state in the context of those, that's just another
perspective,

Speaker 2: [00:49:40]
especially an issues of capacity not trivial there either I suppose right. It would not be hard
to imagine that whatever responsibility to prevent their maybe is one. That is contextual
enough that you would look at it differently if Are an attack originating in, you can show
originated in, I don't know. Somalia, present-day, Somalia versus, you know, showing High
those who are very different different contexts and I suppose you would be justified in
inferring, very different things about the degree to, which such things are tolerated, or
even approved up by authorities if they keep happening in one versus the other. Very
interesting. So only give you all a chance in our last couple of minutes. Any final
comments, especially to kick us off down the road of helping inform and set. Some, some
Understandings and guidance for this Stimson project on how to make all of this better in
some fashion. What should we keep in mind? What you want to make sure. We don't
forget please Rick, you got your hand up to go for very quickly.

Speaker 1: [00:50:38]
I think we have to think really hard about what we either the collective. We are, the
individual stakeholders in this business have to gain from attribution. But do we have the
game? What's the advantage attribution and then work toward identify ways to actually
achieve those things, but we have to some extent. Ask ourselves that that first order
question. So thank you appreciate the opportunity to participate.

Speaker 2: [00:51:07]
I understand they're also going to be sending some time looking at, in a sense of history
and other domains, in the sense of how have Frameworks of normative expectations are
indeed legal rules, you've all been other contacts? What is going into that? What lessons
can we draw, or what lessons, or should we not try to import from this context? That
sounds like a very interesting project John or about? What would you like to add? Is a
closer. If

Speaker 4: [00:51:29]
anything,

Speaker 2: [00:51:32]
you know, I think there's a lot of low-hanging fruit still in the Cyber education World wet
and a That comes down to the the the statement itself that is released and the degree to
which we can make those much more predictable. Much more standardized much more
consistent both from the technology industry. When we're putting out our statements, as
well as from from government bodies into putting out their statements, I think that will do
a lot to help reinforce International expectations and lay the groundwork for a more
robust deterrence approach to Reckless particular State behavior in cyberspace, you
know, on the part of governments, you know, that that An look like more transparency in
terms of hey, what's the underlying information that gets corroborating? This particular
that statement has come up like more coordination with other governments. It can also
click retroactive transparency which I think would be an interesting and novel approach
here as well, which is to say completely understandable that sources a message methods
behind a particular attribution. Might not be something that could readily disclosed at the
time of the attribution statement. But perhaps months or years down the line, we could
revisit that and say, hey, here's actually how we arrived at that conclusion. So you would
least, would be Be demonstrating a little bit more about a robust process that goes into
place for arriving in such conclusions from the technical community side. I think we're
doing a better job at least, you know, I speak for Microsoft we release now, you know,
frequently not just attributions, but I technical breakdown of the attack, as well as that, a
policy based analysis of where were sort of assuming this

Speaker 1: [00:52:59]
responsibility is lying for the attack itself.

Speaker 3: [00:53:05]
given the time and yeah, I'll just go with John on this about standardization but I also want
to talk about reproducibility and in how far attribution can actually be reproduced by
independent expert and independent party and looking how can we can use peer review
processes for this and really ensuring that any attribution that is done and that leads to
Future action is actually independent of Chaleur geopolitical objectives as well, and, and
then really one final phrase is really how attribution can be used as one piece of the puzzle
to help to increase stability inside a space overall.

Speaker 2: [00:53:47]
Tremendous. I have every expectation that you guys have really helped jump. Start this
project to a good end. My only impression of these areas is that the mere fact of
discussing and trying to articulate expectations and best practices is itself, really critical.
And I think it sounds like, that's that's something with wooden, which we can all agree. It
sounds like we are already helping to move things down the road towards really properly
thinking, through whether some improvements might be possible in that respect, can we
get In order to come together, better to do more to discuss and develop an articulate.
Those kinds of expectations and standards of ways to approach this stuff and can be Vivid
from there. In fact, to helping Build a Better Community, trying to hold people to those
expectations and employ them beautifully. This is really cool, we haven't answered all
those questions today, but I am really delighted. We've been able to discuss them in very
much, so that we've been able to discuss them with three, such a terrific presenters and
discussants. Thanks also to all all the questions that came in. I'm sorry, we couldn't take all
of them, but this is a really rich vein and I'm pleased that we got as far as we did. I myself
have really enjoyed being part of this. I've learned a lot and I think I'm sure that the same
is true for all of the listeners out there listening. So I hope we've virtually clapping, but if
we can, please join me in thanking the panelists as well as the Washington foreign boss
society and Stimson putting all this together. Fantastic stuff, really? Appreciate all of you
being part of this and I hope everyone has a wonderful Thanksgiving. Wish you all the
best. Thanks so much for being part of this and thank you so much Chris. For moderating
this, terrific program has been truly a pleasure and an honor. Let me just remind folks that
the program will be put on our YouTube page on the website. So if folks missed bits of it
they'll be able to catch it again and obviously follow us for more
Speaker 1: [00:55:35]
great programs.

Speaker 4: [00:55:36]
Thank you. All.

Speaker 2: [00:55:39]
Thanks everyone. Thanks

Speaker 4: [00:55:40]
bye.