attribution.news

The capabilities, access to information, motivations, interests and incentives of platforms may look different from other entities making attribution judgments. Platforms may:

• Withhold public attribution due to privacy law concerns.
• Have greater visibility in certain operations, such as influence operations, as they have access to account metadata that the public or other entities do not.
• Withhold public attribution to protect employees in certain countries.
• Withhold public attribution due to financial concerns (in countries where they wish to grow).

How the story begins: A platform issues a takedown announcement. 

1. Read the takedown announcement. Look for:
   1. Where the activity originated. 
   2. Whether the platform identified actors behind or tied to the behavior leading to the takedown. 
   3. Who the actors were acting on behalf of.
   4. Who the activity targeted or focused on.
   5. What tactics were used. 
   6. Who the platform has shared the information about its findings with — for example, Facebook has in the past noted when it has shared findings with law enforcement, policymakers or industry partners.

2. Familiarize yourself with the terminology that the platform uses, so that the description in your story accurately reflects the announcement. For example: 
   1. Facebook uses “coordinated inauthentic behavior” (CIB) to describe campaigns that seek to manipulate public debate on its services. It issues public announcements when it has identified and removed accounts associated with: 
      1. CIB in the context of domestic, non-state campaigns. 
      2. CIB carried out on behalf of a government entity or by foreign actors, for which Facebook uses the term “Foreign or Government Interference” (FGI). 
   2. Facebook’s Head of Security Policy Nathaniel Gleicher has stated that the platform uses the terms: 
      1. “From country X” to describe operations where Facebook only has geographic attribution (but cannot determine the specific actor). 
      2. “Linked to country X” when Facebook only sees limited links to the country.
      3. “Individuals associated with country X” if Facebook cannot prove that there was institutional direction. 

3. Contact the platform and ask for the information that was not disclosed in the announcement. Ask whether it can make available the dataset behind the announcement, and ask who else it has shared the data with. 

4. If possible, contact the other parties with whom the platform has shared the data, and ask if you can see it — you can then look at the data yourself or bring it to cybersecurity experts. 

5. Your story should be clear about: 
   1. What the platform disclosed in its announcement, including: 
      1. Where the activity originated.
      2. The tactics used. 
      3. Who the activity targeted. 
      4. Whether the platform could determine leadership and direction of the activity.
   2. The information that the platform did not disclose, either because they declined to disclose it or because it was unable to determine the information. 

6. Your story should link to the platform’s announcement, so readers can see the judgment and the supporting evidence provided. 

7. Ask someone in your newsroom, or a cybersecurity expert, to “red team” your story.

For a closer look at the types of operations that platforms confront see our TYPES OF OPERATIONS page under, UNDERSTANDING ATTRIBUTION.