Sometimes, an attribution story begins when a prominent individual or group makes a public statement speculating on who might be behind a cyber incident or influence operation, but without issuing a report or other evidence to support the claim. Below is the recommended workflow. How the story begins: An individual or a group uses language … More Prominent Figures Workflow

Before writing your story: Know your limitations and gaps in knowledge.  Do you have the expertise or experience to conduct your own investigation into attribution, or to interpret the evidence of attribution you are offered? If not, does your newsroom have reporters with the expertise to help you investigate or pull apart the data? If … More Tips for Writing Your Story

The capabilities, access to information, motivations, interests and incentives for private-sector cybersecurity firms and research organizations may look different from other entities that make attribution judgments. They may: Have business incentives for issuing public attribution judgments, which helps raise their profile in a competitive marketplace. Have greater visibility into computing networks: companies such as FireEye … More Cybersecurity Firms and Research Organizations Workflow

The capabilities, access to information, motivations, interests and incentives of platforms may look different from other entities making attribution judgments. Platforms may: Withhold public attribution due to privacy law concerns. Have greater visibility in certain operations, such as influence operations, as they have access to account metadata that the public or other entities do not. … More Platforms Workflow

The capabilities, access to information, motivations, interests and incentives of government agencies may look different from other entities that make attribution judgments. Government agencies may: Make an attribution claim, but choose not to disclose classified information behind the claim or explain its methodology or sources. Be incentivized to make a public stance of certainty, in … More Government Agencies Workflow