A story on attribution can begin in different ways. Sometimes the reporting process begins when a government issues a statement that publicly ascribes responsibility for a cyber incident. Other times it begins when a platform, such as Facebook or Twitter, publishes a takedown announcement linking an influence operation to certain actors. Sometimes a cybersecurity firm or research organization sends you a report containing claims on the origins of an incident. Or, you could be writing about attribution because a prominent figure has made comments blaming certain individuals or entities for an influence operation.
Below are some general tips that may be useful as you research and write your story on attribution. We have also developed four workflows, based on the source of the attribution judgment you are covering.
attribution.news 