Cyberattack Attribution As Empowerment And Constraint

When a state seeks to respond to a cyberattack, must it first attribute the attack to the perpetrator responsible? This essay explores the international and US domestic laws governing cyberattack attribution and argues that attribution to another state can bolster the US executive branch’s authority to act pursuant to its Defend Forward policy and, conversely, that the absence of attribution can place the executive on less certain legal footing.