{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T23:25:21Z","timestamp":1783553121209,"version":"3.55.0"},"reference-count":43,"publisher":"National Academy of Sciences","issue":"11","license":[{"start":{"date-parts":[[2017,8,27]],"date-time":"2017-08-27T00:00:00Z","timestamp":1503792000000},"content-version":"vor","delay-in-days":181,"URL":"http:\/\/www.pnas.org\/site\/misc\/userlicense.xhtml"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1444871"],"award-info":[{"award-number":["1444871"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1518878"],"award-info":[{"award-number":["1518878"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000185","name":"DOD | Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","award":["FA8750-15-C-0118"],"award-info":[{"award-number":["FA8750-15-C-0118"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100006602","name":"Air Force Research Laboratory","doi-asserted-by":"publisher","award":["FA8750-15-2-0075"],"award-info":[{"award-number":["FA8750-15-2-0075"]}],"id":[{"id":"10.13039\/100006602","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["www.pnas.org"],"crossmark-restriction":true},"short-container-title":["Proc. Natl. Acad. Sci. U.S.A."],"published-print":{"date-parts":[[2017,3,14]]},"abstract":"<jats:title>Significance<\/jats:title>\n                  <jats:p>Attribution of cyberattacks has strategic and technical components. We provide a formal model that incorporates both elements and shows the conditions under which it is rational to tolerate an attack and when it is better to assign blame publicly. The model applies to a wide range of conflicts and provides guidance to policymakers about which parameters must be estimated to make a sound decision about attribution and blame. It also draws some surprising conclusions about the risks of asymmetric technical attribution capabilities.<\/jats:p>","DOI":"10.1073\/pnas.1700442114","type":"journal-article","created":{"date-parts":[[2017,2,27]],"date-time":"2017-02-27T20:55:25Z","timestamp":1488228925000},"page":"2825-2830","update-policy":"https:\/\/doi.org\/10.1073\/pnas.cm10313","source":"Crossref","is-referenced-by-count":42,"title":["Strategic aspects of cyberattack, attribution, and blame"],"prefix":"10.1073","volume":"114","author":[{"given":"Benjamin","family":"Edwards","sequence":"first","affiliation":[{"name":"Information Security Group, IBM Research, Yorktown Heights, NY 10598;"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alexander","family":"Furnas","sequence":"additional","affiliation":[{"name":"Department of Political Science, University of Michigan, Ann Arbor, MI 48109;"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Stephanie","family":"Forrest","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of New Mexico, Albuquerque, NM 87131;"},{"name":"Santa Fe Institute, Santa Fe, NM 87501;"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4758-6590","authenticated-orcid":false,"given":"Robert","family":"Axelrod","sequence":"additional","affiliation":[{"name":"Gerald R. Ford School of Public Policy, University of Michigan, Ann Arbor, MI 48109"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"341","published-online":{"date-parts":[[2017,2,27]]},"reference":[{"key":"e_1_3_3_1_2","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1322638111"},{"key":"e_1_3_3_2_2","volume-title":"Cyber War","author":"Clarke RA","year":"2011","unstructured":"RA Clarke, RK Knake Cyber War (HarperCollins, New York, 2011)."},{"key":"e_1_3_3_3_2","unstructured":"JH Davis Hacking exposed 21 million in U.S. government says. New York Times Section A p 1. (July 10 2015)."},{"key":"e_1_3_3_4_2","unstructured":"E Wong Hackers find China is land of opportunity. New York Times Section A p 1. (May 23 2013)."},{"key":"e_1_3_3_5_2","unstructured":"M Riley J Robertson FBI said to examine whether Russia tied to JPMorgan hacking. Bloomberg . Available at https:\/\/www.bloomberg.com\/news\/articles\/2014-08-27\/fbi-said-to-be-probing-whether-russia-tied-to-jpmorgan-hacking. Accessed February 4 2017. (August 27 2014)."},{"key":"e_1_3_3_6_2","unstructured":"J Silver-Greenberg M Goldstein N Perlroth Hackers\u2019 attack struck systems at 10 companies. New York Times Section A p 1. (October 3 2014)."},{"key":"e_1_3_3_7_2","unstructured":"E Nakashima M Zapotosky U.S. indicts 7 in connection with cyberattacks linked to Iranian government. Washington Post Section A p 14. (March 24 2016)."},{"key":"e_1_3_3_8_2","unstructured":"E Nakashima U.S. officially condemns Russia over hacking. Washington Post Section A p 1. (October 7 2016)."},{"key":"e_1_3_3_9_2","unstructured":"S Waterman US needs to publicly attribute cyberattacks former House intel chair says. Fedscoop . Available at https:\/\/www.fedscoop.com\/fmr-rep-rogers-u-s-needs-to-publicly-attribute-cyberattacks\/. Accessed February 4 2017. (June 30 2016)."},{"key":"e_1_3_3_10_2","unstructured":"A Schmidt The Estonian cyberattacks. A Fierce Domain: Conflict in Cyberspace 1986 to 2012 eds Healy J (Cyber Conflict Studies Association Arlington VA) pp 174\u2013193. (2013)."},{"key":"e_1_3_3_11_2","unstructured":"FBI National Press Office (December 19 2014) Update on Sony investigation. Available at https:\/\/www.fbi.gov\/news\/pressrel\/press-releases\/update-on-sony-investigation. Accessed February 4 2017."},{"key":"e_1_3_3_12_2","unstructured":"J Appelbaum Inside the NSA\u2019s war on internet security. Der Spiegel Online . Available at http:\/\/www.spiegel.de\/international\/germany\/inside-the-nsa-s-war-on-internet-security-a-1010361.html. Accessed February 6 2017. (December 28 2014)."},{"key":"e_1_3_3_13_2","unstructured":"D Sanger M Fackler Tracking the Cyberattack on Sony to North Koreans. New York Times Section A p 1. (January 18 2015)."},{"key":"e_1_3_3_14_2","unstructured":"K Scannel FBI details North Korean attack on Sony. Financial Times . Available at https:\/\/www.ft.com\/content\/287beee4-96a2-11e4-a83c-00144feabdc0. Accessed February 4 2017. (January 8 2015)."},{"key":"e_1_3_3_15_2","doi-asserted-by":"publisher","DOI":"10.1080\/01402390.2014.977382"},{"key":"e_1_3_3_16_2","unstructured":"DE Sanger N Perlroth U.S. is said to find North Korea behind cyberattack on Sony. New York Times Section A p 1. (December 18 2014)."},{"key":"e_1_3_3_17_2","doi-asserted-by":"publisher","DOI":"10.21236\/ADA468859"},{"key":"e_1_3_3_18_2","unstructured":"Mandiant (2013) APT1: Exposing One of China\u2019s Cyber Espionage Units. Available at https:\/\/www.fireeye.com\/content\/dam\/fireeye-www\/services\/pdfs\/mandiant-apt1-report.pdf. Accessed February 6 2017."},{"key":"e_1_3_3_19_2","unstructured":"Kaspersky Labs (2015) Equation group: Questions and answers. Available at https:\/\/securelist.com\/files\/2015\/02\/Equation_group_questions_and_answers.pdf. Accessed February 4 2017."},{"key":"e_1_3_3_20_2","unstructured":"SB McVey Cyber attribution: Useful evidence in attributing malware and cyber attacks. PhD thesis (Utica College Utica NY). (2015)."},{"key":"e_1_3_3_21_2","first-page":"323","article-title":"Untangling attribution","volume":"2","author":"Clark DD","year":"2011","unstructured":"DD Clark, S Landau, Untangling attribution. Harvard Law School National Security J 2, 323\u2013352 (2011).","journal-title":"Harvard Law School National Security J"},{"key":"e_1_3_3_22_2","first-page":"345","volume-title":"Proceedings of the IEEE International Conference on Technologies for Homeland Security","author":"Hunker J","year":"2011","unstructured":"J Hunker, C Gates, M Bishop, Attribution requirements for next generation internets. Proceedings of the IEEE International Conference on Technologies for Homeland Security (IEEE, Piscataway, NJ), pp. 345\u2013350 (2011)."},{"key":"e_1_3_3_23_2","volume-title":"The Diamond Model of Intrusion Analysis","author":"Caltagirone S","year":"2013","unstructured":"S Caltagirone, A Pendergast, C Betz The Diamond Model of Intrusion Analysis (Center for Cyber Intelligence Analysis and Threat, Hanover, MD, Tech Rep ADA586960. (2013)."},{"key":"e_1_3_3_24_2","doi-asserted-by":"publisher","DOI":"10.1080\/13523260312331271839"},{"key":"e_1_3_3_25_2","unstructured":"B Schneier We still don\u2019t know who hacked Sony. The Atlantic . Available at https:\/\/www.theatlantic.com\/international\/archive\/2015\/01\/we-still-dont-know-who-hacked-sony-north-korea\/384198\/. Accessed February 4 2017. (January 5 2015)."},{"key":"e_1_3_3_26_2","doi-asserted-by":"publisher","DOI":"10.1145\/1719030.1719039"},{"key":"e_1_3_3_27_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-012-9134-5"},{"key":"e_1_3_3_28_2","doi-asserted-by":"crossref","unstructured":"S Roy A survey of game theory as applied to network security. Proceedings of the 2010 43rd Hawaii International Conference on System Sciences eds Sprague RH (IEEE Los Alamitos CA) pp 1\u201310. (2010).","DOI":"10.1109\/HICSS.2010.35"},{"key":"e_1_3_3_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/2480741.2480742"},{"key":"e_1_3_3_30_2","doi-asserted-by":"crossref","first-page":"553","DOI":"10.1145\/2382196.2382255","volume-title":"Proceedings of the 2012 ACM Conference Computer and Communications Security","author":"Yan G","year":"2012","unstructured":"G Yan, R Lee, A Kent, D Wolpert, Towards a Bayesian network game framework for evaluating DDoS attacks and defense. Proceedings of the 2012 ACM Conference Computer and Communications Security (Association for Computing Machinery, New York, NY), pp. 553\u2013566 (2012)."},{"key":"e_1_3_3_31_2","first-page":"379","article-title":"\u201cAt light speed\u201d: Attribution and response to cybercrime\/terrorism\/warfare","volume":"97","author":"Brenner SW","year":"2007","unstructured":"SW Brenner, \u201cAt light speed\u201d: Attribution and response to cybercrime\/terrorism\/warfare. J Crim Law Criminol 97, 379\u2013475 (2007).","journal-title":"J Crim Law Criminol"},{"key":"e_1_3_3_32_2","volume-title":"Cyberdeterrence and Cyberwar","author":"Libicki MC","year":"2009","unstructured":"MC Libicki Cyberdeterrence and Cyberwar (Rand Corporation, Santa Monica, CA, 2009)."},{"key":"e_1_3_3_33_2","first-page":"53","article-title":"Tipping the scales: The attribution problem and the feasibility of deterrence against cyberattack","volume":"1","author":"Lindsay JR","year":"2015","unstructured":"JR Lindsay, Tipping the scales: The attribution problem and the feasibility of deterrence against cyberattack. J Cybersecurity 1, 53\u201367 (2015).","journal-title":"J Cybersecurity"},{"key":"e_1_3_3_34_2","doi-asserted-by":"publisher","DOI":"10.2307\/2944796"},{"key":"e_1_3_3_35_2","unstructured":"E Nakashima Economic cyberespionage by China has dropped steeply security firm says. Washington Post Section A p 3. (June 21 2016)."},{"key":"e_1_3_3_36_2","unstructured":"DE Sanger E Schmitt Spy agency consensus grows that Russia hacked D.N.C. New York Times Section A p 1. (July 26 2016)."},{"key":"e_1_3_3_37_2","doi-asserted-by":"crossref","unstructured":"M Maschler E Solan S Zamir Game Theory (Cambridge Univ Press Cambridge UK). (2013).","DOI":"10.1017\/CBO9780511794216"},{"key":"e_1_3_3_38_2","unstructured":"E Nakashima Following US indictments Chinese cybertheft waned after U.S. indictments. Washington Post Section A p 3. (December 1 2015)."},{"key":"e_1_3_3_39_2","unstructured":"D Sanger U.S. and China seek arms deal for cyberspace. New York Times Section A p 1. (September 19 2015)."},{"key":"e_1_3_3_40_2","unstructured":"B Obama Press conference by the president. White House . Available at https:\/\/obamawhitehouse.archives.gov\/the-press-office\/2015\/12\/18\/press-conference-president-121815. Accessed February 4 2017. (December 15 2016)."},{"key":"e_1_3_3_41_2","unstructured":"N al Mughrabi Islamic Jihad rockets hit Israel after West Bank raid. Reuters . Available at http:\/\/www.reuters.com\/article\/us-palestinians-israel-idUSL1278499020080313. Accessed Feb 4 2017. (March 13 2008)."},{"key":"e_1_3_3_42_2","unstructured":"KB Alexander Digital acts of war: Evolving the cybersecurity conversation before the subcommittees on information technology and national security of the Committee on Oversight and Government Reform. Testimony to the House Oversight Committee . Available at https:\/\/oversight.house.gov\/wp-content\/uploads\/2016\/07\/Gen-Alexander-Statement-Digital-Acts-of-War-7-13.pdf. Accessed February 4 2017. (July 13 2016)."},{"key":"e_1_3_3_43_2","unstructured":"; Washington Post Editorial Board The U.S. has been complacent and lazy in responding to cyberattacks. Washington Post . Available at https:\/\/www.washingtonpost.com\/opinions\/the-us-has-been-complacent-and-lazy-in-responding-to-cyberattacks\/2015\/08\/12\/d10040c2-3d4d-11e5-8e98-115a3cf7d7ae_story.html. Accessed February 4 2017. (August 12 2015)."}],"container-title":["Proceedings of the National Academy of Sciences"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/www.pnas.org\/syndication\/doi\/10.1073\/pnas.1700442114","content-type":"unspecified","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/pnas.org\/doi\/pdf\/10.1073\/pnas.1700442114","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,24]],"date-time":"2022-07-24T18:18:59Z","timestamp":1658686739000},"score":1,"resource":{"primary":{"URL":"https:\/\/pnas.org\/doi\/full\/10.1073\/pnas.1700442114"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,2,27]]},"references-count":43,"journal-issue":{"issue":"11","published-print":{"date-parts":[[2017,3,14]]}},"alternative-id":["10.1073\/pnas.1700442114"],"URL":"https:\/\/doi.org\/10.1073\/pnas.1700442114","relation":{},"ISSN":["0027-8424","1091-6490"],"issn-type":[{"value":"0027-8424","type":"print"},{"value":"1091-6490","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,2,27]]},"assertion":[{"value":"2017-02-27","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}