How to Identify a Cyber Adversary: Standards of Proof

This commentary (part one of two) explains the purpose and process of cyber attribution, distinguishing between private attribution assessments and public disclosure actions. It outlines intelligence community confidence and probability standards (ICD 203), contrasts them with judicial standards of proof, and emphasizes the contextual nature and half-life of technical indicators and TTPs. The piece argues that attribution informs better defense and strategic responses, using APT1 as an illustrative example, and sets the stage for a follow-up on methods for attributing events.