Attribution of cyberattacks requires identifying those responsible for bad acts, prominently
including states, and accurate attribution is a crucial predicate in contexts as diverse as
criminal indictments, insurance coverage disputes, and cyberwar. But the difficult technical
side of attribution is just the precursor to highly contested legal and policy questions about
when and how to accuse governments of responsibility for cyberattacks. Although politics
may largely determine whether attributions are made public, this Article argues that when …