Attribution is central to cybersecurity politics. It establishes a link between technical occurrences and political consequences by reducing the uncertainty about who is behind an intrusion and what the likely intent was, ultimately creating cybersecurity “truths” with political consequences. In a critical security studies’ spirit, we purport that the “truth” about cyber-incidents that is established through attribution is constructed through a knowledge creation process that is neither value-free nor purely objective but built on assumptions and choices that make certain outcomes more or less likely. We conceptualize attribution as a knowledge creation process in three phases – incident creation, incident response, and public attribution – and embark on identifying who creates what kind of knowledge in this process, when they do it, and on what kind of assumptions and previous knowledge this is based on. Using assemblage theory as a backdrop, we highlight attribution as happening in complex networks that are never stable but always shifting, assembled, disassembled and reassembled in different contexts, with multiple functionalities. To illustrate, we use the intrusions at the US Office of Personnel Management (OPM) discovered in 2014 and 2015 with a focus on three factors: assumptions about threat actors, entanglement of public and private knowledge creation, and self-reflection about uncertainties. When it comes to attribution as knowledge creation processes, we critique the strong focus on existing enemy images as potentially crowding out knowledge on other threat actors, which in turn shapes the knowledge structure about security in cyberspace. One remedy, so we argue, is to bring in additional data collectors from the academic sector who can provide alternative interpretations based on independent knowledge creation processes.

中文翻译：

---

网络安全政治中的归因和知识创造组合

归因是网络安全政治的核心。它通过减少关于谁是入侵背后的人以及可能的意图是什么的不确定性，在技术事件和政治后果之间建立联系，最终创造具有政治后果的网络安全“真相”。本着批判性安全研究的精神，我们主张通过归因建立的关于网络事件的“真相”是通过知识创造过程构建的，该过程既不是无价值的也不是纯粹客观的，而是建立在产生某些结果的假设和选择之上或多或少的可能性。我们将归因概念化为分为三个阶段的知识创造过程——事件创建、事件响应和公共归因——并着手确定谁在这个过程中创造了什么样的知识，他们何时创造，以及这是基于什么样的假设和先前的知识。以组装理论为背景，我们强调归因发生在复杂网络中，这些网络永远不稳定，但总是在不同的环境中移动、组装、拆卸和重新组装，具有多种功能。为了说明这一点，我们使用 2014 年和 2015 年在美国人事管理办公室 (OPM) 发现的入侵事件，重点关注三个因素：关于威胁参与者的假设、公共和私人知识创造的纠缠以及对不确定性的自我反思。当谈到作为知识创造过程的归因时，我们批评对现有敌人形象的强烈关注可能会挤出其他威胁参与者的知识，这反过来又塑造了有关网络空间安全的知识结构。一种补救措施，因此我们认为，