Attribution of State-Sponsored Cyberattacks Takes Years and Rarely Deters

When a cyberattack hits critical infrastructure or steals sensitive government data, one of the first questions is: who did it? Unlike a missile launch with a visible trajectory, cyberattacks are routed through compromised servers across multiple countries, use shared toolkits, and employ false flags designed to implicate other actors. The U.S. intelligence community took months to formally attribute the SolarWinds attack to Russia and years to build the evidentiary case for indictments related to Chinese hacking campaigns. During that delay, the attackers continue operating. The inability to quickly and confidently attribute attacks fundamentally undermines deterrence. In conventional warfare, deterrence works because an adversary knows that an attack will be traced back to them and met with a proportional response. In cyberspace, the attacker can maintain plausible deniability long enough to achieve their objectives and prepare for any eventual response. Even when attribution is eventually established, the consequences are typically limited to sanctions, indictments of intelligence officers who will never stand trial, or diplomatic protests. No nation-state actor has been meaningfully deterred from cyber operations by these responses. This problem persists because of the fundamental asymmetry between offense and defense in cyberspace. Attackers can invest heavily in obfuscation and misdirection at relatively low cost. They route operations through commercial VPNs, compromised third-country infrastructure, and shared malware frameworks that multiple groups use. Intelligence agencies may have classified capabilities to attribute attacks faster, but sharing that evidence publicly would reveal collection methods. This creates a structural tension between the need for public accountability and the need to protect intelligence sources. Until this tension is resolved, or until the cost-benefit calculus of launching cyberattacks fundamentally shifts, attribution will remain too slow and consequences too mild to deter state-sponsored hacking.