Jake Kouns - Cyber Who Done It: Attribution Analysis Through Arrest History

### The Problem of Cyber Threat Attribution In cybersecurity, determining "who did it" has become an obsession for intelligence agencies, corporate incident responders, and news headlines. Following major breaches—such as the Sony Pictures entertainment hack, the Democratic National Committee (DNC) intrusion, and the Office of Personnel Management (OPM) compromise—attribution is swiftly assigned to nation-states like North Korea, Russia, or China. In this presentation, Jake Kouns, CEO and CISO of Risk Based Security, challenges the industry's rush to judgment, critiquing the methodology of commercial threat intelligence reports and contrasting technical claims against verifiable, empirical law enforcement arrest histories.

### Attribution Dice, Technical Indicators, and False Flags Kouns satirizes the commercial intelligence market's overconfidence, referencing satirical "attribution dice" and "attribution magic eight balls" sold to mock corporate reports: - **Fragile Technical Artifacts:** Security vendors frequently base high-confidence attribution on transient forensic indicators: IP address geolocation, command-and-control (C2) domains, malware compilation timestamps, and language encoding artifacts (such as Cyrillic code strings or keyboard layouts). - **The Ease of Deception:** Unlike conventional warfare, where military operations require physical troop movements and missile trajectories, cyber operations are trivially easy to disguise. Sophisticated threat actors intentionally incorporate false-flag indicators, borrow publicly leaked exploit code, utilize commercial VPN networks, and manipulate compile clocks to mislead forensic investigators. - **The Case of Guccifer 2.0:** Kouns examines the murky personas claiming responsibility for high-profile political breaches, demonstrating how self-proclaimed Romanian hackers, hacktivist front groups, and state-sponsored espionage units deliberately blend identities to confuse media and intelligence analysts.

### Introducing the Arrest Tracker Dataset To move beyond subjective vendor speculation, Kouns and researcher Lee Johnstone created "Arrest Tracker," a comprehensive empirical database tracking real-world legal actions against computer criminals worldwide: - **Data Scope:** The project aggregates verifiable arrest records, formal indictments, extradition proceedings, judicial convictions, fines, and prison sentences across federal and international law enforcement bodies (including the FBI, Secret Service, DOJ, Europol, and Interpol). - **Methodological Transparency:** By anchoring analysis in sworn legal affidavits and court records, the dataset strips away marketing hype to document which malicious activities actually result in physical apprehensions and successful judicial prosecutions.

### Statistical Analysis of Cybercrime Apprehensions The database reveals sharp divergences between media perception and empirical arrest reality: - **Predominance of Financial Cybercrime:** While news coverage disproportionately focuses on advanced nation-state espionage, the overwhelming majority of global arrests involve financially motivated cybercrime: payment card fraud (carding), banking trojan operators, illicit marketplace vendors, and DDoS-for-hire booters. - **Domestic vs. Foreign Prosecutions:** Law enforcement agencies achieve their highest conviction rates against domestic actors or criminals operating in allied nations with cooperative extradition treaties. In contrast, state-sponsored operators located in non-extradition jurisdictions (e.g., Russia, China, Iran, North Korea) are subject to symbolic indictments in absentia with zero immediate probability of arrest. - **Sentencing Inconsistencies:** The data highlights dramatic disparities in sentencing length and fine amounts across jurisdictions, illustrating that juvenile offenders and low-level script operators frequently receive disproportionately harsh punishments compared to organized syndicates laundering millions through crypto assets.

### Policy Impacts and Realities for Incident Responders Kouns explores the broader strategic implications of attribution: - **Geopolitical Repercussions:** Attribution at the nation-state level triggers real-world consequences, including presidential executive orders, international economic sanctions, and retaliatory diplomatic expulsions. When government attribution is flawed or driven by political convenience, it risks dangerous geopolitical escalation. - **Defender Priorities:** For corporate network defenders, incident response teams, and CISOs, Kouns argues that attribution is largely a costly distraction. Whether an intrusion is executed by a sophisticated intelligence service or an opportunistic script kid, the enterprise's immediate operational imperative remains identical: patch vulnerabilities, evict the adversary, harden architectural controls, and recover compromised assets.

(AI summary — Gemini 3.8 Flash)