Disinformation, deterrence and the politics of attribution

Abstract

How do acts of attribution serve liberal states' attempts at deterring foreign influence operations in their public spheres, and why are they enacted so unevenly? This article nuances the sensitive relationship between domestic politics, the narrow framing of disinformation attribution as a technical question of pinpointing attackers' identities, and the role of disinformation as a security threat to be deterred. As foreign influence operations have (re-)emerged as a critical threat to liberal democracy, efforts to assess and effectively counter their effects have risen on the political agenda. The increase in disinformation campaigns as hostile acts in the context of geopolitical tensions also means that defensive measures serve as deterrence strategies. Like the cybersphere, the information sphere is seen as an extension of physical territory needing credible defence and deterrence.¹ Foreign interference in key political processes such as elections poses an existential risk to democratic states. At the same time, addressing the problem of weaponized disinformation pushes government interventions into the public sphere. Therefore, publicly exposing foreign influence campaigns risks interference with deliberation processes and attracting international attention to a ‘structural vulnerability’ within democracies.² Decisions by governments to attribute campaigns to state or state-like actors are therefore sensitive and charged with uncertainty. The politics surrounding acts of attribution illustrates why deterring disinformation is a challenge, influenced as much by domestic political considerations as by a need to balance geopolitical interests.

Over the past two decades, deterrence theory has undergone a significant expansion. While the fundamental principle of deterrence—influencing an opponent's strategic actions through the perception of cost, benefits and risks—remains consistent, strategies and scenarios have widened to achieve this influence. This expansion reflects geopolitical developments—the shift from American supremacy and East–West bipolarity through nuclear balancing and the gradual inclusion of analytical perspectives outside the traditional domains of rationalist International Relations theory.³ Moreover, emerging technologies and the speed and scope in which they change have been firmly integrated into deterrence scholarship as factors influencing the security dilemma—the risk of misinterpretation in situations of uncertainty.⁴

In this context of fear over escalation—whether from unchecked provocations or efforts at deterrence—the literature has actively engaged with the cybersphere.⁵ Cyber deterrence poses many additional challenges to the traditional interaction dynamics between the deterrent and the deterred, conceptualized in the central ‘attribution problem’.⁶ In the cyber domain, the challenge of identifying a threat actor increases the uncertainty in the deterrence situation.⁷ The ambiguity surrounding the identities of threat actors also exacerbates the disinformation threat, prompting analysts to classify foreign influence campaigns as a subset of cyber attacks.⁸ Consequently, the literature on cyber deterrence and attribution offers a technological solution to identifying the sources of disinformation attacks. The potential to counter the skills and low costs of foreign actors' influence campaigns with an international regime for standardized attribution suggests a reduced advantage for attackers, thereby enhancing deterrence. Although the challenges associated with cyber deterrence offer valuable perspectives on how to address the technical uncertainties of disinformation attacks, this literature obscures the political uncertainties shaping decision-making on attribution in the context of disinformation. The problem of disinformation attribution extends beyond identifying who is responsible and includes the politicization of questions of when and how to attribute.

By bringing what we call the ‘uncertainty loop’ into focus, this article shows how attribution intersects with deterrence in the disinformation context and offers new opportunities to study, analyse and assess empirical variations in attribution strategies pursued by governments. Over the past decade there has been a marked increase in disinformation attribution efforts, driven by initiatives to enhance resilience and deterrence. This has been especially evident in intensified efforts on the part of western governments following Russia's 2022 invasion of Ukraine. Although the ‘proof’ underlying attribution is seldom disclosed, the inconsistent application of attribution measures and retrospective criticism of failures to attribute reveal the complex and politically charged nature of these decisions. Showing how the uncertainty loop is at play in different strategies for attribution, and how the interaction between capabilities and timing dictates which sources of uncertainty take precedence when actors assess costs, the article highlights the domestic dynamic of deterrence and answers recent calls for an expansion of the contextual circumstances which condition the use of attribution as deterrence.⁹

The aim of this article is threefold. It seeks to: 1) bring together research strands in disinformation studies and the fourth wave of deterrence theory; 2) advance a conceptual framework for attribution as deterrence in the context of disinformation, by introducing the uncertainty loop and laying bare the politics of alternative attribution strategies; and 3) illustrate variations of attribution as deterrence through established empirical cases of foreign interference. Our analysis should not be read as a structured comparison, but as an analysis of how factors related to timing and political context can explain variation in attribution acts. We begin by outlining the state of the art in deterrence theory, the attribution problem and how the latter speaks to the disinformation domain. We then show how uncertainty flows differently when the domestic information sphere is the battlefield. We discuss how and why the uncertainty loop matters in decision-making by disentangling forms of attribution from non-attribution. We conclude by calling for studies that can advance our knowledge about how the pursuit of deterrence is shaped by present-day disinformation, its propagation, and the surrounding domestic and geopolitical contexts.

Deterrence and the attribution problem

Deterrence is a tool of statecraft used to prevent an adversary from taking an undesirable course of action. The traditional deterrence theory was developed in a Cold War context of nuclear threats and builds heavily on rationalist assumptions. As Miller underlines, deterrence ‘relies on leaders who are rational enough, informed enough, and value their lives and positions of power’.¹⁰ Deterrence involves cost–benefit calculations which ‘necessarily presume a high order of rationality and calculability’.¹¹ While any cost–benefit calculation suffers from uncertainty in trying to ‘anticipate what the other will do’,¹² the kinetic weaponry upon which deterrence theory was originally moulded allows actors to estimate the threat and the vulnerability of an adversary to an attack.¹³ Taking such assumptions as a point of departure, an adversary's desired response can be instigated by raising the (perception of) costs involved in pursuing a particular path of action. This can be achieved by signalling a potential punishment or denying an adversary the necessary capabilities to act. Credible retaliation threats are crucial, signalling ‘meaningful pain’¹⁴ to deter actors from harmful behaviour. Effective attribution capabilities furthermore play a central part as adversaries must weigh the likelihood of being caught. Thus, attribution is critical to the cost–benefit analysis central to deterrence logic.

As deterrence logic is applied to a novel range of threats—some non-kinetic and asymmetric—the question of attribution emerges as an intricate and pervasive ‘problem’. The cybersecurity literature on deterrence has seen longstanding discussions about the ‘attribution problem’. Cyber attacks are cheaper than kinetic threats, enabling state and non-state actors to interact more equally. The vast number of potential cyber threat actors complicates attribution. Accentuating this problem, threat actors actively exploit the opportunities to obfuscate their identities due to technical issues with traceability in multi-stage attacks.¹⁵ Even if the technological devices employed in an attack can be pinpointed, tracing attacks back to individuals or groups and, in a further step, establishing credible links to state threat actors presents a challenge.¹⁶ Additionally, assessing damage in the cyber domain is more complex than in the kinetic domain. The early cyber deterrence literature therefore emphasizes ‘perfect technical attribution’ as essential for effective deterrence by punishment.¹⁷ At the same time, sometimes even the ‘nature’ of a cyber attack cannot be fully established,¹⁸ causing some scholars to ask whether there could even be ‘such a thing’¹⁹ as a solid case of cyber attribution.

The cybersecurity literature has produced various technological and methodological solutions to address the attribution problem. Researchers and practitioners have developed advanced tools and techniques to enhance attribution capabilities, improve threat detection and strengthen defences. Many analyses support a two-pronged approach, involving technical expertise in ‘threat intelligence and digital forensics experts advising decision-makers’ in combination with international agreements on a common forensic standard.²⁰ This approach depends on the collection of ‘observable data artifacts’²¹ and information on threat actors' behaviours—their ‘tactics, techniques, and procedures (TTPs)’²²—to build a credible case for attribution. Such methods address the uncertainties of cyber attacks through predictive modelling, enabling actors to estimate the likelihood of an attack by a specific actor. Technical advancements have significantly improved the potential for identifying threat actors in the cyber domain.²³ When technical capabilities are credibly communicated, they also generate a potential for ‘deterrence by detection’,²⁴ discouraging potential attackers by signalling a high likelihood of detection and punishment.

Disinformation, like cyber attacks, stems from the digital age, and both are sometimes referred to as ‘hybrid threats’ or tools of ‘hybrid warfare’.²⁵ Still, they differ significantly in their methods and objectives, as well as their impacts on individuals, organizations and societies. Cyber attacks target technological systems and infrastructure directly, whereas disinformation targets human perception and information environments.²⁶ Nonetheless they are frequently linked, as threat actors often use them together. A cyber attack may precede or follow a foreign influence campaign with the goal of undermining a society or disrupting a political process. For instance, the hacked emails of political candidates can be used to diffuse a disinformation campaign by introducing fake documents among authentic content. Like cyber attacks, a disinformation attack introduces difficulties with ‘attribution of who, what, and potentially why an attack occurred’,²⁷ leaving state actors ‘with questions about who to hold accountable’.²⁸ Nevertheless, establishing intent is necessary in a context where ‘many different actors spread false and misleading information constantly and without necessarily pursuing distinct or readily identifiable aims’,²⁹ and framing the problem of disinformation deterrence in technological terms paves the way for technological solutions.³⁰ Inspired by cybersecurity, disinformation studies have developed complex methods to identify threat actors and disinformation traits.³¹ Solutions include behaviour taxonomies, forensic analysis techniques,³² tools for detecting deepfakes³³ and frameworks for identifying social bots.³⁴ As with ‘deterrence by detection’ within cybersecurity, this forensic monitoring enables punishment of malicious actors and signals deterrence capabilities to potential offenders.³⁵

Technological solutions to the attribution problem also underpin contemporary policy practices on foreign information influence. Concerns with identifying behaviours are embedded in the widely used DISARM framework outlining the TTPs of disinformation perpetrators.³⁶ An overarching focus on identifying ‘foreign’ threat actors in the information environment has similarly contributed to international agreements and cooperation on information-sharing between allies, such as the G7 Rapid Response Mechanism³⁷ and the European Union-wide Rapid Alert System.³⁸ The promise of establishing such recognized attribution frameworks is to put in place a standardized and transparent approach, thereby increasing the legitimacy of attribution statements.

While improving the understanding of threat actor behaviours, the cybersecurity approach to disinformation attribution overlooks a key point from constructivist deterrence scholars: deterrence is also influenced by the political stakes involved.³⁹ Scholars spearheading the ‘fourth wave of deterrence theory’ note that technical attribution only addresses part of the problem with cyber deterrence. Various social and contextual factors feed into the cost–benefit calculation underpinning attribution practices⁴⁰ and attribution goes beyond identifying a perpetrator.⁴¹ In a context of actor and threat complexity, leveraging reputation through attribution has, for instance, emerged as a tool for ‘deterrence by delegitimization’.⁴² Rather than being a means to an end, using naming and shaming as deterrence tactics⁴³ makes attribution into a ‘distinct form of punishment’.⁴⁴ Its effectiveness is dependent on social norms and actors' sensitivity to ‘public opinion costs’.⁴⁵ Yet, it is still unclear ‘whether, how, and under what conditions public attribution—and the threat of shaming’⁴⁶ functions as a means for deterrence. Calculating the potential effects of deterrence measures is always difficult, but using attribution to delegitimize actors presents a novel problem of calculability, since it serves both domestic and foreign aims.⁴⁷

Perhaps more than any other threat, foreign influence campaigns demonstrate that the question of a perpetrator's identity is not the only concern of state actors involved in deterrence. Decisions on disinformation attribution are often related to a perceived political need for attribution (or for non-attribution).⁴⁸ This consideration of political factors echoes arguments from the fourth wave of deterrence theory: deterrence is determined by political processes that are mediated through social context(s) and norms.⁴⁹ To adequately address the disinformation attribution problem, we must recognize that foreign influence campaigns differ from both kinetic threats and pure cyber threats. Disinformation unsettles the foundations of liberal democracy. It is the very fact that values and opinions can be contested that weaponizes disinformation.⁵⁰ Disinformation campaigns are known to exploit socio-political cleavages and are most effective when resonating with existing domestic polarization.⁵¹ Disinformation as an external threat thereby intersects with essential processes of political deliberation.⁵² The impact of disinformation is difficult, if not impossible, to distinguish from ‘authentic’ contestation in public opinion. In some cases, campaigns involve domestic actors,⁵³ or actors from several states working in concert.⁵⁴ For these reasons, impact assessments of disinformation campaigns are scarce, and questions concerning harmful effects are not yet settled.⁵⁵ Attribution in a highly polarized domestic context might even generate contrary results, since ‘overstating the power of propaganda risks amplifying not only the original falsehood but also an even more corrosive and polarizing narrative’.⁵⁶

A diverse body of critical and constructivist scholarship has emphasized the politics involved in attributing disinformation. For instance, attribution theory highlights how people perceive behaviour and assign responsibility based on causal information.⁵⁷ This lens helps explain how public attribution involves blaming an actor for spreading disinformation, particularly in politicized, polarized or populist contexts.⁵⁸ In an ideologically charged environment, citizens concerned with disinformation as a threat may display an ‘attribution bias’⁵⁹ and ‘selectively attribute blame to politicians and media from the opposite side’.⁶⁰ The inherent link between attribution and blame also allows politicians⁶¹ to use attribution as a political tool to ‘delegitimise or attack political opponents’.⁶² By emphasizing these potentially harmful implications of attribution, this research brings attention to the precarious politics of attributing disinformation to citizens or political opponents in a democratic context.

Critical security scholars focus instead on the perils of attributing disinformation to foreign adversaries, but highlight similar risks to democratic debate.⁶³ While the foreign/domestic distinction is often mobilized to separate illegitimate disinformation from legitimate public debate,⁶⁴ attributing disinformation to foreign adversaries might raise the political stakes domestically. Attribution in a context of national security not only allows actors to ‘denounce certain opinions’,⁶⁵ but also to describe citizens or particular communities as ‘useful idiots’⁶⁶ or potential ‘fifth columns’.⁶⁷ The blame relayed through attribution is then associated with acting for the benefit of a foreign adversary.

These insights in disinformation studies show how attribution is productive of political risk. The risk tied to attribution arises from a web of uncertainties that need to be factored into the deterrence strategies used against foreign influence operations. Aligned with the fourth wave of deterrence theory, a thorough understanding of deterrence must encompass the material capabilities and technological aspects of attribution and the intersubjective social context in which deterrence is enacted.

The politics of attribution

Building on these arguments, we conceptualize the politics of attribution as the interaction between sources of uncertainty and risk that are related to the capability to attribute and the timing of the political decision to attribute. While technical attribution capabilities can be purposefully developed to strengthen ‘deterrence by detection’, other sources of uncertainty arise from both domestic and international politics. The presence of such uncertainties compels governments to carefully navigate different deterrence scenarios and can explain variations in attribution strategies. Unpacking the politics of disinformation attribution destabilizes the traditional interactional dynamics of deterrence (between the deterrer and the deterred) and demonstrates why foreign information influence is ‘a unique vulnerability’.⁶⁸

In figure 1, below, we envision decision-making processes in relation to the attribution of disinformation as an ‘uncertainty loop’ where timing dictates which sources of uncertainty and risk take precedence when government actors assess costs at a given moment. The loop thereby adds a layer of complexity to the interactional dynamics of deterrence, where timing is seen as relative to the undesirable actions of an adversary,⁶⁹ and brings a domestic component into deterrence theory.

Figure 1:

The uncertainty loop

Open in new tabDownload slide

In the uncertainty loop, a continuous flow of uncertainty charges the decision-making situation. Decisions to attribute disinformation (or refrain from attribution) are based on actors' cost–benefit calculations at any given time. Once a decision has been made, however, the timing of that decision may align with a new set of costs entering the equation. This temporal complexity springs from the specific political-contextual uncertainties affecting cost–benefit calculations in relation to disinformation attribution. Uncertainties spring from: 1) the nature of foreign information influence as an external threat intersecting with domestic processes of political deliberation and 2) the act of public attribution as potentially productive of political risk. On the domestic side of the loop, states can assess neither the harmful impact of influence operations in their own ‘territory’ nor the impact that attribution of foreign interference may have on inter-party relations, the state of public deliberation or levels of public trust. On the international side of the loop, there is uncertainty about whether attribution signals vulnerability or strength to the outside world, whether it would strengthen alliances, and whether it would incur costs to the perpetrator or, in fact, adversely serve their goal. Due to the inherent difficulty of separating domestic politics from the external threat, domestic political risk can also persist even after an attribution decision is made. Because uncertainties continuously generate novel conditions for attribution, it is not the mere accumulation of uncertainty that complicates decision-making, but the unpredictable changes themselves.

Alongside technical attribution capabilities, the dynamic sources of political uncertainty outlined in the loop throw some much-needed⁷⁰ light upon the conditions that governments need to consider when navigating public attribution of disinformation. Further grasping the politics of attribution requires that we distinguish between a set of attribution strategies available to governments, and how these strategies relate to deterrence.

Public attribution refers to instances where governments publicly identify and respond to interference using measures such as sanctions, indictments, media regulations, bans, official statements or counter-operations. In the disinformation context, acts of public attribution serve deterrence by imposing costs on foreign actors who seek to undermine democratic processes. They do so by exposing attackers' identities, laying bare the tactics and strategies they use and condemning them by reference to international law. By holding state actors, groups or individuals publicly accountable for their efforts to interfere in democratic politics, they are ‘named and shamed’. At the same time, governments signal capability and resolve when calling them out.⁷¹ In the logic of ‘deterrence by delegitimization’, public attribution thereby works by imposing social costs while denying the attacker political victories.⁷² The decision to pursue this strategy will, however, depend on the conditions of uncertainty charging the situation at that point in time. The likelihood of attribution around an upcoming election can either increase or decrease based on the policy agenda and the ‘public mood’,⁷³ including perceived levels of resilience.⁷⁴ If the public is polarized on key policy issues, attribution might be seen as further politicizing the situation. Additionally, if the public shows ideological sympathy with the attackers' regime, attribution could be rejected.⁷⁵ In cases where societal resilience is high and disinformation is unlikely to cause significant harm, governments might strategically choose to withhold attribution.

Non-attribution is not merely the absence of attribution or a misdirection of blame, but a deliberate choice to refrain from publicly assigning blame despite having evidence. This approach is therefore distinct from an inability to attribute due to underdeveloped capabilities for ‘deterrence by detection’, and centres on the strategic political implications of attribution. Non-attribution can act as a deterrent by preserving ambiguity about the nature of threats across different audiences. Decisions to pursue non-attribution are influenced by assessments of domestic resilience capabilities and the potential costs both to the perpetrator and in the domestic sphere. Unlike ‘deterrence by denial’, which focuses on building societal resilience, non-attribution weighs the risks of backlash and other domestic consequences. It involves a calculated judgement rather than ignoring the perpetrator outright, and considers how attribution might have unintended negative effects. Timing and capabilities remain crucial, as non-attribution can precede eventual attribution, with strategies evolving based on situational factors and accumulating forensic evidence to reduce uncertainty in the domestic context.

Finally, diffused attribution involves managing the balance between being transparent and maintaining discretion in public discourse. By allowing or informally encouraging credible non-state actors or international organizations to publicly assign blame and suggest consequences, governments can support attribution without directly intervening. This method is akin to ‘deterrence by detection’, in that it publicly demonstrates a technical ability to identify threat actors, but crucially enables shared responsibility for public attribution. Diffused attribution—for instance EU member states collectively imposing sanctions⁷⁶—thereby effectively manages the domestic political impact while signalling international determination. A case in point is the EU's suspension of the activities of the Russian state-owned broadcasters Russia Today (now RT) and Sputnik, both within and directed at EU member states, due to the broadcasters' spread of disinformation.⁷⁷ This approach helps manage uncertainty and reduce vulnerabilities by carefully balancing domestic and geopolitical risks while avoiding publicly assigning blame to citizens. It also strengthens deterrence by fostering credible alliances against threat actors while avoiding direct government intervention in the public sphere.

Public attribution and its alternatives

To further explore the politics of attribution, we will illustrate how the uncertainty loop drives variation in attribution acts by examining three recent cases of foreign interference involving disinformation: the 2016 presidential election in the United States; the 2021 federal election in Germany; and the COVID-19 pandemic of 2020–21. The cases were selected because all three involved reports that there was substantial evidence of disinformation, yet governments adopted distinct approaches to attribution. We argue that these diverging responses are driven by the specific uncertainties permeating the political situation at any given time. The cases differ in their liberal democratic contexts (for instance in terms of levels of cohesion and polarization) and in the range of disclosed sources that determine the strength of evidence available to governments. Our analysis is not focused on evaluating the robustness or effectiveness of attribution, but on exploring how the timing of political circumstances feed into attribution decisions. We cannot determine causal effects, but rather offer a deeper understanding of the political-contextual factors that shape and drive these choices. The logic of inquiry is inductive, and our method of analysis serves to trace political decisions on attribution through a triangulation of publicly available documents, reports and news media reporting. While the lack of public attribution naturally results in a sparser paper trail, the timing of political events and eventual acts of attribution have nevertheless provided us with enough empirical material for our illustrative analysis.

Public attribution

Since 2016, the US government has publicly attributed both disinformation and cyber offences with great frequency, but attention to the timing of attribution statements suggests that a degree of political risk and uncertainty is at play as actors assess attribution costs. The US intelligence community notably exposed Russia's disinformation activities during the 2016 presidential election. This disclosure prompted four investigations assessing the potential electoral harm of the threat and the responses of the government and the Federal Bureau of Intelligence (FBI).⁷⁸ The reports, totalling 2,500 pages of evidence and testimonies, illustrate how Russia's targeted election interference intersected with domestic political polarization, complicating efforts to investigate and attribute foreign interference. Despite possessing the technical capabilities for attribution, these political factors constrained the US strategy of ‘deterrence by detection’.

President Barack Obama first issued sanctions against Russia on 29 December 2016 for ‘aggressive harassment of U.S. officials and cyber operations aimed at the U.S. election’.⁷⁹ Just over a week afterwards, on 6 January 2017, the Office of the Director of National Intelligence released its initial report stating that Russian President Vladimir Putin had orchestrated a campaign to undermine confidence in the US democratic process and to harm Hillary Clinton's candidacy.⁸⁰ The Obama administration refrained from attributing these actions during the campaigning that had begun after Clinton and Donald Trump accepted their party nominations for the presidency in July 2016, leading up to the election on 8 November. The timing of attributing statements and the subsequent report findings shed light on the persistent flow of uncertainty over how attribution would affect the election outcome. The report by special counsel Robert S. Mueller III in April 2019 confirmed that despite warnings to the Russian regime, and even though the FBI had initiated an investigation as early as July,⁸¹ the Obama administration had intentionally delayed public attribution.

The report that was released by special counsel John Durham in 2023 further revealed that uncertainty about how the investigations would be framed in public narratives and the risk of a backlash against politically motivated attribution were involved in the assessment. Most notably, it was perceived that attribution would have benefited the Clinton campaign, which actively sought to highlight the alleged ties between the Russian government and the Trump campaign in the latter months of 2016.⁸² Meanwhile, the Trump campaign capitalized on anti-establishment sentiments and warnings of a ‘rigged election’. The risk was thus that a backlash following a perceived ‘attribution bias’ would negatively influence the legitimacy of the election. Delaying attribution was a way of demonstrating detection capabilities to Russia while not risking the domestic costs of meddling in a polarized electorate. However, Republicans—not least President Trump—immediately used the findings of the Mueller report (e.g. the criticism of delayed attribution) to direct blame at the Obama administration, deflecting discussions on the impact on the election outcome.⁸³ Criticism of the Obama administration increased when the bipartisan Senate Select Committee on Intelligence released its multi-volume report. Volume 3, published in February 2020, suggested that

The Obama administration … tempered its response over concerns about appearing to act politically on behalf of one candidate, undermining public confidence in the election, and provoking additional Russian actions. Further, administration officials' options were limited by incomplete information about the threat and having a narrow slate of response options from which to draw.⁸⁴

While the report was more vocal in directing blame at Obama, it also went further than the Mueller report in detailing the links between the Trump campaign and the Russian state. In addition to the uncertainty about how the calling out of Clinton's unfavourable conditions would be received by the electorate, and about what measures to use in a new situation, the Obama administration was criticized—at least by its opponents—for being lenient with Russia to secure the legacy of the Iran nuclear deal framework.⁸⁵ Hence, there was also geopolitical uncertainty about how an adversary (and its allies) would respond to a deterring move and the potential cost of retaliation.

When Trump assumed office in January 2017, the question of Russian interference was undoubtedly sensitive. The Trump administration opted to continue to downplay the results of investigations while echoing the failure of the Obama administration to protect the election. The Office of Foreign Assets Control of the US Department of the Treasury did not issue sanctions against Russia for its 2016 election interference until 2018.⁸⁶ Still, Trump made headlines in July 2018 when, after his Helsinki summit meeting with Putin, he publicly sided with the Russian president over the FBI's allegations (by then proven) of interference, stating ‘President Putin says it's not Russia. I don't see any reason why it would be.’⁸⁷ Thus Trump again mobilized the flow of uncertainty to his own advantage by pointing fingers at Obama's lack of resolve while simultaneously avoiding costs to his own administration.⁸⁸

By contrast, the Biden administration swiftly addressed Russia's ‘harmful foreign activities’ following the 2020 election through executive orders, economic sanctions and expulsions of diplomats.⁸⁹ The attribution efforts bolstered renewed commitment to multilateralism amid strong domestic and international signals, including expanded sanctions in 2021 targeting Russia-sponsored influence operations and safeguarding US national security.⁹⁰ The flow of uncertainty had shifted, however, and the timing of the Biden administration's decision to attribute was most likely also influenced by other calculations of costs, such as trade-offs in the US debate on privacy rights and the booming digital economy. Big tech, the largest IT companies and dominant owners of social media platforms, represents a growing portion of the US economy. Whereas the EU has leaned towards increasing the accountability of social media platforms that enable and diffuse disinformation (along with other harmful content), the US electorate is divided over the issue of regulation.⁹¹ At the same time, the Biden administration has been criticized for its inability to act on the ‘misinformation plague’ and its handling of the COVID-19 pandemic.⁹² In the US context, public attribution of Russian interference thereby also reassured the public of capable deterrence of ‘a foreign threat’ in the absence of regulatory reform.

Non-attribution

In the case of Germany's 2021 Bundestag election, despite reported disinformation campaigns targeting Annalena Baerbock, the co-leader of Alliance 90/The Greens, officials chose not to publicly attribute the interference to foreign actors. In this example of ‘non-attribution’, the flow of uncertainty led to a distinct pattern of balancing domestic risks and calculating the costs of deterrence. Despite Germany being a prime target for Russian disinformation efforts among EU member states since 2015,⁹³ successive coalition governments had been hesitant in risking the country's stability and reform efforts by reversing Germany's rapprochement with Russia.⁹⁴ In the aftermath of the annexation of Crimea in 2014, Germany aimed to reconcile economic relations—notably in energy and joint ventures like the Nord Stream 2 pipeline project—with the EU's stance against Russia's breaches of international law. Germany's balancing strategy and stance on the disinformation threat therefore centred on ‘deterrence by denial’ and bolstering resilience to prevent harm on the state of public deliberation. Anticipating disinformation and cyber threats during the 2021 federal election, precautionary measures were implemented that included cybersecurity measures, public education initiatives and proactive collaborations with social media platforms.⁹⁵ However, the distinctively gendered disinformation campaigns targeting Annalena Baerbock, the sole female candidate for the chancellorship, were unexpectedly impactful.⁹⁶ Baerbock faced disproportionate attacks, including misogynistic narratives and doctored nude images portraying her as a former sex worker.⁹⁷ Baerbock's criticism of Nord Stream 2 further fuelled these attacks, which were linked to Russian state actors and media.⁹⁸ In fact, since 2021 Russian state media have continued to circulate the false claims of Baerbock's past along with the images.⁹⁹ Although the origin of this campaign and its online amplification was linked to Russia, German media also engaged in sexist rhetoric questioning of Baerbock's ability to balance leadership with motherhood.¹⁰⁰ The sensitive nature of gender-based attacks thus intersected with value conservatism and ‘home-grown misogyny’, complicating the assessment of interference as well as introducing risks of domestic backlash resulting from attribution. Threat actors—in this context most notably Russia—certainly fuelled negative campaigning in Germany, but the resonance of narratives reflected a polarization over both foreign policy (and the stance on Russia) and gender norms. Amid high stakes and Germany's political transition away from Angela Merkel's leadership, public attribution of interference was likely avoided to prevent further polarization and preserve stability, highlighting the complexity of addressing both deterrence interests and domestic risks to electoral integrity. Moreover, the combination of non-attribution and prevailing uncertainty could act as a deterrent by preserving ambiguity about the disinformation threat among the German public.

Russia's invasion of Ukraine in 2022 marked the end of Germany's policy of rapprochement¹⁰¹ and produced a new context for the politics of attribution. Since 2022, actions by Germany further signal deterrence-seeking and a shift from its choice of non-attribution during the 2021 federal elections. The German government has made a series of accusations of Russian disinformation,¹⁰² including digital forensic proof of a large-scale disinformation campaign aimed at discouraging public support for German aid to Ukraine.¹⁰³

In May 2024 Germany went so far as to temporarily recall its ambassador from Moscow, following which then-foreign minister Baerbock publicly attributed interference in German politics to Russian military cyber operators, specifically the advanced persistent threat group APT28 (also known as Fancy Bear or Pawn Storm).¹⁰⁴ The cyber attack was specifically framed as a threat to the integrity of upcoming European Parliament elections, as well as regional elections in Germany and those in neighbouring states. This strategic move positioned Germany's evolving stance in preparation for the 2025 Bundestag election by providing clear ‘deterrence by detection’ signals to Russia while mitigating the uncertainties that had charged the 2021 election. The emphasis on the European Parliament elections was not just an opportunity to combat disinformation while keeping a safe distance from the upcoming federal election: it was also a pivotal moment to expose Russia's geopolitical interests and the stakes of the war in Ukraine to the German public, as well as to emphasize Germany's commitment to its international allies through collective deterrence by both punishment (sanctions and public attribution) and denial (resilience-building).

Diffused attribution

During the COVID-19 pandemic, European governments leveraged EU frameworks to balance the protection of domestic accountability with deterrence interests. The European Commission initially aimed to combat harmful COVID-related misinformation by using the Code of Practice on Disinformation, a voluntary self-regulation initiative for online platforms.¹⁰⁵ Despite this existing measure, European governments also pursued EU-level attribution amid significant domestic political risks.

The COVID-19 pandemic presented a challenge for democratic governments. The uncertainties related to the origins of the virus, its transmission and, later, the safety of the newly developed vaccines were accompanied by an ‘infodemic’¹⁰⁶ involving the spread of false and misleading information. The World Health Organization concluded that the spread of disinformation posed ‘profound health and public safety risks’.¹⁰⁷ This was especially true for the vaccine-related disinformation, which threatened to reduce the uptake of vaccines. Much COVID-related disinformation—according to some, the bulk of dis- and misinformation¹⁰⁸—was disseminated by domestic or intra-EU actors for financial or political gain,¹⁰⁹ or spread by citizens experiencing uncertainty and fear. A set of coordinated foreign influence campaigns was, however, linked to threat actors, notably Russia and China. China focused on deflecting blame for the spread of the virus by spreading narratives on western failures and enhancing its position on the world stage,¹¹⁰ and Russia aimed to weaken public trust in European governments' responses to the pandemic.¹¹¹ In-depth studies show how ‘French and German-language reporting from Russian state media highlighted acts of civil disobedience, and tensions with public authorities amid the pandemic’, and thereby tried to fuel existing domestic divisiveness.¹¹²

Throughout the pandemic, European populations held deeply divided views on the stringent government measures employed to tackle the virus, such as lockdowns and, in some states, compulsory vaccination schemes. In many EU states trust in government was low and resilience to disinformation sometimes poor; groups of citizens engaged in public protests.¹¹³ In countries like Germany and Austria, government responses to the pandemic were politicized by domestic actors. Opposition actors saw an opportunity to gather support for their causes,¹¹⁴ while extremists exploited growing anti-lockdown sentiments within parts of the population.¹¹⁵ These aspects charged the uncertainty loop with a complex set of domestic political risks. Any form of public distribution of blame or social punishment risked being used by domestic political actors to mobilize more support. Attribution of disinformation—even disinformation by foreign adversaries—thereby risked feeding into existing polarized narratives on government overreach and vaccine safety while generating increased support for actors in the opposition.

Rather than pursuing a strict strategy of non-attribution, however, European governments navigated the flow of uncertainty by shifting attribution to the EU level. Beginning in 2020, the European External Action Service (EEAS) published a series of special reports¹¹⁶ on the COVID-19 infodemic, attributing coordinated disinformation campaigns to Russia and China (and, to a certain extent, to Iran).¹¹⁷ The EEAS argued that these threat actors were striving to ‘undermine trust in western-made vaccines, EU institutions and western/European vaccination strategies’ and to fuel ‘anti-vaccination movements within the EU’.¹¹⁸ Following an update in April 2020,¹¹⁹ in an opening statement in the European Parliament, the High Representative of the Union for Foreign Affairs and Security Policy, Josep Borrell, reiterated the attributional intent by underlining that the report ‘very clearly points out state-sponsored disinformation campaigns and very specifically names the actors behind them—including China’.¹²⁰ This last comment was made following criticism that the EEAS tried to avoid attributing disinformation to Chinese state actors,¹²¹ and Borrell underlined that ‘[t]here was no “watering down” of our findings, however uncomfortable they could be’ and indicated the potential use of additional diplomatic measures.¹²² By attributing coordinated campaigns to adversary states, the EU aimed to signal resolve internationally through a collective demonstration of capabilities for deterrence by detection, while allowing individual member states to manage domestic political risk. By moving attribution to the EU level, governments could avoid unfavourable political outcomes generated through public attribution and the overt blaming of citizens, such as enhanced polarization and a display of domestic societal vulnerabilities to COVID-19 disinformation. Furthermore, signalling resolve towards Russia and Iran bolstered the EU's broader geopolitical deterrence stance while navigating uncertainties amid US–China tensions during Trump's presidency.¹²³ Additionally, the diffused attribution strategy potentially enhanced domestic resilience by attributing COVID-19 disinformation to foreign adversaries, thereby discouraging acceptance of similar narratives among EU citizens.

Even with these efforts to mitigate multiple uncertainties, attribution was not without criticism. Following the release of the EEAS special reports, the EU DisinfoLab, an independent non-profit organization producing knowledge on disinformation, published a statement calling for EU institutions to be ‘cautious with attribution’ of foreign influence operations to Russia.¹²⁴ Arguing that ‘there is absolutely no evidence that these [pro-Kremlin media] outlets are the “architects” of the massive disinformation around the coronavirus’, the statement underscored that ‘an overwhelming majority of the disinformation and misinformation’ was internal to the EU and required a different toolbox.¹²⁵

Conclusion

This article has argued that attribution must be seen as a political challenge, and that variations in governments' pursuit of deterrence through disinformation attribution can be better understood through attention to the complex and dynamic flow of political uncertainties conditioning the decision-making situation. By attending to the politics of attribution, and introducing the ‘uncertainty loop’, the article makes several contributions to current discussions on disinformation deterrence.

First, emphasizing timing as a key aspect alongside attribution capabilities highlighted in the cyber deterrence literature, we show how deterrence in the information sphere necessitates attention to a set of highly dynamic political uncertainties in addition to technical attribution models. While the capability to attribute is crucial for deterrence, the absence of attribution does not necessarily mean the absence of such capabilities. Instead, governments might refrain from attribution due to perceived political costs. Second, by also taking seriously the domestic factors at play in disinformation deterrence, the ‘uncertainty loop’ adds to broader discussions within deterrence theory. Crucially, our model challenges the traditional interactional dynamic of deterrence and shows how political costs might also mean domestic political costs. Third, by conceptualizing three different variations of attribution and empirically illustrating how the uncertainty loop allows for different attribution strategies, the article speaks to current debates about the circumstances conditioning the use of ‘naming and shaming’, and appeals to social punishment as a deterrency strategy. Taken together, these novel insights could potentially be applied to better understand deterrence strategies employed in relation to a broader range of non-kinetic threats which interact with domestic factors, and in contexts where actors draw on social norms and the threat of social punishment.

Footnotes

Author notes