Attribution of attacks is a fundamental structure in cybersecurity and state safety depends on the stability of this structure. Since 2013 a number of governments and companies have made significant advances in attributing computer network intrusions, setting precedents that had certain legal consequences, for example in the insurance industry. New norms and practices are emerging, and Thomas Rid will reflect on recent trends in cyberattack attribution.