The Attribution Threshold: From Technical Confidence to Lawful Response in Cyber-Economic Warfare

Cyber-economic warfare presents government with an unpleasant choice which the language of confidence has too often concealed. If the State waits for evidence fit to convict a named operator, the hospital may lose its records, the water utility its control system and the winter grid its margin of safety. If it treats technical suspicion as proof of State responsibility, it may punish the wrong person, strike the wrong object or convert a remediable intrusion into an international crisis. The defect is not that attribution is impossible. It is that law has failed to state, in one place, what must be attributed, to whom, upon what material and with what degree of assurance before each form of response becomes lawful. This paper supplies that missing law of decision. Technical attribution identifies infrastructure, tooling, access, operator and campaign. Legal attribution asks whether proved conduct is that of a natural person, company, State organ, empowered entity, instructed or controlled auxiliary, adopting State or assisting State. Decisional attribution asks whether the evidence is sufficient for the particular act now proposed. Those questions overlap, but they are not interchangeable. A malware family is not a State; nationality is not control; presence on territory is not knowledge; and a government's public assessment is not a criminal conviction. The paper establishes a response ladder. Reversible preservation and defensive containment may proceed upon recorded and particularised reasonable grounds, provided that the measure is narrow, short and independently reviewable. Confidential diplomacy may rest upon a candid intelligence assessment which identifies gaps. Public attribution requires corroborated, source-conscious confidence sufficient to justify the accusation to allies, the public and the accused. Sanctions and civil restraint require the statutory or judicial threshold governing the interference and a rational connection between person, conduct and purpose. Charge requires a realistic prospect of conviction; conviction requires the tribunal to be sure. Countermeasures require a sufficiently established prior internationally wrongful act attributable to the State against which they are directed. Force requires a high degree of confidence in the facts necessary to establish an actual or imminent armed attack, necessity, a lawful target and proportionality; uncertainty concerning a target cannot be cured by certainty concerning the danger in general. Maximum reasonably credible foreseeable harm affects urgency, preservation, precaution and the acceptable cost of temporary defensive error. It does not lower the proof necessary for irreversible punishment or force. The stronger answer to speed is not evidential indulgence but staged authority: preserve first, test hypotheses, contain the smallest dependency, record dissent, demand correction through every recipient and escalate only when the proposition required by the next legal gateway is proved. Classified intelligence and allied reporting may lawfully inform executive action, but secrecy is not weight. The decision record must distinguish direct fact, technical inference, organisational inference, legal conclusion and policy judgement; identify independence, provenance, deception opportunity and material alternatives; and state what would change the conclusion. Closed procedures, special advocates and public-interest immunity may protect sources only within their lawful fields. They cannot create a secret common law of punishment. Where a controller deliberately shards an operation, withholds the manifest or destroys the only record capable of connecting payer, operator and effect, the law may draw a bounded adverse inference against that controller. It may not transfer the controller's obstruction to an innocent territorial State which saw only one fragment. Designed opacity changes the evaluation of evidence against its designer; it does not abolish the substantive rules of attribution. The resulting Attribution Decision Certificate forms the hinge between the MOSAIC evidence architecture and the United Kingdom Economic Warfare Prevention and Response Act proposed in the preceding papers. It records the proposition proved, the applicable threshold, the supporting and contrary material, the decision owner, the measure selected, its maximum duration, the reviewer and the correction route. Firm response and disciplined proof are not opponents. In a domain built upon disguise, speed without a record is rashness, while a standard which can be satisfied only after the threatened harm is complete is not caution but surrender. Publication edition, revised October 2026; not yet peer reviewed.