> Then they should say nothing. "It was the Russians, trust us" simply doesn't cut it.

This would be better than releasing a report that makes no sense to technical/security people.