Even though the NSA-style attack was conducted by Chinese hackers in March 2016 (comfortably before the Shadow Brokers' leak of NSA tools in August 2016), it's possible that the tools were circulating outside the NSA earlier and thus used outside of NSA direction.

Edit: That was confusing. Basically, we don't know when exactly before Aug2016 the tools were leaked, so it could have been someone else probing the Chinese server.

After the Wikileaks Vault 7 releases, specifically the details about how Marble and Umbrage make it easy to implement a digital false-flag attack, I don't see how anyone can be certain of the identity of a sufficiently skilled attacker in the modern era. Any state security agency in any reasonably-advanced country likely has their own equivalents of the Marble and Umbrage tools at this point.

Was this attack from China? Was it from the US making it look like China to justify US economic and diplomatic retaliation? Was it from Germany looking to embarrass the US with a false-false-flag attack making it look like the US made a false-flag attack on China after the US spied on Merkel's phone conversations?

We could go down rabbit holes forever. Who can be completely trusted to speak openly, knowledgeably, and honestly on specific instances of attacks? Every last individual and organization in that world is neck-deep in their own agendas.

And on that note, are choices like these autocratic top-down decisions, with each attack approved by those leading the NSA, or is it run-of-the-mill, and done without explicit authorization per target by each team? Or are teams separated by target?

I'd imagine it's just the digital extension of an historically ongoing effort to collect anything that could be used as leverage in a conflict, if and when one happens.

Who do you expect the NSA to attack? The French? (I know they probably do that too)

What do you think is NSA's mission?

How about you share your answers and we can compare notes.

Here's what I have.

https://www.nsa.gov/about/mission-values/

That page sounds like standard stuff that organizations put up. Based on James Clapper’s lies that the NSA didn’t collect telephone metadata on Americans, none of the points on that page seem to be truthful or respected.