and yet, we were able to accurately attribute the code released in that leak as being developed by NSA.

We know it was the NSA because of leaked NSA documents that admitted to the affiliation. Not from the tools themselves.

Interesting; could you share your source on that?

I had only previously heard [0] that similarities in the tools were discovered by Kaspersky, not that there were any leaked docs that pointed the finger back at NSA themselves. Are you maybe thinking of PRISM/Wikileaks?

[0] - https://arstechnica.com/information-technology/2015/02/how-o...

Sure, and we should be willing to entertain skepticism of specific incidents when justified. The idea that there's no such thing as real attribution, that it's always fabricated based on political convenience, is just unproductive nihilism.

There is such a thing as real attribution. Just not from IPs and tools that are easily faked. You need more than that, and indeed there were many cases were we got more than that.

Agreed, but this seems to be one of the cases where we got more than that. I don't have time to read the indictment in a ton of depth, but it tells a very detailed story about some of the hackers and how they organized the hacking; it's not just "the IP matched so it's gotta be them".

> There is such a thing as real attribution. Just not from IPs and tools that are easily faked. You need more than that, and indeed there were many cases were we got more than that.

And there are most likely a lot of cases where:

1) "...we got more than that," and...

2) ...data from "IPs and tools that are easily faked" is the only information that could be released publicly without compromising sources and methods.

It's a hopeless wish to want to be able to independently assess (as an amateur!) intelligence findings in all cases. If trusting the official assessments isn't acceptable (cross-checked with general knowledge of the situation), about the only reasonable alternative position is to remain agnostic.