What is Misattribution? Part 1: Digital Misattribution
Thanks to shows like Catfish and To Catch a Predator, the concept of hiding one’s identity online has become commonplace. But what about when online users create hidden identities, not to disguise the bad guys…but to find them? Misattribution, a term used mostly within the national security community, refers to activities conducted under some kind of assumed identity. In this four-part series, I will go into detail about digital misattribution, operational misattribution, and misattribution challenges.
Listen to the Ntrepid Cast podcast on this topic.
Attribution refers to when a document or piece of work is ascribed to a certain person—the creator of that piece of work. Managing online attribution entails hiding or changing aspects of one’s true identity, using both technical tools and operational tactics. These methods range from simple to complex, and can be used to aid in all types of investigations and online missions.
How Does Digital Misattribution Work?
A user achieves digital misattribution by providing false identifying information, allowing certain actions or content to appear in a way that is different from its true attribution. Misattribution does not include impersonation; that is, attempting to act like a real person who already exists. Rather, misattribution hides the identity of the true author or actor, leading the viewer to believe some other identity carried out certain online activities.
In the past, people often discussed “non-attributed” identities; However, this has become a depreciated term. The reality is that it is impossible to have no identifying information at all when online. Information about someone’s network address, system configuration, and more is always visible. Even the act of trying to strip away all traces leaves a distinctive pattern and can be suspicious in itself.
When managing online attribution, there are three levels of capabilities:
- Low, or acting as “nobody.” This is called being “overtly anonymous,” where it is obvious a person is trying to hide all identifying information. Typically, users achieve this through using public anonymity services, blocking cookies, and hiding browser headers.
- Medium, or acting as “anybody.” Here, a user seems to be a generalized individual with certain characteristics. He or she would look like some random user from a particular city using a computer with certain characteristics, but they would not have any named identity attached to them.
- High, or acting as “somebody.” In this case, one would use a specific alias which could have accounts, history, and patterns of activity visible to observers.
The key idea is that there is always some kind of attribution information visible. Capabilities levels depend on the type of attribution needed for specific mission goals.
