National Cyberstrategy (NCS) M9 Attribution Description Attribution means identifying the perpetrators of attacks as precisely as possible. It plays an important role in determining what further action is taken. The Swiss authorities must be able to attribute cyberattacks directed against Switzerland with security policy implications (whether cyberattacks on Swiss targets or the misuse of Swiss infrastructure for attacks abroad). Attribution is the basis for the formulation of political and legal options for action. Background and need for action Overview of measure To be able to hold the perpetrators of a cyberattack accountable, they must first be identified. This is a major challenge in cyberspace as the perpetrators are not physically present at the site of the attack. Identification is only successful if attacks are detected in time and their technical, operational and strategic context can be analysed. The attribution of cyberattacks is a task of the Federal Intelligence Service (FIS). To fulfil this task, it needs information from its own investigations, but is also reliant on cooperation with other federal units and intelligence sharing with partner services. This has to be regulated. The attribution of cyberattacks is important for political leaders to be able to assess the threat situation. This includes assessing whether an action can be attributed under international law and what possible responses are permitted under international law. It is also the prerequisite for decisions on technical, political or penal measures. Key actors Priorities - Examining and supplementing the legal foundations for the analysis of cyberattacks on Switzerland. Cooperation between the FIS and other federal units. Expanding the FIS's capabilities for analysing cyberattacks with security policy implications. Definition of strategic priorities: It must be determined which attacks are to be analysed in depth. Confederation: FIS, FDFA, fedpol, NCSC GS DDPS Cantons: cantonal police corps, NEDIK 25