Abstract

Appearances in cyberspace are deceptive and problematic. Deception in the cyber domain poses an immensely difficult challenge for states to differentiate between espionage activities in cyberspace and cyber attacks. The inability to distinguish between cyber activities places US cyber infrastructure in a perilous position and increases the possibility of a disproportionate or inadequate response to cyber incidents. This paper uses case analysis to examine the characteristics associated with the tools and decisions related to cyber espionage and cyber attacks to develop a framework for distinction leveraging epidemiological models for combating disease.