A digital forensic report is the most decisive document in a cyber loss and the most badly read. It is written by technicians for technicians, in a register of probability and converging evidence, and it is then used by lawyers and underwriters in a register of proof and characterization. Between the two a distinction is lost that this module exists to restore: what a report establishes, what it assumes, and what it did not look for. A cyber war exclusion triggering on state attribution depends entirely on that reading.
One must first understand what an investigator actually observes, because it is never an actor. It observes artifacts: command and control addresses, file hashes, timestamps, character strings in a binary, operational habits called modes of operation. From those traces, it matches a set already described by others, to which the community has given a name. That matching is a classification, not an identification: saying an intrusion resembles those of a known set does not say who typed the commands, and the gap between the two is exactly where contracts are disputed.
Three levels are superimposed in what is called attribution, and confusing them is the central error. Technical attribution links an intrusion to a set of tools and methods; it is the investigator's province and is documented. Attribution to a named group links that set to a presumed organization; it belongs to private intelligence and rests on sources the report does not show. State attribution, finally, says a state is responsible; it is a political act, pronounced by a government, often months later, and sometimes never. A technical report never produces the third level, and many clauses depend on it.
One must then read the confidence vocabulary these reports use, because it is standardized and says exactly what it means. A conclusion with high confidence rests on converging evidence of several kinds; medium confidence signals consistent elements insufficient to exclude other hypotheses; low confidence marks a plausible and unsupported hypothesis. The formula that causes the most trouble is that of a probably state-sponsored or state-linked actor: it is technically honest and it settles nothing legally, since probably is not a finding and linked to is not an attachment.
Then comes the question that decides whole files: what an insurer does with that sentence. Everything depends on the exclusion's drafting, and it must be read before the loss. A clause conditioning the exclusion on official attribution by a government does not operate on a technical report, however probative, and an insurer invoking it on that basis departs from its own text. A clause leaving the assessment to the insurer, on any reasonably available material, by contrast turns the report into the decisive document. The same intrusion, the same report, two policies, two opposite outcomes.
What the report did not look for must be added, and it is often as important as what it found. An investigation is bounded by a scope and a budget: it covers the systems it was pointed at, the period for which logs still exist, and it stops when the question asked receives an answer. A report that does not mention exfiltration does not prove there was none, it says the question was not settled on that scope. That nuance decides the notification obligation, the liability exposure, and the honesty of what is declared to an authority.
The reading method therefore comes to four questions, asked in this order and of every report. What is the scope examined and over what depth of logs. What level of attribution is reached, technical, named group, or state. What confidence vocabulary carries each conclusion, and on what evidence. And what questions were not asked, notably exfiltration. A report read this way serves to characterize; a report read for its conclusion serves to be confidently wrong.
A manufacturer suffers encryption of its production systems on May 3; the loss reaches 12 million euros, of which 9 is business interruption. The forensic report, delivered on June 20, concludes with medium confidence that the intrusion is attributable to a set of tools and methods documented by several vendors, and adds that this set is "probably linked to a state actor". The report states that the scope examined covered production servers and the last sixty days of logs, and that it did not look for exfiltration. The policy excludes acts of war and hostile acts of a state or of an actor acting on its behalf. The insurer invokes the exclusion. What should it be told?
The insurer's position rests on a sentence the report did not write, and that must be shown rather than argued. Three levels of attribution are superimposed and the report reaches only the first: it links the intrusion to a set of tools and methods, which is a technical classification and not an identification. The second level, attachment to a named group, belongs to private intelligence, and the third, state attribution, is a political act pronounced by a government, which the report does not produce and does not claim to produce. The vocabulary says so twice: medium confidence signals consistent elements insufficient to exclude other hypotheses, and the formula probably linked to a state actor is technically honest while settling nothing legally, since probably is not a finding and linked to is not an attachment. Everything then depends on the drafting: if the exclusion targets a hostile act of a state or of an actor acting on its behalf without conditioning the exclusion on official attribution, the insurer may assess for itself, and the debate then bears on the weight of medium confidence, not on its existence. One point cuts the other way and the insured must see it before the insurer does: the report did not look for exfiltration, so it does not prove there was none. That absence of an answer touches the notification obligation and the liability exposure, and it calls for a further investigation on a widened scope, while logs older than sixty days still exist somewhere.
- 01An investigator observes artifacts, never an actor: matching an intrusion to a known set is a classification, not an identification.
- 02Three levels are superimposed, technical, named group, state, and a technical report never produces the third.
- 03Confidence vocabulary is standardized: "probably linked to" is technically honest and settles nothing legally.
- 04An exclusion requiring official attribution does not operate on a technical report; one leaving the assessment to the insurer makes it the decisive document.
- 05A report that does not mention exfiltration does not prove there was none: it says the question was not asked on that scope.