False flag (cyber)
Clues an attacker plants on purpose to put the blame on another actor, which weakens any cover whose outcome depends on who carried out the attack.
A false flag operation is an attack whose author sows technical clues pointing at someone else: reused code fragments, comments in another language, infrastructure borrowed from a known group. It aims to muddy attribution, which relies on exactly those clues. For insurance, a false flag is a contract problem as much as a technical one: once a war or state act exclusion depends on the attacker's identity, a mistaken attribution moves a loss from one side of the cover to the other. That is why the London market's cyber war clauses look first to attribution by the government of the affected state, then to a reasonable inference, rather than to the insurer's own analysis. The underwriter must read these clauses knowing that the first public attribution is not always the right one.
On February 9, 2018, the Olympic Destroyer attack crippled the systems of the Pyeongchang Games opening ceremony. Its code mimicked that of the North Korean Lazarus group; it took until October 19, 2020 for the US Justice Department to indict six Russian military intelligence officers.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.