Methods of Intelligence Agencies

Abstract

Much of the publicly available information about attribution methods and concrete cases originates from reports by security companies. Still, attribution statements by government agencies generate much more attention and are regarded as more reliable. Therefore it is worthwhile to examine what methods are available to intelligence agencies and whether they can provide a more complete picture than those of security companies. In this chapter, public sources are used to gain insights into the attribution methods of intelligence services. What is the relevance of human sources and informants? How do intelligence services monitor Internet traffic to track APT activity? How can offensive cyber-operations support attribution? And how do attackers protect themselves against wiretap** and recruitment attempts from foreign intelligence services? How do the methods of IT security companies compare to those of intelligence services?