APT1 — Exposing One of China's Cyber Espionage Units

Filed under idea in proposals.md; written here as moment, and the correction is small because the filing was never really a claim. The id sits in the idea section, but so do the whole batch of candidates appended on 2026-08-17, and those have since come out as four different kinds — sputnik-1957 as moment, printing-press-1440 and von-neumann-singularity-1958 as interpretation, good-intelligence-explosion-1965 as prediction. The section is where they were written down, not what they are.

The kind still has to be argued, because two of the alternatives are genuinely tempting.

Why not idea. The canon's idea is "a framing later work is built out of rather than argued about." The second half fails immediately: this report was argued about, by name, on the day it was published. Jeffrey Carr's "Mandiant APT1 Report Has Critical Analytic Flaws" is dated 19 February 2013, the same date as the report. Something argued over from hour one is not the kind of inheritance idea describes.

Why not interpretation. This is the close call, and it deserves more than a sentence, because the document is literally an interpretation: Mandiant read a body of forensic observation and argued a conclusion from it, complete with an explicit either/or on page 60. But an interpretation entry earns its place by the reading it offers, and this project will essentially never need to cite Mandiant's reading of who ran a particular intrusion campaign between 2006 and 2013. It needs the event and the standard the event set. And the specific interpretation stopped being the live question fifteen months later, when a US federal grand jury indicted five named officers of the same unit, one of them the same persona Mandiant had exposed.

Why moment holds. The canon has already fixed the house definition of the kind, twice. eliza-1966 talked its way out of moment and in doing so established that a moment is a date on which something visibly happened in public; tcp-ip-1983 failed the same clause, on the ground that the cutover was announced to a few hundred host administrators. APT1 passes it about as emphatically as anything in the canon can. It was on the front page of the New York Times the day it landed. And what changed is exactly what build.py's definition asks for — "something that happened and changed what people expected next": after 19 February 2013, what a security company was expected to publish was different.

The descent, and the ancestor that is missing

descends_from names one id, and the edge is one of substance rather than of citation — the report does not mention TCP/IP and had no reason to.

tcp-ip-1983. The hardest single section of the APT1 report is Infrastructure, and it is hard because of a property that entry is about. Mandiant had to account for a minimum of 937 command-and-control servers on 849 distinct IP addresses across 13 countries, plus a layer of "hop" points, before it could say anything about who was at the keyboard. That machinery exists because networks federate without asking a centre: an operator in Shanghai can route through a compromised host in Kansas without anyone's permission, and the packet that arrives carries a source address that is an assertion, not a credential. Attribution is a research problem rather than a lookup for that reason and essentially no other.

The limit of that edge, stated so it is not over-claimed. tcp-ip-1983 was written about uncontainability, and it went out of its way to argue that what the architecture abolished was permission's centre rather than permission itself. The property this entry actually needs is a different one: that the protocol carries no authenticated source. The two are related and are not the same fact, and the canon does not yet have an entry for the second. The ancestor this entry wants and cannot draw is an entry on source authentication and the end-to-end argument — why identity was left out of the network layer, by whom, and on what reasoning. Until that exists, the edge above is the closest honest approximation and should be read as one.

A second ancestor is wanted and absent: the term "Advanced Persistent Threat" itself, which the report uses in its title-adjacent framing and traces to its own January 2010 M-Trends, and which originates in US Air Force usage around 2006 as a way to discuss a state adversary in unclassified company. That coinage is a real piece of this history — a euphemism invented so the naming could be avoided — and this report is the moment the euphemism stopped being necessary. There is no id for it.

What it is

On 19 February 2013 Mandiant, then a private US incident-response firm of a few hundred people, published a 74-page report titled APT1: Exposing One of China's Cyber Espionage Units. The New York Times ran the story the previous evening, 18 February, under David Sanger, David Barboza and Nicole Perlroth's bylines — the one-day offset between the newspaper and the vendor is why the record carries both dates, and both are correct for what they describe.

The report opens with two epigraphs facing each other. A US congressman in October 2011 saying China's economic espionage "has reached an intolerable level." The Chinese Defense Ministry, in January 2013:

> It is unprofessional and groundless to accuse the Chinese military of launching > cyber attacks without any conclusive evidence.

Everything after that is an attempt to answer the second quotation on its own terms.

The reversal, stated in the first paragraph. Mandiant had published on the APT in its January 2010 M-Trends and had taken a deliberately agnostic line then, which the executive summary quotes against itself:

> "The Chinese government may authorize this activity, but there's no way to > determine the extent of its involvement." Now, three years later, we have the > evidence required to change our assessment.

The scale claim. APT1 "has systematically stolen hundreds of terabytes of data from at least 141 organizations, and has demonstrated the capability and intent to steal from dozens of organizations simultaneously." 141 companies across 20 major industries since at least 2006; 87% of the victims headquartered in countries where English is the native language; the targeted industries matching four of the seven strategic emerging industries in China's 12th Five Year Plan. Average time inside a victim network 356 days — a figure the report footnotes as based on 91 of the 141, because in the rest the access was ongoing or the visibility incomplete. Longest 1,764 days, four years and ten months. 6.5 terabytes of compressed data out of a single organisation over ten months. Seventeen new victims in ten industries in the first month of 2011 alone.

The infrastructure count, which is where the argument actually lives. A minimum of 937 C2 servers on 849 distinct IP addresses in 13 countries, 709 of those addresses registered to organisations in China and 109 to the US; 2,551 fully qualified domain names; 1,905 confirmed Remote Desktop logins into the attack infrastructure from 832 different IP addresses between January 2011 and January 2013. Of those 1,905 sessions, 1,849 — 97% — had the operator's keyboard set to "Chinese (Simplified) — US Keyboard". Of the 832 source addresses, 817 (98%) resolved back to China. And of 614 distinct IP addresses observed using the HUC Packet Transmit Tool, 614 of 614 were registered in China and 613 of them — 99.8% — to one of four Shanghai net blocks.

The unit. APT1 "is believed to be the 2nd Bureau of the People's Liberation Army (PLA) General Staff Department's (GSD) 3rd Department (总参三部二局), which is most commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398 (61398部队)." Partially situated on Datong Road (大同路) in Gaoqiaozhen (高桥镇), Pudong New Area (浦东新区), Shanghai; the central building 130,663 square feet, twelve storeys, built in early 2007; staffed by "hundreds, and perhaps thousands" on the evidence of that physical infrastructure; supplied with special fibre optic communications by China Telecom "in the name of national defense"; requiring its personnel to be proficient in English.

The three people. This is the section that made the report notorious, and it is the section where the method is most completely on display. Mandiant named three personas "in an effort to underscore that there are actual individuals behind the keyboard," and added, unprompted: "These operators, like soldiers, may merely be following orders given to them by others."

The chain for the first one is worth setting out in full, because it is a reproducible argument and not an assertion. On 16 January 2004 a user with the nickname 绿野 ("Greenfield") posted a question in a China Military Online forum Q&A with Professor Zhang Zhaozhong of the National Defense University:

> Professor Zhang, I read your book 'Network Warfare' and was deeply impressed by > the views and arguments in the book. It is said that the U.S. military has set up > a dedicated network force referred to as a 'cyber army.' Does China have a > similar force? Does China have cyber troops?

The forum required a profile. The profile carried the email address uglygorilla@163.com and a "real name" of "JackWang". Nine months later, on 25 October 2004, that account registered the domain zone hugesoft.org, which was still under the same registrant when the report went out and which appears throughout APT1's hostnames — ug-opm.hugesoft.org, ug-rj.arrowservice.net, ug-hst.msnhome.org. In 2007 the same handle signed a malware family in the clear: "v1.0 No Doubt to Hack You, Writed by UglyGorilla, 06/29/2007". In February 2011, Anonymous dumped rootkit.com's registered accounts, which included "uglygorilla" with that same 163.com address, registered from 58.246.255.28 — inside the 58.246.0.0/15 range Mandiant had already identified as APT1's home block. And on 2 February 2006 a user "uglygorilla" had uploaded a file to the Chinese developer site PUDN under account details giving the real name 汪东, Wang Dong.

The second persona, DOTA, was placed in Shanghai by a Google verification SMS observed in a live session: the number 159-2193-7229, where "159" is a China Mobile mobile prefix and "2193" a Shanghai one, and where the speed of the response told Mandiant the phone was in the operator's hand. The third, SuperHard, self-identified as being in the Pudong New Area.

And the thing that actually made all of it possible, which the report states plainly and which is the single most important sentence in it for anyone reading a modern attribution:

> Like many Chinese hackers, APT1 attackers do not like to be constrained by the > strict rules put in place by the Communist Party of China (CPC), which deployed > the GFWoC as a censorship measure... This creates a situation where the easiest > way for them to log into Facebook and Twitter is directly from their attack > infrastructure. Once noticed, this is an effective way to discover their real > identities.

The attribution was cracked by operators evading their own government's firewall from the machines they were attacking through.

What was published alongside it. More than 3,000 indicators — domain names, IP addresses, MD5 hashes; sample IOCs and descriptions of over 40 malware families; thirteen X.509 encryption certificates; and a compilation of videos of actual attacker sessions. Footnote 3 on page 2 does more work than any of it:

> Our conclusions are based exclusively on unclassified, open source information > derived from Mandiant observations. None of the information in this report > involves access to or confirmation by classified intelligence.

The conclusion, and the either/or. Page 59: "In a State that rigorously monitors Internet use, it is highly unlikely that the Chinese Government is unaware of an attack group that operates from the Pudong New Area of Shanghai... Therefore the most probable conclusion is that APT1 is able to wage such a long-running and extensive cyber espionage campaign because it is acting with the full knowledge and cooperation of the government. Given the mission, resourcing, and location of PLA Unit 61398, we conclude that PLA Unit 61398 is APT1." Then a six-row table of matched characteristics, then:

> Either > > A secret, resourced organization full of mainland Chinese speakers with direct > access to Shanghai-based telecommunications infrastructure is engaged in a > multi-year, enterprise scale computer espionage campaign right outside of Unit > 61398's gates, performing tasks similar to Unit 61398's known mission. > > Or > > APT1 is Unit 61398.

Why they published, in their own words, page 6:

> The decision to publish a significant part of our intelligence about Unit 61398 > was a painstaking one... the positive impact resulting from our decision to > expose APT1 outweighed the risk to our ability to collect intelligence on this > particular APT group... The issue of attribution has always been a missing link > in publicly understanding the landscape of APT cyber espionage. Without > establishing a solid connection to China, there will always be room for observers > to dismiss APT actions as uncoordinated, solely criminal in nature, or peripheral > to larger national security and global economic concerns.

And the last line before the section ends: "We are acutely aware of the risk this report poses for us. We expect reprisals from China as well as an onslaught of criticism."

One provenance note, marked as recollection. A 2020s account by Kim Zetter, based on interviews with the analyst who led the work, describes the report being assembled in about two weeks from an isolated facility called "The Lair"; Mandia and Reese initially refusing to publish, and reversing when they heard the US government was preparing its own disclosure; advance copies going to the NSA and FBI rather than to the White House, with the NSA asking for one indicator to be withheld; and the timing chosen for the Chinese New Year period. That account also carries a much larger internal estimate of Unit 61398's headcount than the report published. Where the recollection and the document differ, the document is what this entry quotes — the published estimate is "hundreds, and perhaps thousands," and no larger figure appears in it.

Why a reading would cite it

Attribution is the hard part of nearly every security finding this project files, and this is the entry that supplies the standard. Four occasions, all live.

1. When an AI vendor publishes a threat report about its own model being misused. This is now a recurring category and it is the sharpest occasion the entry has. On 13 November 2025 Anthropic published an account of GTG-1002, which it described as the first documented case of a cyberattack largely executed without human intervention at scale — roughly thirty targets, attributed with high confidence to a Chinese state-sponsored group, with the operation put at 80–90% model-executed. The security community's objection was not mainly that the claim was implausible. It was that the report shipped without the thing that makes a vendor attribution checkable. Kevin Beaumont: "the complete lack of IOCs again strongly suggests they don't want to be called out over that." A post titled "Anthropic's paper smells like bullshit" reached the top of Hacker News with over 1,150 points. Bob Rudis of GreyNoise argued the report repackaged trends known for years.

Set that against what Mandiant shipped: 3,000-plus indicators, thirteen certificates, forty malware families described, videos of the sessions, and a footnote disclaiming any classified input. That is not a rhetorical contrast, it is an operational one — the APT1 report handed its critics the material to check it with, and one of them used it the same day. A reading that meets a vendor attribution should ask what the vendor published that would let someone else disagree. That question is this entry's whole contribution.

Interest declared, per rule 7. One of the two reports being compared here is Anthropic's, and Anthropic built the model writing this file. The convenient error in that position is to grade the 2013 report and the 2025 report by different standards, and the direction the error would run is obvious. It has been resisted by writing the criticism of the 2025 report from named critics with their words quoted, and by recording — because it is also true — that the objections above are about evidentiary form and not one of them established that the campaign did not happen. Both halves are here at the same weight.

2. When authorship is attributed to a model rather than to a person. On 11 May 2026 Google's Threat Intelligence Group reported the first known case of threat actors using a language model to find a zero-day and write an exploit for it — a 2FA bypass in a widely used open-source web administration tool, disclosed and patched before the planned mass-exploitation campaign ran. GTIG identified the AI authorship from the code's own tells: a hallucinated CVSS score, educational docstrings, textbook-shaped Python. That is a new species of attribution claim and it rests on stylistic inference, which is precisely the class of evidence Mandiant graded weakest. Appendix A, on the report's own scale: a widely available tool "is not unique and not useful — by itself — as an indicator," a custom backdoor is "a much stronger indicator — although it is generally still not sufficient, on its own, for positive attribution." Cite this entry to put a model-authorship claim on that scale rather than off it.

3. When an attribution is made and a reader wants to know how good it is. The report is the worked example of what the good version looks like: a stated question, an enumerated evidence base, quantified indicators, a named confidence, an explicit alternative hypothesis, and the raw material released. It is also the worked example of that version's failure modes, which section 3 sets out. Both halves are usable, and the entry is more useful for having both.

4. When "China" or any state is named as the actor behind an AI-relevant incident. Attribution to a state is a claim with consequences — the 2014 indictment, the 2015 agreement and the sanctions architecture all descend from this one — and a reading that repeats a state attribution without noticing it is a judgment has smuggled in someone else's. Rid and Buchanan's formulation is the one to carry alongside: attribution is "an art as well as a science" tactically, "a nuanced process not a black-and-white problem" operationally, and "a function of what is at stake politically" strategically — attribution, they argue, is what states make of it.

What it got right, and what it got wrong

Not required for moment, but the report made dated and checkable claims and thirteen years have passed, so it is graded.

Right

The core attribution has held up as well as this class of claim ever does. On 19 May 2014 a federal grand jury in the Western District of Pennsylvania indicted five officers of Unit 61398 — Wang Dong, Sun Kailiang, Wen Xinyu, Huang Zhenyu and Gu Chunhui — for computer intrusion and economic espionage against Westinghouse Electric, the US subsidiaries of SolarWorld, US Steel, Allegheny Technologies, Alcoa and the United Steelworkers. It was the first time the United States charged serving members of a foreign military with cyber offences. Wang Dong is Mandiant's UglyGorilla, arrived at independently by a body with subpoena power and different evidence.

That corroboration should be stated at its actual strength and no higher. An indictment is an accusation, not a verdict. None of the five has ever been extradited or tried; the charges have never been tested by a defence. What the indictment establishes is that a second institution, with access Mandiant did not have, reached the same name — which is meaningfully more than nothing and considerably less than proof.

The self-prediction landed exactly. "We expect reprisals from China as well as an onslaught of criticism." China's Foreign Ministry rejected the report within days; the criticism arrived the same day from Carr and did not stop.

Disruption was real and was measured from this date. Mandiant's own follow-up in May 2013 was titled APT1: Three Months Later — Significantly Impacted, Though Active & Rebuilding, which is a fair self-assessment in that it concedes the rebuilding in the title. FireEye's June 2016 Redline Drawn counted network compromises by China-based groups falling from about 60 in February 2013 to fewer than ten by May 2016 — and the honest reading of that series is that the decline began in mid-2014, before the September 2015 agreement, so neither the report nor the diplomacy can claim it cleanly.

Publishing unclassified was the decision that mattered most. Footnote 3 is why the argument could be attacked at all. Every subsequent public attribution that can be independently checked inherits from that choice, and the ones that cannot be checked are conspicuous by contrast.

Wrong, or overstated

1. The either/or is a genuine logical flaw, and it was named the same day. Carr's 19 February 2013 post argued that Mandiant had not applied Analysis of Competing Hypotheses, that it showed what Richards Heuer called expectation bias, and that its two-option framing was not a hypothesis space — other Chinese services (MSS, PSB), a false flag, or third parties operating through Chinese infrastructure all go unconsidered. His conclusion: Mandiant "simply did not succeed in proving that Unit 61398 is their designated APT1." The criticism lands on the framing more than on the finding, and the report's own body is more careful than its summary: page 59 says "the most probable conclusion," which is estimative language, and then page 60 throws it away for a binary. The lesson is narrow and transferable: the strongest evidence in a report is not improved by being restated as the only alternative to an absurdity.

2. "Beyond a reasonable doubt" is borrowed precision. Appendix A: "we say that two intrusion events are attributed to the same group when we have collected enough indicators to show beyond a reasonable doubt that the same person or group of people were involved." That is a criminal trial standard imported into a forensic clustering judgment, with no procedure, no adversary and no trier of fact attached to it. It is judgment dressed as verdict. This project's own bin/ethos-check.py exists to refuse the same move in its own readings, and the entry is more useful for recording that the founding document of public attribution made it.

3. The commercial position is structural and unresolved. The report ends its indicator section by directing readers to download Mandiant's free host-based tool, and Mandiant sold incident response. None of that makes the analysis wrong, and treating it as disqualifying would be lazy — the analysis is checkable and was checked. But the shape is inherited by every vendor attribution since, including the AI-lab reports in section 2, where the vendor is now also the supplier of the capability being reported on. That is a tighter conflict than Mandiant's, not a looser one, and this entry is the right place to notice it.

4. The deterrence case, which the report never made, has not held. Mandiant's own stated hope was modest — to "temporarily increase the costs of Unit 61398's operations." The claim that grew up around the report afterwards, that naming and shaming deters, is the one that failed. Indictments of un-extraditable defendants, sanctions and public attribution have not stopped state intrusion; the standing scholarly assessment is that deterrence-by-attribution has largely underperformed, and the operational answer to being named was better tradecraft rather than less activity. By the 2020s the characteristic state intrusion is the one that leaves almost nothing to publish — living off the land, no custom malware, no distinguishing tooling. The report worked by punishing bad operational security, and the response was better operational security.

5. The unit outlived the exposure. The PLA General Staff Department's 3rd Department was folded into the Strategic Support Force on 31 December 2015; the SSF was itself dissolved on 19 April 2024 and its network mission passed to the new PLA Cyberspace Force, which inherited the units historically associated with 3PLA — Unit 61398 among them. Thirteen years after being named, photographed and indicted, the organisation is still there under a different parent.

Commonly misused as

Not required for moment, but three of these are common enough in security commentary that a reading meeting them should have the correction to hand.

"APT1 proved that attribution is a solved problem." It proved that this intrusion set could be traced, and the report says why: the operators logged into Facebook and Twitter from their own attack infrastructure because that was the convenient way around the Great Firewall, and they had been signing their malware and reusing a handle since 2004. The evidence was an operational-security failure of a specific group over a specific decade, not a general method. What survived into general practice is the format — enumerate, quantify, publish the indicators, state the alternative — not a capability.

"A private company attributed a state attack, which means private attribution is legitimate" / "...which means attribution is just marketing." Both over-readings, and the entry refuses both. The 2014 indictment shows a state institution reaching the same name, which is more than a marketing document usually achieves. The commercial position and the borrowed courtroom standard show that the incentives and the epistemics are both real. The usable position is the one this entry ends on: judge a vendor attribution by what it published for its critics to use.

"Naming and shaming works" / "naming and shaming is theatre." Section 3 grades both. Compromise counts fell and the fall began before the diplomacy; the unit was disrupted and rebuilt within three months and still exists; the individuals were indicted and never tried. A reading that uses this entry for only one of those is using a fraction of it.

And the one this project must guard against directly. Nothing here is evidence. This entry does not deposit into the ledger and does not move the needle — no terabyte figure, no compromise count, no indictment. It exists so that when a reading meets an attribution claim, it can cite what a checkable one looked like in 2013 and say precisely how the one in front of it differs.

Sources

Primary, read directly unless marked.

• Mandiant, APT1: Exposing One of China's Cyber Espionage Units, Mandiant Intelligence Center, 19 February 2013. Read as rendered pages: cover and contents; epigraphs (p. 1); executive summary and footnote 3 (p. 2); key findings, scale, infrastructure and language indicators (pp. 3–5); "Why We Are Exposing APT1" and the conclusion restated (p. 6); Identities, including the UglyGorilla and DOTA profiles in full (pp. 51–56); Conclusion and Table 12 (pp. 59–60); Appendix A, "How Does Mandiant Distinguish Threat Groups?" (pp. 61–62); Appendix B (pp. 63–64). All quotations above are transcribed from those pages.
• Mandiant, "Mandiant Exposes APT1 – One of China's Cyber Espionage Units", company blog, 19 February 2013, now hosted on the Google Cloud threat intelligence blog. Read: the release announcement and the description of the digital appendix. This is the source for the publication date; the New York Times story by David Sanger, David Barboza and Nicole Perlroth ran 18 February 2013 and is recorded from search results, not read directly.
• Jeffrey Carr, "Mandiant APT1 Report Has Critical Analytic Flaws", 19 February 2013. Read in full. The ACH argument, expectation bias, the false either/or and the alternative hypotheses.
• Benjamin Wittes, "Mandiant Report on 'APT1'", Lawfare, 20 February 2013. Read. The same-week policy reading of the disclosure decision.
• Kim Zetter, "How the Infamous APT-1 Report Exposing China's PLA Hackers Came to Be", Zero Day. Read. The provenance account, sourced to interviews with the analyst who led the work — recollection, and marked as such above wherever it differs from the document.
• US Department of Justice, "U.S. Charges Five Chinese Military Hackers for Cyber Espionage Against U.S. Corporations and a Labor Organization for Commercial Advantage", 19 May 2014, and the FBI's wanted notices for the five. The names, charges and victim list are recorded from search results and the DOJ release's summary, not from the indictment itself.
• Joint US–China understanding announced at the Obama–Xi press conference, 25 September 2015 — neither government to "conduct or knowingly support" cyber-enabled theft of intellectual property for commercial advantage. From the White House press-conference record via search; the transcript was not read in full.
• FireEye iSIGHT Intelligence, Redline Drawn: China Recalculates its use of Cyber Espionage, June 2016. The fall from about 60 compromises in February 2013 to fewer than ten by May 2016, and the observation that the decline predates the agreement. Taken from contemporaneous trade reporting on the report, not read in full.
• Thomas Rid and Ben Buchanan, "Attributing Cyber Attacks", Journal of Strategic Studies 38:1–2 (2015), pp. 4–37. The Q Model and the three-level formulation. Fetch failure recorded: the PDF at cs.brown.edu returned only compressed streams and could not be read; the quoted phrases are from the paper's published abstract as returned by search, and a later reading with access to the full text should treat this citation as unverified beyond the abstract.
• Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, 13 November 2025 (GTG-1002), and Bill Toulas, "Anthropic claims of Claude AI-automated cyberattacks met with doubt", BleepingComputer, November 2025. The BleepingComputer piece was read; the named criticisms (Kevin Beaumont, Daniel Card) and the 80–90% figure come from it. Bob Rudis's comment and the Hacker News thread are from search results, not read directly. The Anthropic report itself was not read for this entry — it is the subject of a comparison about evidentiary form, and the form is what the critics describe.
• Google Threat Intelligence Group, report of 11 May 2026 on the first known AI-created zero-day exploit found in the wild. From search results and trade coverage, not read directly. The identifying tells — hallucinated CVSS score, educational docstrings, textbook-format Python — are reported consistently across several accounts but have not been checked against GTIG's own text.
• Jamestown Foundation and contemporaneous analysis of the PLA reorganisation of 19 April 2024, for the dissolution of the Strategic Support Force and the transfer of the former 3PLA network units, Unit 61398 among them, to the PLA Cyberspace Force. From search results, not read in full.

Fetch failure, recorded per the rule that a failed search is noted and the work continues. The Stimson Center's 2026 piece Attribution and Responsive Action: Can Accountability Be Brought to Cyberspace? returned HTTP 403 to this machine and nothing from it is used above. It is the most relevant unread source for section 3's fourth point, and a later reading with access to it should expect it to sharpen — and possibly correct — the claim that deterrence-by-attribution has underperformed, which is stated here as a summary of the standing literature rather than as a finding of this entry.