ATTACK ATTRIBUTIONFifty-Five Hours of Risk: The Dangerous Implications of Slow Attack Attribution

By J. D. Maddox

It took fifty-five hours and twenty-five minutes for a news organization to publish an authoritative public attribution of the Islamic State’s dual suicide bombings in Kerman, Iran, which killed at least ninety people on January 3. During that time, at least one Iranian high official openly blamed Israel for the attacks and called for reprisal attacks, and in the immediate aftermath some American reporters simply repeated Iranian accusations, offering little further investigation into the originators. In the meantime, the Islamic State’s claim to the attacks was questioned and debated broadly.

These rhetorical reactions to the bombings in Kerman are understandable. Amid shifting political and military relationships, it may be increasingly difficult to quickly and reliably identify the perpetrators of an attack. With the greater prominence of proxy organizations used to do the biddings of vengeful states, reliably identifying an attacker’s identity also may be harder. And public officials, news organizations, and commentators can be quick to apply existing paradigms to their attack analysis (intelligence analysts call this “anchoring”). Although the Sunni Islamic State has previously attacked its Shiite Iranian nemesis using similar tactics, Tehran’s close focus on the current Israel-Hamas fight might have anchored it to its inaccurate attribution.

But understandable or not, a delay in accurate attack attribution can give attack originators, or other spoilers, valuable time to redirect blame and to instigate tragic reprisals. Fifty-five hours is an extraordinary window of time for these kinds of malign influence operations. The Russians, for example, are well known for their historical misattribution efforts—creating timely false pretext for acts of violence ranging from the 1939 Winter War to the current war in Ukraine. Their recent influence operations in the United States offer a fairly clear picture of their effective synchronization of offline and online operations, meant to propel Americans’ online sympathies into physical action. Their instigation of physical protests around the 2016 US presidential election is by now legendary.

In the context of current Middle East tensions, it’s easy to imagine the outcome of an open Israeli attack on Iranian civilians. Civilian deaths would almost certainly provoke a reprisal attack, perhaps escalating Iran’s current proxy war and enabling hawkish new Iranian relationships against Israel and other shared enemies. The United States would not be immune to new violence, and instead would likely be drawn into a more complex security dilemma—a choice between commitment to a long-term ally and commitment to open regional warfare. Disproving false claims of such an attack—quickly—is essential to avoiding misdirected