Alice Ternacle is a Master’s student in International Law at Université de Bordeaux, focusing on the intersection of international law and cybersecurity governance. She holds a Bachelor’s degree in International Studies from Leiden University, with a regional focus on East Asia. Her research examines how states build credibility in public attributions of cyber operations in the absence of a binding attribution law, with particular interest in state practice, cyber-norm development, and the role of alliances in shaping attribution narratives.

‍

States have collectively agreed that attributions should be substantiated, yet they generally fail to abide by this standard. This paper argues that in the absence of binding attribution law, Western states have increasingly relied on "credibility" as a political mechanism to fill the legal vacuum. I define credibility as a degree of trust constructed through four specific factors: technical capacity, evidence sharing, norm invocation, and, most decisively, alliance-based corroboration. Through a case-study analysis of the 2017 WannaCry ransomware operation, the 2021/22 Albania cyber operations, and the 2025 Asian Winter Games hack, this paper demonstrates that credibility is not a universal concept but one inherently tied to Western alliance architecture. While credibility allows Western states to attribute without publicly sharing sensitive evidence, it politicizes the process. In that sense, credibility does not replace legal requirements and risks deepening the ongoing fracture between Western and non-Western approaches to cyber norms.