Mr. Ben Nimmo:

In general, I am in favour of transparency in respect of information operations as an educational tool. If people can be shown how it worked on the previous occasion, it will inoculate them against how it will happen the next time, and put pressure on the information operator to change its ways because it will have to find a new tactic. There have been at least four generations of takedown of content from the Russian Internet Research Agency, RIRA, and every time it has had to change tactics precisely because the previous attempt has been caught.

The more transparency, the better. The challenge is the attribution. We do not want people to say an instance must be the Russians because those behind the content behave the way the RIRA did on the previous occasion. The attribution very much comes down to how much the platforms can attribute. Transparency is important and educational but there is a limit beyond which attribution will probably not be able to go. We are in the space where one tells what one can but one has to accept that, sometimes, if the threat actors are clever enough, a hard attribution will not be possible. We want to avoid hysterical attributions to the effect that it is one bot online and that, therefore, it must be a Russian operation. Sadly, there has been much of that in this space recently. Part of what needs to happen is a realistic assessment of what we see, rather than an overexcited one.