While accurate attribution of the ultimate source of a cyber attack is sometimes difficult, the determination does not have to be airtight. To the extent that false flags are imperfect and rumors of the source of an attack are widely deemed credible (though not legally probative), reputational damage to an attacker’s soft power may contribute to deterrence.