Unlike a military invasion or missile launch, the origin of a cyber attack is often quite ambiguous. If attacks "have no return address," then victims cannot credibly threaten retaliation against would$-$be attackers. Retaliating against the wrong country just because an attack originated there would be foolish: the attack could have simply been routed through another country, initiated by some group unconnected to the state, or be a "false flag" operation designed to cast suspicion on a third party. If deterrence by threat of punishment becomes infeasible, then states might be better off with deterrence by denial through improved defenses. Unfortunately, because cyberdefense is harder than offense, it is difficult to deny access to the shadowy attacker and impair his ability to cause significant damage.

Question $2$ options:

True

False