It's ~impossible to prove who's behind any attack these days given code-reuse, false flags & TOR. Anyone who claims to be able to do it reliably, is bullshitting you and likely has an agenda.
There are plenty of things that get reused such as public keys that can be reliably tied to a group. There are also many private indicators that are not released to the general public Discovering who funds that group or where they operate from can be tougher, but APT groups are trackable.
How is the chain of custody for digital evidence handled by intelligence agencies and 3rd party researchers? Are there higher standards with regard to digital evidence? It seems to me that with digital evidence, ultimately you at least have to trust the investigatory agency at hand. But we're past that, because a huge number of Americans like myself will never trust any information from the US government.
Of course I'm sure the NSA has a number of fluent Chinese speakers.
No native Chinese speaker would unintentionally make such mistakes. Any decent Chinese pinyin input method would have corrected that typo mistake, not to mention handwriting methods. Also, it is highly unlikely to miss a letter when typing Chinese pinyin, unless the person have been pronouncing it wrongly and is unaware of the mistake.
> The text uses certain terms that further narrow down a geographic location. One term, “礼拜” for “week,” is more common in South China, Hong Kong, Taiwan, and Singapore; although it is occasionally used in other regions of the country. The other “杀毒软件” for “anti-virus” is more common in the Chinese mainland.
No, ＂礼拜＂ is used interchangeably across China and it is one of the standard translations of days of the week. And ＂杀毒软件＂ is the default translation of antivirus in Google translate.
I am not saying that the person behind the note is not Chinese. It's just the poor analysis in this article makes me both want to laugh and cry as a native Chinese speaker. The bottom line is, I would not trust a report on Chinese linguistic analysis by three non-native Chinese speakers.
Still the odds are low, considering this is a common phrase and he/she has likely made similar mistakes before (zh -> z) and taken some corrective actions to prevent future typos.
> The two Chinese ransom notes differ substantially from other notes in content, format, and tone. Google Translate fails in both Chinese-English and English-Chinese tests, producing inaccurate results that suggests the Chinese text was likely not have been similarly generated by the English text.
Really? Did Flashpoint even compare English to Chinese samples from the many professional human-based translation services online or was Google Translate their sole source of testing?
> Perhaps most compelling, the Chinese note contains substantial content not present in any other version of the note, is lengthier, and differs slightly in format.
Hmm. That again suggests it may have been interpreted by a human. Although why immediately assume it's one of the authors? A human-based translation service could yield the same results...