Thanks for the extra context. One thing I didn’t see addressed that I’m curious about is how does Google distinguish a “government-backed” attack vs your normal everyday hackers? Is it a function of the specific methods used, the depth and breadth of resources deployed, source ip ranges, or what?