The week’s loudest attribution stories rest on unnamed sources, one hedged word and an interested official

Middle East Eye reported suspected spyware attacks on the phones of Turkish ministers roughly a week ago. The qualifier is doing the work: we have seen no named forensic laboratory attached to the finding, no published indicators, and no Turkish government confirmation. Until Citizen Lab, Amnesty International’s Security Lab or Ankara puts a name to a determination, this is a claim about an event rather than a confirmed event, and should be written that way. NBC News’s account of attempted Iranian cyberattacks on a range of US infrastructure carries “sources say” in its own headline — unnamed American officials, attributable to NBC’s reporting, not statable as fact. The National’s characterisation of Iranian cyber strategy as a “perfect weapon” appears to be an analyst’s phrase; we could not confirm the speaker.

The on-the-record material sits elsewhere and attracts less traffic. CISA’s advisory AA26-097A of 22 July, on Iranian-affiliated actors exploiting programmable logic controllers across US critical infrastructure, is authoritative and signed. Meta’s H2 2026 adversarial threat report is public in full, while the pickups have all worked from a single exclusive’s framing. By contrast, the Times of Israel’s June report of surging Iranian attacks quotes a serving Israeli cyber official — an official characterisation by a party to the conflict, not independent measurement. Citizen Lab’s “Bad Connection” telecom-exploitation research, published in April and May, is now being recirculated by at least one partisan social account as a finding about “Israeli-linked telecom infrastructure,” language sharper than the researchers' own.

Assessment: There is a reliable hierarchy here and it is inversely related to reach. Signed advisories and lab reports travel slowly; hedged single-source claims travel fast and shed their hedges en route. Watch specifically for the moment “suspected” becomes “confirmed” in a third-party summary of the Turkish story, and for advocacy accounts hardening Citizen Lab’s careful attribution language. A smaller hygiene point with the same lesson: Human Rights Watch’s Iran shutdown piece carries 6 March in its URL and 26 March in its indexed page age. Provenance errors of that size are common and they are how stale material re-enters circulation dated as new.