One reason it matters to distinguish an attack from espionage is so bad arguments can’t be made about deterrence. The threat of a counterattack in and through cyberspace or other domains is a deterrent against a cyberattack, but when you frame espionage as a cyberattack, nope.

Adversaries aren’t naive. They have years and years of getting away with a certain level of activity. When you say “this isn’t deterring cyberattacks” and cite traditional espionage applied through cyberspace, you’re not even having the right discussion. Language matters.

When the U.S. military says their actions will deter cyberattacks, go ahead and pull up the joint publication and read how that’s defined. They’re more deliberate in their chosen language than the private sector and media.

Espionage through CNO isn’t a cyberattack.

And don’t link me to a bunch of material where I would need to explain why my position on “cyberattack” differs from that of my colleagues. Some people believe it helps laymen understand, but my position is people are smart enough to understand the difference.