Authoritative attribution of cyberattacks to nation-state actors requires more than purely technical solutions. New institutions are needed to develop the credibility and procedural checks and balances that can take attribution beyond one nation pointing its finger at one of its adversaries. This white paper explores the attribution challenge, reviews proposed models for new institutions, and sketches an agenda for future research.