USA Today on cyber security experts contemplating if the NSA efforts are part of the battle in cyber proxy war:

Black-and-white distinction between criminal hackers and the intelligence wings of other countries can be difficult to make. It’s common in some nations for hackers to be allowed to operate with impunity as long as they don’t hack anything within their own country, experts say. They’re also expected to share information they come across that might be useful to their nation, and to be “patriotic” and aid the state when called upon, Kellerman said.

Intrusions often have multiple targets and happen on multiple levels. Graham offered a hypothetical example: If a government wanted information about specific types of employees at the Defense Department, it could hire or encourage a hacking group to attack a financial institution or health care system in the Washington, D. C., area. That would get them personal information about hundreds of thousands of individuals, some of whom may work at the Defense Department.

“They’re hiding one attack in the noise of another, and everybody writes it off as cybercrime,” Graham said.

That’s where looking at hacking activity broadly can pay off, Graham said. “You don’t know until you work you way up the food chain if they’re working independently or they’re a small hacking group working with a government,” Graham said.