In this joint report from the NATO Strategic Communications Centre of Excellence and the European Centre of Excellence for Countering Hybrid Threats, James Pamment and Victoria Smith provide a solid base for further discussion on the attribution of information influence operations, as part of an overall effort between our two Centres of Excellence to improve the theory and practice of attribution. This paper aims to improve the ability of practitioners to collect and analyse evidence in support of the attribution process. It reviews existing approaches to attribution and suggests that malicious activities online can be analysed using four key lenses and three key types of evidence, with differing degrees of accessibility. The paper then looks at how this framework relates to real world cases of investigation conducted by leading practitioners in the field.