“sources and methods” Joyce was referring to—which is also classified. This means that the US government often can’t explain why it attributes an attack to a particular country or group, which means there is no way to independently verify its attribution. This, if you’re someone who tends to distrust the government, is bad. And while it’s obvious that the NSA needs to keep its sources and methods secret, government officials will need to expose them if they expect the general public to believe their attribution claims and support any retaliatory actions they’re going to take.