Yes, probably such an attack would be traceable in some way to a state-sponsored program—if the authorities were to pursue the trail to its conclusion. However, as we have seen in the past, there are cases when an investigation is not fully carried out or does not yield totally convincing...
Yes, probably such an attack would be traceable in some way to a state-sponsored program—if the authorities were to pursue the trail to its conclusion. However, as we have seen in the past, there are cases when an investigation is not fully carried out or does not yield totally convincing results. And a state-sponsored program can be used by an actor who has gone rogue, using facilities available to him against that state, as unexpected as such an act might seem.
The 2001 anthrax mailings in the United States are a case of an apparent non-state actor or actors carrying out biological attacks. Coming as they did only a few weeks after 9/11, many people at the time—not entirely without reason—believed that these mailings might possibly be the second wave of an assault by radical Islamists. Yet they were actually a case of domestic terrorism made to look as if the attackers were al-Qaeda or some other foreign organization. The strain of anthrax was apparently the same as that known to have been developed at a research facility in the United States. For years, the investigation by the FBI seemed either to be going nowhere or to be casting blame prematurely on suspects about whom there was no solid evidence.
The culprit was finally "conclusively" identified in 2010 as a former Army biodefense expert named Bruce Ivins. Given that this man had committed suicide two years earlier, there was no explanation of his motives—or how, if, or why he might have used his access to a government lab to engage in this murder spree. Despite the genuine terror the anthrax attacks caused in 2001, the whole episode was largely dropped from the public consciousness in the wake of so many other events, and most Americans ended up paying little attention to the long investigation or its conclusion.
Such a person as Ivins, assuming he actually was the attacker, was indeed a non-state actor, but one who presumably was tied to the government of the very country he was attacking, as he went rogue. Usually, an individual working alone would need access to government facilities to be able to weaponize anthrax or employ chemical or radiological devices, as Ivins apparently did.
The more conventional attacks by non-state actors using explosives, on the other hand, don't require sophisticated equipment. Hopefully CBRN terrorist attacks will never occur again, but if they do, a competent investigation should be able find that there was a government connection, even if it was not intentional on the part of that government, as the rogue actions of Ivins evidently demonstrated.