Breaking the Myth of Cyber Doom: Securitization and Normalization of Novel Threats

Abstract

Physical damage resulting from cyber operations continues to reinforce the “cyber doom” narrative across societies dependent on information and communication technology. This is paradoxical given the absence of severe, lasting consequences from cyber operations and the relative restraint exercised by cyber-capable actors. Moreover, the mass adoption of vulnerable digital systems raises questions whether or not individuals’ dread cyber insecurity is as severe as we are often asked to believe. Employing a survey experiment, we find that the assumptions of the “cyber doom” narrative are misleading. While sensitivity to cybersecurity threats is shaped by negative information, the onset of panic and dread is not a given. The impact of novel environmental circumstances on opinion formation is shaped by the individuals’ embeddedness in modern digital society. Consequently, long-term exposure to any invasive development mitigates the emotional response associated with it, normalizing novel threats over time. We present evidence suggesting that the unique characteristics of a development (i.e., web-technology proliferation) matter in opinion formation, as sensitivity to digital threats to the polity is grounded on personal threat sensitivity. Thus, policymakers can expect to see public responses to new national security threats manifest through the lens of prevailing social and political narratives.

Hitting back or holding back in cyberspace: Experimental evidence regarding Americans’ responses to cyberattacks

“…Recent work in cognate research areas suggests a stronger claim that officials are influenced directly by public opinion when considering the use of force (Chu and Recchia, 2022; Lin-Greenberg, 2021; Tomz et al, 2020). Gomez and Whyte (2021: 124) report that US officials have said during wargames that the severity of a initial response to a cyberattack would depend on the reaction of the American public. Such influence may not need to be observed to be real.…”

“…Despite decades of worries about a “Cyber Pearl Harbor” or similar cataclysms, most cyberattacks take tamer forms, such as defacing web sites or carrying out distributed denial of service attacks. To be sure, more severe cyberattacks have occurred, such as the use of the Stuxnet worm (Lindsay, 2013). Even if cyberattacks have (probably) not yet killed anyone, they have led to significant economic impacts: Maschmeyer (2021: 81–2) reports estimates that the NotPetya attack reduced Ukraine's GDP by 0.5 percentage points in 2017.…”

“…Most previous empirical work, however, does not vary the type of perpetrator committing a cyberattack within an experiment. Recent work has emphasized the motivations of attackers (Gomez and Whyte, 2021), but most earlier studies did not vary the motivations and objectives of perpetrators. Real-world cases have hinted at the significance of this factor for some decision-makers.…”

Public Opinion and Cyberterrorism

“…According to a 2021 Gallup study, the US public ranked “cyberterrorism” as the single most critical threat facing the nation—more even than Russian aggression, the spread of COVID, or the development of nuclear weapons by Iran ( Brenan 2021 ). Some experts seem to share the public’s concern over a potent, even apocalyptic threat of cyberterrorism ( Gross, Canetti, and Vashdi 2016 , 2017 ; Henschke 2021 ), while others view this issue as a hyperbolic depiction of a still developing phenomenon ( Valeriano and Maness 2015 ; Lawson 2019 ; Gomez and Whyte 2021 ). Yet what attacks are people afraid of?…”

Hacking Nuclear Stability: Wargaming Technology, Uncertainty, and Escalation

“…41.Gomez and Whyte 2021; Jensen and Valeriano 2019; Kostyuk and Wayne 2020; Kreps and Schneider 2019; Lindsay 2013; Schneider 2017; Valeriano, Jensen, and Maness 2018; Valeriano and Maness 2015.…”