If it bleeps it leads? Media coverage on cyber conflict and misperception

Extant scholarship has until now relied on informal-theoretic, case study, and interpretative methods to assess patterns of norm development in cyberspace. Ideally, these accounts would be complemented with more systematic cross-national and longitudinal empirical evidence. To address this gap, this article introduces the International Cyber Expression Dataset. The dataset includes a corpus of more than 34,000 official expressions of view by states and their authorized representatives regarding the international politics of cyberspace. The article describes the sources of these data and demonstrates the dataset’s usefulness, with an Online appendix containing an exploratory analysis of norm convergence. Future research can leverage the dataset to empirically test questions of theory and policy. For example, the dataset can be used to study how foundational theories of norm diffusion apply to cyberspace. It can also be paired with existing cyber conflict datasets to study the conditions under which state practice influences cyber discourse, and vice versa.

Until consensus: Introducing the International Cyber Expression dataset

Canfil

2024

How the process of discovering cyberattacks biases our understanding of cybersecurity

Oppenheimer

2024

Social scientists do not directly study cyberattacks; they draw inferences from attack reports that are public and visible. Like human rights violations or war casualties, there are missing cyberattacks that researchers have not observed. The existing approach is to either ignore missing data and assume they do not exist or argue that reported attacks accurately represent the missing events. This article is the first to detail the steps between attack, discovery and public report to identify sources of bias in cyber data. Visibility bias presents significant inferential challenges for cybersecurity – some attacks are easy to observe or claimed by attackers, while others take a long time to surface or are carried out by actors seeking to hide their actions. The article argues that missing attacks in public reporting likely share features of reported attacks that take the longest to surface. It builds on datasets of cyberattacks by or against Five Eyes (an intelligence alliance composed of Australia, Canada, New Zealand, the United Kingdom and the United States) governments and adds new data on when attacks occurred, when the media first reported them, and the characteristics of attackers and techniques. Leveraging survival models, it demonstrates how the delay between attack and disclosure depends on both the attacker’s identity (state or non-state) and the technical characteristics of the attack (whether it targets information confidentiality, integrity, or availability). The article argues that missing cybersecurity events are least likely to be carried out by non-state actors or target information availability. Our understanding of ‘persistent engagement,’ relative capabilities, ‘intelligence contests’ and cyber coercion rely on accurately measuring restraint. This article’s findings cast significant doubt on whether researchers have accurately measured and observed restraint, and informs how others should consider external validity. This article has implications for our understanding of data bias, empirical cybersecurity research and secrecy in international relations.

Cyberattacks and public opinion – The effect of uncertainty in guiding preferences

Jardine,

Porter,

Shandler

2024

When it comes to cybersecurity incidents – public opinion matters. But how do voters form opinions in the aftermath of cyberattacks that are shrouded in ambiguity? How do people account for the uncertainty inherent in cyberspace to forge preferences following attacks? This article seeks to answer these questions by introducing an uncertainty threshold mechanism predicting the level of attributional certainty required for the public to support economic, diplomatic or military responses following cyberattacks. Using a discrete-choice experimental design with 2025 US respondents, we find lower attributional certainty is associated with less support for retaliation, yet this mechanism is contingent on the suspected identity of the attacker and partisan identity. Diplomatic allies possess a reservoir of good will that amplifies the effect of uncertainty, while rivals are less often given the benefit of the doubt. We demonstrate that uncertainty encourages the use of cognitive schemas to overcome ambiguity, and that people fall back upon pre-existing and politically guided views about the suspected country behind an attack. If the ambiguity surrounding cyberattacks has typically been discussed as an operational and strategic concern, this article shifts the focus of attention to the human level and positions the mass public as a forgotten yet important party during cyber conflict.