IDEAS home Printed from https://ideas.repec.org/a/sae/joupea/v61y2024i1p28-43.html
   My bibliography  Save this article

How the process of discovering cyberattacks biases our understanding of cybersecurity

Author

Listed:
  • Harry Oppenheimer

    (Institute on Global Conflict and Cooperation, University of California, USA)

Abstract

Social scientists do not directly study cyberattacks; they draw inferences from attack reports that are public and visible. Like human rights violations or war casualties, there are missing cyberattacks that researchers have not observed. The existing approach is to either ignore missing data and assume they do not exist or argue that reported attacks accurately represent the missing events. This article is the first to detail the steps between attack, discovery and public report to identify sources of bias in cyber data. Visibility bias presents significant inferential challenges for cybersecurity – some attacks are easy to observe or claimed by attackers, while others take a long time to surface or are carried out by actors seeking to hide their actions. The article argues that missing attacks in public reporting likely share features of reported attacks that take the longest to surface. It builds on datasets of cyberattacks by or against Five Eyes (an intelligence alliance composed of Australia, Canada, New Zealand, the United Kingdom and the United States) governments and adds new data on when attacks occurred, when the media first reported them, and the characteristics of attackers and techniques. Leveraging survival models, it demonstrates how the delay between attack and disclosure depends on both the attacker’s identity (state or non-state) and the technical characteristics of the attack (whether it targets information confidentiality, integrity, or availability). The article argues that missing cybersecurity events are least likely to be carried out by non-state actors or target information availability. Our understanding of ‘persistent engagement,’ relative capabilities, ‘intelligence contests’ and cyber coercion rely on accurately measuring restraint. This article’s findings cast significant doubt on whether researchers have accurately measured and observed restraint, and informs how others should consider external validity. This article has implications for our understanding of data bias, empirical cybersecurity research and secrecy in international relations.

Suggested Citation

  • Harry Oppenheimer, 2024. "How the process of discovering cyberattacks biases our understanding of cybersecurity," Journal of Peace Research, Peace Research Institute Oslo, vol. 61(1), pages 28-43, January.
  • Handle: RePEc:sae:joupea:v:61:y:2024:i:1:p:28-43
    DOI: 10.1177/00223433231217687
    as

    Download full text from publisher

    File URL: https://journals.sagepub.com/doi/10.1177/00223433231217687
    Download Restriction: no

    File URL: https://libkey.io/10.1177/00223433231217687?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    References listed on IDEAS

    as
    1. Sophia Dawkins, 2021. "The problem of the missing dead," Journal of Peace Research, Peace Research Institute Oslo, vol. 58(5), pages 1098-1116, September.
    2. Christos Makridis & Lennart Maschmeyer & Max Smeets, 2024. "If it bleeps it leads? Media coverage on cyber conflict and misperception," Journal of Peace Research, Peace Research Institute Oslo, vol. 61(1), pages 72-86, January.
    3. Baliga, Sandeep & Bueno De Mesquita, Ethan & Wolitzky, Alexander, 2020. "Deterrence with Imperfect Attribution," American Political Science Review, Cambridge University Press, vol. 114(4), pages 1155-1178, November.
    4. Brandon Valeriano & Ryan C. Maness, 2018. "How We Stopped Worrying about Cyber Doom and Started Collecting Data," Politics and Governance, Cogitatio Press, vol. 6(2), pages 49-60.
    5. Carson, Austin, 2016. "Facing Off and Saving Face: Covert Intervention and Escalation Management in the Korean War," International Organization, Cambridge University Press, vol. 70(1), pages 103-131, January.
    6. Nick Dietrich & Kristine Eck, 2020. "Known unknowns: media bias in the reporting of political violence," International Interactions, Taylor & Francis Journals, vol. 46(6), pages 1043-1060, November.
    7. Fariss, Christopher J., 2014. "Respect for Human Rights has Improved Over Time: Modeling the Changing Standard of Accountability," American Political Science Review, Cambridge University Press, vol. 108(2), pages 297-318, May.
    8. William Akoto, 2024. "Who spies on whom? Unravelling the puzzle of state-sponsored cyber economic espionage," Journal of Peace Research, Peace Research Institute Oslo, vol. 61(1), pages 59-71, January.
    9. Kurizaki, Shuhei, 2007. "Efficient Secrecy: Public versus Private Threats in Crisis Diplomacy," American Political Science Review, Cambridge University Press, vol. 101(3), pages 543-558, August.
    Full references (including those not matched with items on IDEAS)

    Citations

    Citations are extracted by the CitEc Project, subscribe to its RSS feed for this item.
    as


    Cited by:

    1. Ryan Shandler & Daphna Canetti, 2024. "Introduction: Cyber-conflict – Moving from speculation to investigation," Journal of Peace Research, Peace Research Institute Oslo, vol. 61(1), pages 3-9, January.
    2. Nadiya Kostyuk, 2024. "Allies and diffusion of state military cybercapacity," Journal of Peace Research, Peace Research Institute Oslo, vol. 61(1), pages 44-58, January.
    3. Justin Key Canfil, 2024. "Until consensus: Introducing the International Cyber Expression dataset," Journal of Peace Research, Peace Research Institute Oslo, vol. 61(1), pages 150-159, January.

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Melissa Carlson & Barbara Koremenos, 2021. "Cooperation Failure or Secret Collusion? Absolute Monarchs and Informal Cooperation," The Review of International Organizations, Springer, vol. 16(1), pages 95-135, January.
    2. Ryan Shandler & Daphna Canetti, 2024. "Introduction: Cyber-conflict – Moving from speculation to investigation," Journal of Peace Research, Peace Research Institute Oslo, vol. 61(1), pages 3-9, January.
    3. Afiq bin Oslan & T. Ryan Johnson, 2023. "Spies in a Barrel: When To Reel In Espionage," Working Papers tax-mpg-rps-2023-22, Max Planck Institute for Tax Law and Public Finance.
    4. Dreher, Axel & Fuchs, Andreas & Langlotz, Sarah, 2019. "The effects of foreign aid on refugee flows," European Economic Review, Elsevier, vol. 112(C), pages 127-147.
    5. Sarah A. V. Ellington & Benjamin E. Bagozzi & Daniel Berliner & Brian Palmer-Rubin & Aaron Erlich, 2022. "Measuring Human Rights Abuse from Access to Information Requests," Journal of Conflict Resolution, Peace Science Society (International), vol. 66(2), pages 357-384, February.
    6. Jule Krüger & Ragnhild Nordås, 2020. "A latent variable approach to measuring wartime sexual violence," Journal of Peace Research, Peace Research Institute Oslo, vol. 57(6), pages 728-739, November.
    7. Afesorgbor, Sylvanus Kwaku & Mahadevan, Renuka, 2016. "The Impact of Economic Sanctions on Income Inequality of Target States," World Development, Elsevier, vol. 83(C), pages 1-11.
    8. Escriba-Folch, Abel & Meseguer, Covadonga & Wright, Joseph, 2018. "Remittances and protest in dictatorships," LSE Research Online Documents on Economics 89058, London School of Economics and Political Science, LSE Library.
    9. Guizhou Wang & Jonathan W. Welburn & Kjell Hausken, 2020. "A Two-Period Game Theoretic Model of Zero-Day Attacks with Stockpiling," Games, MDPI, vol. 11(4), pages 1-26, December.
    10. Kimberly R Frugé, 2019. "Repressive agent defections: How power, costs, and uncertainty influence military behavior and state repression," Conflict Management and Peace Science, Peace Science Society (International), vol. 36(6), pages 591-607, November.
    11. K Chad Clay & Ryan Bakker & Anne-Marie Brook & Daniel W Hill Jr & Amanda Murdie, 2020. "Using practitioner surveys to measure human rights: The Human Rights Measurement Initiative’s civil and political rights metrics," Journal of Peace Research, Peace Research Institute Oslo, vol. 57(6), pages 715-727, November.
    12. Wong, Pui-Hang & Celbis, Mehmet Guney, 2015. "Migration as a response to differences in human rights and income: A bilateral panel study," MERIT Working Papers 2015-053, United Nations University - Maastricht Economic and Social Research Institute on Innovation and Technology (MERIT).
    13. Sherry Zaks, 2024. "Do we know it when we see it? (Re)-conceptualizing rebel-to-party transition," Journal of Peace Research, Peace Research Institute Oslo, vol. 61(2), pages 246-262, March.
    14. Bjørnskov, Christian & Pfaff, Katharina, 2021. "Differences matter: The effect of coup types on physical integrity rights," European Journal of Political Economy, Elsevier, vol. 69(C).
    15. Thorin M. Wright, 2020. "Revisionist Conflict and State Repression," International Area Studies Review, Center for International Area Studies, Hankuk University of Foreign Studies, vol. 23(1), pages 49-72, March.
    16. Allard Duursma & Samantha Marie Gamez, 2023. "Introducing the African Peace Processes (APP) dataset: Negotiations and mediation in interstate, intrastate and non-state conflicts in Africa," Journal of Peace Research, Peace Research Institute Oslo, vol. 60(6), pages 1010-1020, November.
    17. Nicole Janz & Noel Johnston & Paasha Mahdavi, 2022. "Expropriation and human rights: does the seizure of FDI signal wider repression?," The Review of International Organizations, Springer, vol. 17(4), pages 847-875, October.
    18. Marius Mehrl & Ioannis Choulis, 2024. "Secret Police Organizations and State Repression," Journal of Conflict Resolution, Peace Science Society (International), vol. 68(5), pages 993-1016, May.
    19. Timothy M. Peterson, 2017. "Export Diversity and Human Rights," Journal of Conflict Resolution, Peace Science Society (International), vol. 61(8), pages 1740-1767, September.
    20. Svend-Erik Skaaning, 2018. "Different Types of Data and the Validity of Democracy Measures," Politics and Governance, Cogitatio Press, vol. 6(1), pages 105-116.

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:sae:joupea:v:61:y:2024:i:1:p:28-43. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: SAGE Publications (email available below). General contact details of provider: http://www.prio.no/ .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.