The Dynamics of Disclosure: Bias in the Bytes

• In Event: The Politics of Cyber Threat

Abstract

How do the dynamics of threat disclosure affect our understanding of cyberconflict? Fundamentally, researchers do not study cyberattacks, they study reports of cyberattacks that become public through technical reports, group statements, and the media. This fact introduces several layers of bias that fundamentally change the quantity of interest. In this paper, I construct a dataset of publicly known cyberattacks in the United States, including information regarding when the attack occurred, when it was first discovered, when it was first reported, and how it was reported. This article is the first to identify the systemic sources of bias in cyber data - the technical sophistication of both the attacker and target, the nature of the target, and the intentions of the attack (espionage, sabotage, subversion). How often are disclosures voluntary vis-à-vis involuntary, and how is this related to the different characteristics of the attack? Is the population of known cyberattacks reflective of the population of all cyberattacks, or does it reflect the attacks that are most likely to be observed? The amount of time between attack, discovery, and disclosure demonstrates the impact of the technical and political factors in cyberattack data. This paper concludes with a consideration of how this affects existing findings on cyberconflict. For example, if sophisticated attacks are less likely to be discovered, does the fact that there are few cases indicate that cyberweapons are not useful as tools of coercion? Does our understanding of cyber coercion change if we consider the timing of the successful attack instead of when it was discovered or reported?

Author

• Harry Oppenheimer, Harvard University