A tale of two cybers - how threat reporting by cybersecurity firms systematically underrepresents threats to civil society. Issue 1 (2nd January 2021)

• Record Type: Journal Article
• Authors: Maschmeyer, Lennart; Deibert, Ronald J.; Lindsay, Jon R.
• Is Part Of: Journal of information technology & politics. Volume 18:Issue 1(2021)
• Page Start: 1
• Page End: 20
• Publication Date: 2021-01-02
• Subjects: Cybersecurity -- public goods -- civil society -- threat intelligence -- cyber conflict -- market failure; Electronic government information -- Periodicals; Internet in public administration -- Periodicals; Information technology -- Political aspects -- Periodicals; 320.0285
• DOI: 10.1080/19331681.2020.1776658
• Languages: English
• ISSNs: 1933-1681

Abstract

ABSTRACT: Public and academic knowledge of cyber conflict relies heavily on data from commercial threat reporting. There are reasons to be concerned that these data provide a distorted view of cyber threat activity. Commercial cybersecurity firms only focus on a subset of the universe of threats, and they only report publicly on a subset of the subset. High end threats to high-profile victims are prioritized in commercial reporting while threats to civil society organizations, which lack the resources to pay for high-end cyber defense, tend to be neglected or entirely bracketed. This selection bias not only hampers scholarship on cybersecurity but also has concerning consequences for democracy. We present and analyze an original dataset of available public reporting by the private sector together with independent research centers. We also present three case studies tracing reporting patterns on a cyber operation targeting civil society. Our findings confirm the neglect of civil society threats, supporting the hypothesis that commercial interests of firms will produce a systematic bias in reporting, which functions as much as advertising as intelligence. The result is a truncated sample of cyber conflict that underrepresents civil society targeting and distorts academic debate as well as public policy.