An Assessment of the Harms Associated With Ideologically Motivated Cyberattacks

Abstract

There has been a dramatic increase in research on terrorism and extremist activities over the last two decades. Despite this growth, the majority of studies focus on either the harm caused by ideologically-motivated violence in physical spaces, or the ways in which individuals radicalize and organize in online spaces. There is growing evidence that traditional extremist groups and terrorists engage in cyberattacks, such as computer hacking, in support of their ideological beliefs. Little is known about the degree to which ideologically-motivated cyberattacks cause harm to victims, and the correlates of harm depending on the nature of the attack. This study attempts to address this gap in the literature through a quantitative analysis of 425 victims of 246 cyberattacks captured in the open-source Extremist CyberCrime Database (ECCD). Using situational crime prevention, this analysis attempts to identify the significant factors associated with the loss of time, data, and financial harm experienced by victims of cyberattacks performed by ideological actors with and without state sponsorship. The findings demonstrate that the forms of attack reported, as well as the unique attack methods, such as zero-day vulnerabilities, are more likely to lead victims to report the loss of time to the victim, as well as sensitive data and financial losses. The target type is also associated with the loss of both time and sensitive data, however there is no relationship between targets and the financial losses reported from cyberattacks. Additionally, financial harm was more likely to result from non-state sponsored ideological actors, such as racial and ethnically motivated individuals and jihadists. This analysis demonstrates support for the application of situational crime prevention frameworks traditionally used for physical terrorism to virtual ideological attacks. Further, this study demonstrates the importance of assessing cyberattacks as a form of ideologically-motivated crime. Finally, the findings demonstrate the need for increased resources to improve the state of cybersecurity for individuals, businesses, and government agencies to reduce the risk of harm associated with cyberattacks performed by both nation-state sponsored and non-state ideological actors alike.