The limits of cyberattacks in eroding political trust: A tripartite survey experiment

Abstract

To what extent do security threats – such as cyberattacks – undermine trust in government? Fears have emerged that cyberattacks undercut public trust in government and sow doubt in democratic institutions heavily dependent on digitised systems. Nevertheless, the logic of this threat remains untested. This article presents survey experiments conducted in the United States (n = 607), the United Kingdom (n = 594), and Israel (n = 627) that examine whether cyberattacks on critical infrastructure truly undermine public trust in government and, if so, by what psychological mechanism. We exposed participants to simulations of cyberattacks against critical infrastructure before measuring the psychological and political outcomes. Our results reveal that cyberattacks do not undermine voters’ trust in the government’s ability to protect them. Furthermore, in the United States, exposure to cyberattacks heightens public trust by amplifying anger. Our findings inject a missing comparative component to the theoretical discussion of when, why, and how cyberattacks affect public trust in government.

Introduction

Cyberattacks on critical infrastructure have become a significant concern in the realm of cybersecurity and, recently, for political scientists. These attacks target vital systems and networks that are essential for the functioning of a country’s economy, security, public safety, and democratic stability. Therefore, it is inevitable that political scientists and cyber scholars alike have zoomed in on an insidious threat: the ability of cyberattacks to undermine public trust and sow doubt in democratic institutions. The logic of this insidious threat works as follows: With critical infrastructures, elections, healthcare, news media, finance, and government bureaucracy all relying on digital networks, the occurrence of cyberattacks by seemingly omniscient and invulnerable actors undercuts the government’s guarantee of personal security and the integrity of democratic institutions (Schneider, 2022; Shandler and Gomez, 2023). If cyberspace, a central pillar underpinning critical infrastructure in modern society, is perceived as vulnerable, the public will reevaluate their trust in the government. Yet despite the intuitive plausibility of the claim that cyberattacks erode public trust, its logic remains undertested, and the psychological mechanism at its heart remains unknown. Therefore, this article presents a rigorous, multi-country experimental analysis that tests whether cyberattacks undermine public trust in government and, if so, by what psychological mechanism they do so.

The idea that cyberattacks can result in political consequences has been reinforced by recent empirical studies demonstrating how cyberattacks influence voters’ attitudes and behaviours. Public exposure to digital attacks has been found to promote militaristic political attitudes, encourage escalation of violence, and amplify public demands for strict new security policies that undermine privacy (Kreps and Schneider, 2019; Leal and Musgrave, 2023b; Snider et al., 2021). Such consequences – as cyber scholars and pundits posit – are liable to subvert the pillars of democratic societies. These effects are thought to manifest as a consequence of the psychological distress that cyberattacks evoke in the public (Shandler et al., 2023a; Shandler and Gomez, 2023).

Be that as it may, scepticism of a cyber-political link persists. Why should the public be swayed by cyberattacks, which lack the visual and explosive spectacle of conventional warfare or terrorism? The idea that voters will respond to political violence by reducing their public trust in government – specifically, the public’s trust in the government’s ability to mitigate future attacks – clashes with a historical line of research depicting the public responding to external threats by rallying behind their political leaders (Mueller, 1970). Moreover, research has shown that civilians typically become resilient to political violence if the effects are constrained, and as cyberattacks become ubiquitous, habituation theory holds that the public is expected to become emotionally inured to ongoing political violence (Bitton and Laufer, 2018; Muldoon, 2003; Nussio, 2020; Waxman, 2011). Therefore, as the novelty surrounding cyber threats fades, an alternative logic dictates that cyberattacks should arouse no discernible effect on public trust in government or perhaps even evoke heightened trust in government as with physical violence. We are thus faced with two competing theories arguing that public exposure to cyberattacks should either amplify or undermine public trust in political leaders and government institutions more broadly.

To isolate the political effects of cyberattacks, we employed a multi-country survey experiment that simulated public exposure to different forms of cyberattacks compared to conventional terrorism. We sampled participants from the United States (n = 607), the United Kingdom (n = 594), and Israel (n = 627) and exposed them to professionally produced original media news reports of threatening cyber-terror attacks on critical infrastructure. Within this experimental framework, we mimicked the style and framing of media coverage, intentionally using exaggerated descriptors such as cyber-terrorism, which are the terms that media convey to the public when reporting about cyberattacks (Jarvis et al., 2017; Shandler et al., 2023b). Participants were randomly assigned to view professionally created video treatments depicting cyberattacks or conventional terror attacks on railway infrastructure, with the attacks either causing lethal outcomes or financial damage. We employed an experimental 2 × 2-factorial design with a pure control group. We collected psychological responses and data on political attitudes to examine whether and how cyberattacks on critical infrastructure produce political consequences to understand the psychological mechanism by which the cyber-political link operates.

Our findings suggest that contrary to recent cyber threat assessments, cyberattacks on critical infrastructure do not directly erode public trust in government – a null finding we obtained in all three cases sampled. Because our literature a priori dictated an emotional mediating mechanism, we followed recommendations by Memon et al. (2018) and Zhao et al. (2010) and tested for mediation regardless of a direct effect. Our empirical evidence corroborates that in the United States (but not in the United Kingdom or Israel), exposure to cyberattacks can increase public trust by generating anger at a common outgroup enemy. We theorise that the suddenness and the isolation of cyberattacks on critical infrastructure play a role in the formation of a rally effect as a result of cyberattacks with lethal outcomes.

As the political science and political psychology literature grapples with the question of how to incorporate cybersecurity within a psycho-political framework, our findings demonstrate that in one regard, at least, cyberattacks do not diverge from classical models, which predict higher public trust in government following shocking and sudden national events. We conclude this article by discussing further avenues of research that cyber scholars should consider in their examination of the cyber-political link.

Exposure to cyberattacks and public trust in government

Stemming from a broadly debated crisis of public trust in government during the last decade, public trust in government has become one of the most debated topics of research in the political sciences. Ranging from discussions about the definition and conceptualisation of public trust in government (see, for example, Hardin, 2002) through the empirical operationalisation and classification of public trust (see the debate between Fisher et al., 2010, 2011 and Hooghe, 2011 about dimensions of public trust in this journal), and theorising the nature and origins of public trust in government (Brody and Shapiro, 1991; Mueller, 1970; Zaller, 1992) – research on public trust is burgeoning. The subject of public trust spans far back to the core roots of democratic governance. In its essence, the paradigmatic idea in scholarly literature considers political trust in government to be an imperative prerequisite for democratic rule and institutional integrity (Ben-Nun Bloom and Arikan, 2013; Crozier et al., 1975).

Although the definition of public trust is still a matter of scholarly debate, the opinion held by most scholars views public trust in government as the perceived ability of governments and law enforcement agencies to produce an expected and publicly desired outcome (see Horne, 2017 for definitions and taxonomy of public trust). As such, public trust in government is a subjective assessment fed by two components – an authority in which trust is placed – the government, and a subject to which trust refers – the public (Berry et al., 2008; Van der Meer, 2017). Essentially, the public is more likely to comply with laws and engage in democratic activity when they trust the government and other democratic institutions (Scholz and Lubell, 1998). From a government perspective, high public trust allows for policy reforms and higher risk-taking. In contrast, lowered trust has been found to compromise government stability and hinder public legitimacy of government (Bianco, 1994).

Thus, public trust in government is fundamental to a thriving democratic society (OECD, 2022). Trust reinforces compliance with various public policies, such as health regulations and the tax system. It also promotes political participation, strengthens social capital, and nurtures institutional legitimacy (Hetherington, 1998). Trust is associated with support for democracy (Ben-Nun Bloom and Arikan, 2013) and is pivotal for community and national resilience (Kimhi, 2016; Kimhi et al., 2020). Therefore, the preservation of public trust in government becomes more salient as modern societies digitise (Wang et al., 2023; You and Wang, 2020). Citizens must be able to trust that the government can manage and regulate digitised systems to mitigate the recurrence of cyberattacks that exploit structural digital vulnerabilities (Maschmeyer, 2023). Because regulatory regimes rely on digitised networks almost exclusively, Haber and Reichman (2020) argue that the state can be understood as a networked entity. Hence, public trust in government is particularly sensitive to new digital and systematic vulnerabilities and exploits.

Prior to the digital era, research on political violence and public trust in government primarily focused on the ‘rally ‘round the flag’ effect (Perrin and Smolek, 2009; Woods, 2011). As Mueller (1970) explained, exposure to sudden violence by external forces, such as international terrorism, causes voters to rally behind political leaders. Theoretical approaches to the nature and origins of the rally effect have resulted in two primary schools of thought. The first – what Brody and Shapiro (1991) referred to as Mueller’s ‘patriotism’ explanation – posits that in times of national threat, the public will uncritically unite behind the political incumbent for fear of hindering the nation’s success in recovery. According to the ‘rally’ view, the public relates to the commander-in-chief as an ‘anthropomorphic symbol of national unity – a kind of living flag’ (Hetherington and Nelson, 2003: 37). Hetherington and Nelson’s account of a rally effect can be viewed as a political reflex, in which the public responds to a national event without more profound consideration of preexisting experiences with the government’s past responses or policies. Another account for the rally phenomenon – what Brody and Shapiro (1991) and Zaller (1992) refer to as the ‘opinion leadership’ interpretation – posits that a rally effect, to the extent that a rally effect forms (but see Baker and Oneal, 2001; Feinstein, 2018, 2022) is not dissimilar to any other political phenomena. According to the ‘opinion leadership’ view, when the public is given the opportunity to consider the government’s performance, the public will do so based on preexisting information about government performance and policies and the availability of new information as relayed by the media.

Nevertheless, cyber scholars argue that growing public dependence upon the cyber domain for everyday activities introduces unprecedented political vulnerabilities. But if sudden external threats have historically caused surges in political trust, why should cyberattacks produce an opposite set of political effects? Cyber scholars posit that the importance of the answer to this question lies within the ever-changing social and political landscape consequent to the rapid progression of the information highway and, inevitably, the rapid digitisation of states (Maschmeyer, 2023; Schneider, 2022). Cyber scholars’ divergence from traditional models that explain public trust following political violence is premised on cyberspace-specific factors. As opposed to the physical sphere, cyberspace enables enhanced speed and distance of coercive action (Kuehl, 2007) and greater anonymity that complicates the process of attributing attackers (Egloff and Wenger, 2019; Finlay and Payne, 2019; Libicki, 2009; Lynn, 2010), and is regularly depicted by the mass media in hyperbolic images of mass destruction, which amplify fear and threat perception within the public (Jarvis et al., 2017; Lawson, 2019). Furthermore, recent work on the political effects of cyberattacks reveals that assumptions about cyber assailants and uncertainty about perpetrators’ identity can bear with them political consequences (Egloff and Dunn Cavelty, 2021; Gartzke, 2021). In turn, uncertainty about the nature of an attack can lead decision-makers to (erroneously or not) rely on heuristics in responding to them (Gomez and Villar, 2018). Owing to the uncertainties surrounding cyberattacks and the identity of perpetrators, authorities must often guess what the most effective policy response should be (Gomez and Villar, 2018). From a public perspective, the uncertainty associated with cyberattacks generates a sense of dread (Gomez and Villar, 2018; Van Schaik et al., 2017), which leads governments to adopt restrained responses that differ from those employed in response to non-cybernetic violence (Gomez, 2019; Kaminska, 2021; Leal and Musgrave, 2022).

Congruent to these cyber-specific factors, empirical works have demonstrated that cyberattacks generate distinct political effects that differ from classical theories that predict political behaviour. For example, research has found that cyberattacks arouse more robust public demands for an escalation of government responses (Schneider, 2020; Valeriano and Jenson, 2019). These include a heightened desire for military retaliation (Gross et al., 2017), public calls for enhanced protective measures (Canetti et al., 2021), and a willingness to sacrifice civil liberties for the sake of enhanced personal and national security (Snider et al., 2021). Furthermore, distinct to cyberattacks is that shifting political preferences hinge on a lethality threshold, suggesting that only certain types of cyberattacks generate strong political effects (Shandler and Gomez, 2023). It logically follows that trust evaluations following cyberattacks may plausibly be different from trust evaluations following conventional warfare and political violence.

Exploring the psychological mechanisms behind cyber-trust effects

Overall, research on American political reactions to sudden terror attacks suggests that emotions can play a central role in the formation of political attitudes (Marcus et al., 2000; Vasilopoulos et al., 2019). Notwithstanding, studies on the role of emotions in driving political attitudes following cyberattacks remain understudied and provide conflicting evidence (Feinstein, 2022; Gomez and Whyte, 2021; Gross et al., 2009, 2017; McDermott, 2019; Shandler and Gomez, 2023; Snider et al., 2021).

To understand how emotional mechanisms interact with digital violence, we can draw on several decades of political psychology research that have studied the psychological effects of conventional terrorism and political violence. Underpinning state-level outcomes of terror attacks are the affective mechanisms that drive political outcomes (Snider et al., 2023). Research has indicated that terrorism affects the public psychologically: Terror can affect life satisfaction (Frey et al., 2009) and result in anxiety, sadness, anger, and dejection (Pliskin et al., 2020). Emotional responses to terrorism and political violence include identifying positive and negative emotional states. Research has found that terror evokes psychological distress such as anxiety (Canetti-Nisim et al., 2009; Liverant et al., 2004; Sinclair and LoCicero, 2007), fear (Ronen et al., 2003), and anger (Lerner et al., 2003) among other negative affective states. Of these, anger and anxiety are thought to generate the most politically consequential effects (Huddy et al., 2002, 2007, 2009; Huddy and Feldman, 2011).

Although anger and anxiety are considered ‘negative emotional states’, these emotions, when decoupled, give rise to vastly different political outcomes. In his definition of anger, Darwin (1872, 1993: 244) referred to anger as a state of mind that differs ‘ . . . from rage only in degree, and there is no marked distinction in their characteristic signs’. Thus, Darwin implicitly defined anger as an emotional state that varies in intensity, from mild irritation or annoyance to intense fury and rage. Anger is often experienced when people perceive themselves or those around them to have suffered a wrong, which arouses a desire to rectify the harm inflicted. Thus, anger acts as a motivating agent, and angry individuals experience moral outrage, denigration of the outgroup, and support hawkish national security policies (Huddy et al., 2009; Lerner and Tiedens, 2006). For instance, in the extensive research on the effects of public exposure to 9/11, it was found that people who predominantly experienced an anger response exhibited heightened trust in government (a rally response) because they perceived the nation to be under attack and in a state of perceived threat (Perrin and Smolek, 2009; Skocpol, 2002).

Distinctive from anger, anxiety is an emotional experience prompted by situations perceived as uncertain and lacking situational control (Lerner and Keltner, 2000, 2001). Once aroused, anxiety encourages pessimistic judgements and causes people to seek information to minimise future victimisation. Huddy and Feldman (2011) found that anxious people feel a sense of personal threat, seek ingroup enhancement, engage in reaffirmation of social values, and are less likely to support overseas military action. The aversive, information-seeking, threat-reducing behaviour aroused by anxiety differs from the active response elicited by anger, which causes people to seek retaliatory action to regain a sense of emotional equilibrium (Huddy et al., 2021).

Considering the distinct features of cyberspace, to what extent can the classical literature on the emotional effects of terrorism apply to new age digitised cyberattacks? To the extent that cyberattacks are simply a subgroup of the broader category of violence, then we could expect the prevailing theories to apply equally. Nevertheless, research has revealed that the qualities of cyberspace give rise to different emotional reactions to cyberattacks (Backhaus et al., 2020; Canetti et al., 2016). Other research has examined how emotional reactions to cyberattacks predict changes in public trust in government (Gross et al., 2017; Shandler and Gomez, 2023). Furthermore, studies have found that cyberattacks evoke dread, anxiety, anger, and heightened threat and risk perceptions (Kostyuk and Wayne, 2021). Gross et al. (2017) found a slight increase in public trust following cyberattacks, whereas Shandler and Gomez (2023) found the opposite: lowered trust due to a heightened sense of dread. Thus, based on the abovementioned literature, we hypothesise the following:

• H1. Exposure to cyberattacks on critical infrastructure will result in heightened levels of anger and anxiety.

• H2(a). Anger will mediate the relationship between exposure to cyberattacks and public trust in government, which will result in increased public trust.

• H2(b). Anxiety will mediate the relationship between exposure to cyberattacks on critical infrastructure and public trust in government which will result in decreased public trust.

Methodology

Procedure

Prior to our main study, we ran a pilot experiment in the United States (n = 50) to verify the efficacy of our experimental manipulations, specifically, to confirm that exposure to media reports of terror attacks caused significant variance in both emotional and political responses. To this end, we concocted a New York Times article that reported different types of terror attacks causing derailments on the Amtrak train network (see Supplemental Appendix B for the full procedure, results, and vignette).

Following the reaffirmation of our hypotheses in the pilot study, we conducted a multi-country experimental study to measure how cyberattacks influence trust in government and the psychological mechanism underlying such an effect. We surveyed 1828 participants in the United States (n = 607), the United Kingdom (n = 594), and Israel (n = 627; see Supplemental Appendix A for an analysis of power). Participants were recruited by Amazon Mechanical Turk in the United States, Prolific in the United Kingdom, and the Midgam Survey Company in Israel. We focused on these three countries for the following two main reasons: they are all strong democracies; therefore, public trust is a salient political matter, and they are all frequent victims of cyberattacks, increasing the experimental realism of the treatments. The selection of these countries also reflects a reality wherein the countries currently most susceptible to cyberattacks are the United States, Europe, and the West more broadly (Macdonald et al., 2022).

Participants were randomly assigned to one of five experimental conditions in each country, amounting to a 2 × 2 design with a pure control group (see Supplemental Appendix D for balance checks). In each group, participants were asked to view realistic and professionally produced news coverage that simulated breaking news reports on television channels in three countries – NBC News in the United States, Sky News in the United Kingdom, and Channel Two in Israel. The news reports were prepared by industry professionals and used authentic footage and were 1:34 minutes to 1:36 minutes long. The video clips begin with introductory news music identical to NBC News in the United States, Sky News in the United Kingdom, and Channel Two in Israel. In the lethal-outcome conditions, a news reporter on the scene is providing voice-over media coverage of footage depicting ambulances near a derailed train and simultaneously running ribbons at the bottom of the screen, stating that a cyber/conventional terror attack by an unidentified perpetrator has resulted in a train derailment. The reporter continues to report that seven people have died due to the derailment, while 10 people have been severely injured and are being taken to a nearby hospital for medical treatment. The footage then cuts to a segment insert that shows a conference room holding a discussion among military personnel. All the lethal manipulations were adapted to local context so that the US manipulation depicted a US derailed train, the UK manipulation depicted a British derailment, and so forth.

In the financial outcome experimental conditions, the footage depicts a hooded perpetrator and the reporter’s voice-over reporting that millions of dollars were stolen from the accounts of tens of thousands of passengers’ credit cards. The footage is followed by the footage insert of the military personnel in the conference room, identical to the lethal-outcome manipulations. In terms of the identity of the perpetrators, we deliberately opted to leave the perpetrators anonymous in all the manipulations to reflect the attribution problem in cybersecurity (Finlay and Payne, 2019). Once a cyberattack is launched, attackers use a plethora of techniques to mask their identity and location, often routing an attack through several dispatching networks around the globe. Thus, the retrospective identification of a forensic link between a cyberattack and a possible perpetrator becomes cumbersome and lengthy for governments and security agencies. States are very careful in not attributing blame and pegging responsibility to perpetrators for fear of misattribution that could lead to escalation of an underlying conflict. The clips and news stories were kept identical in each country, subtly altered only to refer to local cities and railway organisations, and with the correct logo of each broadcaster (see Figure 1). Everything else remained constant – including the news presenter who reported in English in the US and UK news reports and Hebrew in the Israeli report.

Figure 1.

Screenshots of the cyber-terror attack manipulation in the United States, the United Kingdom, and Israel.

Our manipulations resulted in the following four treatment groups: (1) conventional terror resulting in lethal outcome, (2) conventional terror resulting in financial outcome, (3) cyber-terror resulting in lethal outcome, and (4) cyber-terror resulting in financial outcome. A fifth group, the pure control group, was not assigned any manipulation but answered the survey questions. We opted to leave the control group as a pure group after careful deliberation about the nature of the control group. There are multiple ways to construct a control group, each with its advantages and disadvantages. The advantage of a pure control group, which we have employed, is that respondents are not subjected to any experimental stimuli that could affect their emotions. The disadvantage is that the control group is not identical to the treatment groups in all ways since treatment group members viewed experimental manipulation videos. Another possibility to construct a control group – one that we contemplated – was to provide respondents in the control group with a neutral video about trains. However, as emotions lie at the heart of our theory, we opted to leave the control group pure since we did not want to arouse any emotions (positive or negative) that could bias our results. Therefore, the assigned participants in the control group answered the questionnaire fully but did not view any videos.

In all cases, we adhered to the local language (e.g. subway in the United States, underground in the United Kingdom). Videos were originally produced and mimicked the style regarding logos and opening news segment music. The scripts were verified for consistency and language discrepancy in a blind back-translation process (see Supplemental Appendix C for video manipulation scripts and screenshots from the lethal and financial conditions).

Variables

After viewing the video treatment, participants completed a detailed questionnaire to gauge their emotional state and political attitudes and to obtain demographic information. To measure the dependent variable, public trust in government, we used the trust measure employed by Berry et al. (2008). A principal component analysis (PCA) revealed that all three variables were loaded onto one factor (see scree plot in Supplemental Appendix H). We constructed the dependent variable based on the mean score of the three items in the questionnaire. Participants were asked to report,

How confident are you that the government and law enforcement agencies can prevent a terror attack from taking place over the next six months? /How confident are you that the government and law enforcement agencies can prevent a terror attack from taking place over the next year? /How confident are you that the government and law enforcement agencies can prevent a terror attack from taking place over the next five years?

Cronbach’s α = .921 resulted in an excellent measure of reliability.

Anger was measured using the four-item State-Trait Anger Expression Inventory (STAXI): ‘Are you mad?/Do you feel irritated?/Do you feel angry?/Are you furious?’ (Spielberger et al., 1983; Cronbach’s α = .962). Anxiety was measured using the six-item short form Spielberger state-anxiety inventory (STAI): ‘Do you feel tense?/Do you feel calm?/Do you feel relaxed?/Do you feel upset?/Do you feel content?/Do you feel worried?’ ¹ (Spielberger, 1972; Cronbach’s α = .905). All questionnaire items were scored on a six-point Likert-type scale (1 = Not at all to 6 = Absolutely). In addition to these measures, we collected extensive socio-demographic information, including political orientation, age, gender, frequency of use of public transportation, and previous exposure to terror and cyberattacks. For the Israeli questionnaire, all survey items were professionally translated and independently back translated from English to Hebrew, and questions were adapted, where needed, to adhere to the local terms used in each country (e.g. subway in the United States vs underground in the United Kingdom).

Analytical approach

Our proposed theoretical model predicts that exposure to various forms of cyberattacks would influence public trust in government through an indirect pathway encompassing the emotions of anger and anxiety. We therefore explore the possibility of a direct effect between cyberattacks and trust evaluations, as well as an indirect effect through the emotions of anger and anxiety. Following Memon et al. (2018) and Zhao et al. (2010), we regard direct and indirect effects as being independent irrespective of null effects. In keeping with Memon et al. (2018) and Zhao et al. (2010) even in the absence of a direct effect, ‘researchers should test [the possibility of mediating effects] regardless of the significance of the relationship between X and Y’ (Memon et al., 2018: v). The literature points to two negative emotions – anger and anxiety – each bearing discreet political outcomes. While anger results in people seeking retaliatory action to regain a sense of equilibrium, anxiety results in aversive, information-seeking, threat-reducing behaviour (Huddy et al., 2021). Considering that our theoretical foundation a priori dictated that these two emotions resulted in distinct political outcomes, we introduced them separately into the model to avoid opposing complementary and competitive mediation, which could have resulted in a null effect.

Because we expected participants to experience a range of emotions simultaneously in response to the experimental stimuli (Garcia and Rimé, 2019; Larsen and McGraw, 2011), we opted to use structural equation modelling (SEM) for the analysis of the results. Our choice of employing SEM in our analytical approach stems from our complex model, which entails multiple different mediating variables (see Figure 2). We found the unique attributes of SEM to be superior at integrating multi-variable models into an easily understandable output.

Figure 2.

SEM.

Results

Correlations and comparisons

Before conducting the SEM test, we analysed the correlations between the variables of interest. In the United States, we found that public trust in government is significantly and positively correlated with anger, previous exposure to physical terror, and level of education. In Israel, public trust in government significantly and negatively correlated with previous exposure to cyberattacks and positively with age. We found no significant correlations between public trust in government and variables in the United Kingdom. Next, to examine whether there was a bivariate relationship, we conducted a series of independent samples t-tests for the independent variable (exposure to experimental stimuli) and the dependent variable (public trust in government). The results in all three countries revealed no direct relationship between trust in the government and the experimental treatments. The absence of a direct effect, however, does not rule out the possibility of mediation, especially considering that the public reacts to political violence through emotional channels (Garcia and Rimé, 2019; Getmansky and Zeitzoff, 2014; Hirsch-Hoefler et al., 2016; Hobfoll et al., 2006; Shandler et al., 2023a; see Supplemental Appendix E for the complete set of comparisons and correlations).

Structural equation model

Structural equation modelling (SEM) is beneficial for simultaneously estimating multiple and mutual dependencies and for understanding the size and direction of direct and indirect effects. It is instrumental in experimental studies that require causal relationships (Lowry and Gaskin, 2014). SEM combines factor analysis and multiple regression analysis and is helpful in analysing the structural relationship between measured variables and latent constructs (Kline, 2015). A proposed model is acceptable in SEM according to a set of accepted fit indices. We embark on two distinct but related stages to establish whether specific paths are significant if the model is acceptable: first, the validation and estimation of suitability using a set of fit indicators. These indicators include the Incremental Fit Index (IFI), Comparative Fit Index (CFI), and Normed Fit Index (NFI). A model is acceptable if IFI, NFI, and CFI ⩾ .90 (Byrne, 1994). The Root Mean Square Error of Approximation (RMSEA) is a ‘badness-of-fit measure’, yielding lower values for a better fit. An RMSEA ⩽ .06 could be considered acceptable (Hu and Bentler, 1999). In addition to the fit indices, the chi-square test is unique among possible measures of fit in SEM because it is a test of statistical significance. The chi-square value tests the null hypothesis that the predicted model and observed data are equal. In other words, it measures whether the predictions match the actual data. Therefore, a null hypothesis indicates a good model fit for the chi-square test. As a measure of robustness, we opted to also run the data by employing a regression model (see Supplemental Appendix F for an OLS hierarchical regression table). We find that the main effects remain the same as the results in the structural equation model. This outcome gives confidence that our results are robust to the choice of analytical technique.

Direct effects

An initial validation test reveals that our proposed models achieved high goodness of fit (see Supplemental Appendix G for SEM goodness-of-fit indices). Having surpassed this preliminary threshold, we examined the direct effects. As illustrated in Figure 2, lethal and financial cyberattacks and lethal and financial terror attacks failed to directly predict public trust in government in any of our three country samples. Following the extensive support for the argument that mediating effects may exist despite no direct relationship (Memon et al., 2018; Zhao et al., 2010) we examined the mediating mechanism, which posits a role for anger and anxiety in driving attitudinal changes following exposure to cyberattacks.

In the a-path of the SEM, we found that all forms of cyberattacks amplified anger and anxiety and that the effects were weaker for financial cyberattacks than for lethal ones. The b-path of this indirect model revealed that the relationship between negative emotions and trust in government was significant for anger in the United States but not in the United Kingdom or Israel. Anxiety did not predict any change in public trust evaluations of government in any of the countries we sampled.

Indirect effects

The absence of direct effects between the independent variables and the dependent variable, the significant relationships between the independent variables and the mediators, and between the mediators and the dependent variables pave the way for an examination of indirect mediation effects, as hypothesised in hypotheses 2(a) and 2(b) (Memon et al., 2018; Zhao et al., 2010).

Figures 3 and 4 show the results of the indirect analyses using anger and anxiety pathways, respectively. The indirect anger mechanism reveals that in the United States, anger fully and positively mediated the relationship between exposure to cyberattacks and public trust in government. The lethal scenarios elicited a far more potent effect than the non-lethal attacks. Consistent with the political psychology literature and the rally theory, exposure to violence indirectly raised trust evaluations, refuting the notion that trust in government suffers following cyberattacks. There was no significant indirect effect in the United Kingdom and Israel, and the heightened anger resulting from the experimental treatments did not affect public trust in the government. This result supports hypothesis 2(a) in the United States but not in the United Kingdom or Israel.

Figure 3.

Mediation effects of anger underpinning the independent variables and trust.

Figure 4.

Mediation effects of anxiety underpinning the independent variables and trust.

As depicted in Figure 4, our results reveal that anxiety did not significantly mediate the relationship between experimental treatments and trust in government. This finding refutes hypothesis 2(b) in all three countries.

Discussion

The primary focus of this research is to elucidate if and how the disruptive forces of technology can perhaps reshape the fragile balance between governance and citizen trust in the cyber era. Throughout history, the interaction between citizens and their governing bodies has undergone a dynamic balance between two fundamental elements: trust and scepticism in the government’s ability to protect its citizens. Trust in government has been the cornerstone of social cohesion and democratic stability, while scepticism has served as a healthy check on government performance and concentration of power. By examining the relationship between cyberattacks and public trust in government, we report that the emergence of novel security threats – such as cyberattacks on critical infrastructures – can offer indispensable new insights into the malleable nature of public opinion in the cyber era. Stemming from this view, this delicate interplay has given rise to various theories that seek to uncover the origins and nature of trust in government and its evolution over time. Pundits and cyber scholars have suggested that cyberattacks create a crisis of trust and undermine the public’s trust in democratic institutions (Bumiller and Shanker, 2012; Maschmeyer, 2023; Schneider, 2022). Nevertheless, the logic behind this theory remains untested, and the psychological mechanism at its heart is unexplored. To offer an empirical substantiation or repudiation of this claim, this article reported a tripartite survey experiment exposing 1828 participants in the United States, the United Kingdom, and Israel to simulated cyberattacks to identify the ensuing psychological distress and trust outcome.

We examine our research question through the prism of Mueller’s (1970) rally theory and formulate our hypotheses on the vast literature revolving around the rally effect. Through a rigorous examination of the effect of cyberattacks on critical infrastructure, our results suggest that cyberattacks do not directly erode or amplify public trust in the government’s ability to mitigate future cyberattacks on critical infrastructure. This null finding recurred in all three countries we sampled. Rather, to the extent that a cyber-political link occurred, the trust effects of cyberattacks manifested through an indirect psychological mechanism. We confirmed that cyberattacks on critical infrastructure uniformly evoked anger. While our manipulations were not focused on the theoretical aspects of a rally effect per se, we can assume that in the absence of a presidential statement about the event at hand, the public – in the United States at least, acted upon an emotional reflex that resulted in the formation of a political outcome. Our results reveal that this emotional reflex, in turn, heightened participants’ trust in the government in the United States.

In this way, our findings align with Mueller’s rally theory and resemble the many political psychology studies that explored the effects of exposure to terrorism and political violence (Huddy et al., 2007, 2009; Huddy and Feldman, 2011). This finding suggests that digital-era violence can be subsumed into earlier theoretical paradigms and that no new political theories are required to explain human behaviour or political tendencies in the face of novel digital threats. The emotional response generated by violent incidents depends on a range of internal factors, such as people’s long-term emotional sentiment about adversaries, values concerning conflict, and habitual emotional tendencies (Holland, 2021; Holland and Jarvis, 2014) and external factors, namely, news framing and subsequent government interventions (Halperin, 2014; Huddy et al., 2021).

By deliberately opting to leave the perpetrators anonymous in all the manipulations, we were able to reflect the attribution problem in cybersecurity (Finlay and Payne, 2019). Factors such as the Internet’s borderless nature and state-sponsored actors’ involvement further complicate attribution. Attackers can launch operations from different locations, exploiting legal and jurisdictional ambiguities. State-backed attacks introduce political considerations, making distinguishing between criminal hackers and government entities harder. Moreover, cyberattacks on critical infrastructure take place in an environment of technical complexity, resulting in a cumbersome task for governments to identify the perpetrators. This poses a difficult conundrum for states as they are conscientious not to misattribute perpetrators. At the same time, authorities try to maintain public trust in the government’s ability to mitigate such attacks. Furthermore, the misattribution of cyberattacks could lead to an escalation of conflict. For cyberattacks specifically, the absence of an easily identifiable perpetrator as a target for the public’s sentiment of anger does not seem to affect trust in the government. These findings echo other work that examined the desire for retaliation against possibly related targets when the identity of an attacker is unknown (Shandler et al., 2022).

We designed our comparative experimental framework to optimise external and internal validity, but the observed effects were inconsistent in the three countries we sampled. Although the present empirical setup does not provide a conclusive explanation for this inconsistency, several possibilities exist. First, a recent meta-analysis showed that rally effects were evident mainly in the United States (Godefroidt, 2023). Analysing several decades worth of rally experiments, the study concluded that they rarely manifested outside the United States and that Americans were more prone to rallying around their leader as an extension of the American flag in the aftermath of a conflict. This pattern recurred in our data as well.

An alternative explanation to our null finding suggests that we may be witnessing a habituation effect. On one hand, sudden and visceral acts of violence result in politically charged emotions. On the other hand, civilians living in ongoing conflict tend to become emotionally inured and habituated to a conflict situation as it evolves into a threshold of normalcy (Bitton and Laufer, 2018; Muldoon, 2003). Habituation literature reveals that civilians tend to adapt to conflict situations and become emotionally inured (Gelkopf et al., 2013; Hasler et al., 2023; Hobfoll et al., 2006; Itzhaky et al., 2017; Muldoon, 2003; Shechory Bitton and Silawi, 2019). This could explain why, in our findings, the emotional effects aroused from cyberattacks and the subsequent reduction or increase of public trust were milder in Israel and the United Kingdom. The two former nations have experienced prolonged conflict, while the latter has experienced sudden terror attacks. It is plausible that habituation effects caused by exposure to conventional terrorism and political violence can transfer to the cyber domain and cushion emotionally driven political effects caused by cyberattacks.

Our findings also have implications for the construct of public policy. First, cybersecurity seems to be a persistent ‘cat-and-mouse’ race as cyber threats to critical infrastructure vulnerabilities evolve and become more sophisticated. As perpetrators’ technological sophistication advances, the government’s role in cybersecurity will only become more complex. Governments must adapt to novel security threats, collaborate globally, and work closely with private sector partners to ensure the security and stability of the cyber sphere. Moreover, politicians and policymakers seeking to advance proactive measures to mitigate future cyberattacks (e.g. a rollout of robust digital surveillance policies in the form of regulation) should account for the normative, social and conflict contexts in which they deploy their policies (Guillon and Kergall, 2020; Zhang et al., 2020).

Second, trust in government ebbs and flows differently in response to sudden exogenous shocks (Hetherington, 1998; Levi and Stoker, 2000) than in long-term events. Spikes in rally-around-the-flag effects have been observed following crises such as the Reagan assassination attempt (Ostrom Jr and Simon, 1989) and the 9/11 attacks (Huddy et al., 2002). The rally around the flag effect is short-term and tends to dissipate quickly (Baum, 2002). Although public trust in government and political leaders rises dramatically following national crises, this heightened state of public trust tends to return to baseline levels before the occurrence of the security threat (Kernell, 1978). This implies that a rally effect may not have a lasting impact on public opinion or political dynamics. Because government performance is hard to estimate in short-term events such as sudden cyberattacks, government performance becomes particularly salient and positively associated with political trust in situations where the public is exposed to long-term events such as prolonged conflicts (Van der Meer, 2017). It is possible that the uptick we found in trust in the government in the United States (mediated by anger) was a result of the suddenness of the cyberattack on critical infrastructure that participants witnessed. We anticipate that prologued exposure to cyberattacks, such as the Russian cyber-meddling in the 2016 US election or alleged meddling in Brexit, would result in a steady corrosion of public trust in government institutions if these are publicly perceived as unable to mitigate such attacks against core pillars of democracy.

Third, the emotions that cyberattacks evoke on critical infrastructure and their political outcomes imply that the cyber sphere is comparable to the physical domain. Scholars have theorised that cyberspace is an essential new arena in world politics because of its low cost, anonymity, and asymmetries in vulnerability (Nye, 2010). However, our results suggest that concerning emotionally charged political outcomes, lethal cyberattacks and conventional terror attacks are comparable in emotionally politically driven civilian responses.

Conclusion

Classical and prominent theories elucidating trust in government considering shocking and sudden security threats have evolved, shedding light on this intricate dynamic (Mueller, 1970). As cyberattacks continue to present challenges to critical infrastructure vis-à-vis an acceleration of the digitisations of states around the world, pundits and cyber scholars have voiced growing concern about the integrity of public trust in government and, consequently, the stability of democratic institutions in the event of national and catastrophic cyberattacks. Although these concerns grow daily, empirical investigation into the ebbs and flows of public trust in government following exposure to cyberattacks remains scarce, with existing research providing conflicting evidence. On one hand, cyber scholars sound foreboding warnings about the impending erosion of core democratic pillars, such as trust in government and security institutions following exposure to cyberattacks (Schneider, 2022; Shandler and Gomez, 2023). On the other hand, established classical theory holds that sudden attacks result in heightened trust in government (Mueller, 1970). While a substantial number of empirical studies support Mueller’s classical theory following conventional terror attacks, cybersecurity scholarship still lacks substantial empirical evidence for a cyber-political outcome link essential for theory building. As a consequence, we know relatively little about the impact of exposure to sudden cyberattacks on critical infrastructure and the role of emotion in this context in the formation of public trust in government.

This article was intended to fill this gap by building upon a comparative survey-experiment framework designed to optimise external and internal validity. To this end, we performed survey experiments in three democracies: the United States, the United Kingdom, and Israel. We chose these case studies due to common attributes in cyberspace and comparable levels of trust in government. In contrast to recent cyber assessments, but in line with Mueller’s (1970) classical rally theory, we find that cyberattacks on critical infrastructure do not erode trust in government. Furthermore, we find that emotions – primarily anger – play a pivotal role in heightened trust in the government in the United States (but not in the United Kingdom or Israel). While many possible theoretical explanations explain this phenomenon, we theorise that variance in the types of cyberattacks (e.g. sudden vs ongoing cyberattacks; see Leal and Musgrave, 2023a) and context of conflict (nations embroiled in short-term political violence vs ongoing conflict) in the three countries we sampled perhaps play a role in terms of the emotions of anger and anxiety and that these, in turn, then become politically charged as a result.

While our rigorous experimental design has paved the way for cybersecurity scholars to embrace classical theories, we have temporarily dampened the voices that claim that cyberattacks will uniformly precipitate an erosion of public trust in government, at least in terms of the impact of sudden cyberattacks on critical infrastructure. We believe that further avenues of exploration into the relationship between cyberattacks and public trust deserve scholarly examination. First, our time of sampling is somewhat of a ‘betwixt-and-between’. While cyberattacks are no longer a novelty, they have still not become commonplace on critical infrastructure to a level of disruption to daily life. It is very plausible that as perpetrators become more technologically sophisticated in exposing and exploiting systematic vulnerabilities in trusted critical infrastructure used by the public daily, various types of cyberattacks would result in different outcomes in terms of public opinion in general and public trust in particular. Furthermore, prolonged exposure to ongoing cyberattacks (vs sudden and isolated incidents) would publicly implicate the government’s inability to mitigate cyberattacks. Therefore, we believe that cyber scholars should make the distinction between sudden and isolated cyberattacks versus frequent or ongoing attacks that could result in the erosion of public trust in government and security institutions over time. Second, another avenue of research should examine the role of identified perpetrators. The attribution problem remains a complex and ongoing challenge in cybersecurity (Finlay and Payne, 2019). While pegging responsibility for a cyberattack is a lengthy and cumbersome task, scholars should examine how the identification of perpetrators affects public trust in government – for instance, an examination of Bandura’s (2011) moral disengagement theory in relation to ingroup versus outgroup cyber perpetrators in ongoing conflict settings (Li et al., 2016) versus sudden cyberattacks. Third, we believe variance in cyberattack types could affect public trust differently. Logic dictates that cyberattacks against critical infrastructure that uphold core democratic processes, such as voting machines, would yield an immediate and acute anxiety response. Over time, as these types of cyberattacks proliferate, vis-à-vis the digitisation of critical systems, it is inevitable that public attention will be turned to the government to mitigate such attacks. Fourth, our trilateral survey experiment examined the roles of anger and anxiety as mediators. We urge political psychology scholars to introduce other emotions into their models. Some empirical work has examined the role of dread in the relationship between exposure to cyberattacks and political outcomes (Gomez and Villar, 2018; Shandler and Gomez, 2023). Other emotions, such as hatred towards identified perpetrators, seeking revenge, and superstition towards government surveillance aimed at mitigating the recurrence of cyberattacks on critical infrastructure, could also bring with them lasting political outcomes.

Finally, we believe a deeper theoretical and empirical exploration into the nature of rally effects in general, and public trust in government in particular, is called for. As cyberattacks proliferate and states become digitised entities, the nature and origins of trust in government fit for a cyber era is a pressing issue. It is of utmost importance to examine whether a public facing national and threatening cyberattacks formulate their political opinion as a result of a deliberative weighing of administration’s policies based on preexisting dispositions and media portrayals of the leadership (Baker and Oneal, 2001; Brody and Shapiro, 1991; Zaller, 1992) or whether the public formulate their political opinion as a mere emotionally charged political reflex (Hetherington and Nelson, 2003; Mueller, 1970).

Supplemental Material

sj-docx-1-bpi-10.1177_13691481231210383 – Supplemental material for The limits of cyberattacks in eroding political trust: A tripartite survey experiment

Supplemental material, sj-docx-1-bpi-10.1177_13691481231210383 for The limits of cyberattacks in eroding political trust: A tripartite survey experiment by Sharon Matzkin, Ryan Shandler and Daphna Canetti in The British Journal of Politics and International Relations