![Page 1: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/1.jpg)
Experimental Measurement of Attitudes Regarding Cybercrime
James Graves,† Alessandro Acquisti,† and Ross Anderson‡ !
†Carnegie Mellon University ‡University of Cambridge
1
![Page 2: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/2.jpg)
Online vs. Offline Crime
Maximum Sentence: 25 years
2
![Page 3: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/3.jpg)
Online vs. Offline Crime
25 years 3 years3
![Page 4: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/4.jpg)
Online vs. Offline Crime• December, 2008: Natalie Persue, a student at
Greenwich University, allowed her bank account to be used in theft of £18,000 from Sir Peter Hirsch.
• Transaction was online.
• Given 120 hours community service and £100 court costs.
• Sentencing guidelines for face-to-face fraud set the minimum sentence at 3 years.
4
![Page 5: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/5.jpg)
Experimental Philosophy
• “Trolley Problem”
5
![Page 6: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/6.jpg)
Research Question
• How do different aspects of cybercrime affect the perceptions of that crime?
6
![Page 7: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/7.jpg)
Methodology• Amazon Mechanical Turk
• October to December 2013
• N = 2440 across six experiments
• Task: Read a short vignette about a cybercrime and answer questions about it.
• We manipulated the vignettes
7
![Page 8: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/8.jpg)
On June 3, 2013, while browsing the Internet, Tom Smith discovered a security flaw in the Acme Insurance Company’s website. He used that flaw to gain access to Acme’s internal network and download 100,000 records from Acme’s customer database. Each record consisted of a customer’s full name, phone number, and address. Tom did not use or release the information. Acme’s customers suffered no harm.
8
![Page 9: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/9.jpg)
On June 3, 2013, while browsing the Internet, Tom Smith discovered a security flaw in the Acme Insurance Company’s website. He used that flaw to gain access to Acme’s internal network and download 100,000 records from Acme’s customer database. Each record consisted of a customer’s full name, phone number, and address. Tom did not use or release the information. Acme’s customers suffered no harm.
9
![Page 10: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/10.jpg)
On June 3, 2013, while browsing the Internet, Tom Smith discovered a security flaw in the Acme Insurance Company’s website. He used that flaw to gain access to Acme’s internal network and download 100,000 records from Acme’s customer database. Each record consisted of a customer’s full name, health history, medical diagnoses, and prescription records. Tom did not use or release the information. Acme’s customers suffered no harm.
10
![Page 11: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/11.jpg)
On June 3, 2013, while browsing the Internet, Tom Smith discovered a security flaw in the Acme Insurance Company’s website. He used that flaw to gain access to Acme’s internal network and download 100,000 records from Acme’s customer database. Each record consisted of a customer’s full name, phone number, and address. Tom did not use or release the information. Acme’s customers suffered no harm. Acme had patched its server operating systems with the latest security updates.
11
![Page 12: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/12.jpg)
On June 3, 2013, while browsing the Internet, Tom Smith discovered a security flaw in the Acme Insurance Company’s website. He used that flaw to gain access to Acme’s internal network and download 100,000 records from Acme’s customer database. Each record consisted of a customer’s full name, phone number, and address. Tom did not use or release the information. Acme’s customers suffered no harm. Acme had not patched its server operating systems with the latest security updates.
12
![Page 13: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/13.jpg)
Experiments1. Type of Data: Directory vs. medical information. N = 239 of 250.
2. Scope: 10, 100, 1,000, 10,000, or 1,000,000 records. N = 583 of 625.
3. Motivation: Student, activist, or profiteer. N = 361 of 395.
4. Consequences: Low, Acme $5M, or consumers $5M. N = 479 of 511.
5. Co-Responsibility: Servers patched vs. not. N = 276 of 302.
6. Context: Bank, government agency, non-profit. N = 502 of 552.
13
![Page 14: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/14.jpg)
Variables of Interest• Answers to the following questions, each on 1-7 Likert scale:
• “How wrongful were Tom Smith’s actions?”
• “How harmful were Tom Smith’s actions?”
• “How serious was the crime Tom Smith committed?”
• “How harshly should Tom Smith be punished?”
• “How responsible was the Acme Insurance Company for the crime?”
• “How clever was Mr. Tom Smith?”
• “How sensitive was the data that Tom Smith downloaded?”
• “How harmful might the potential consequences of Tom Smith’s actions have been?”
14
![Page 15: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/15.jpg)
Example: Motivation
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
ProfiteerActivist
StudentProfiteer
ActivistStudent
ProfiteerActivist
StudentProfiteer
ActivistStudent
ProfiteerActivist
StudentProfiteer
ActivistStudent
ProfiteerActivist
StudentProfiteer
ActivistStudent
1 Not at all 2 3 4 5 6 7 Extremely
15
![Page 16: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/16.jpg)
Analysis• Ordered probit
• Control variables:
• Demographics: Gender, age, country of birth, education, occupation, work situation,
• Privacy attitudes: CFIP score, personal experience with cybercrime or privacy invasions, awareness of media coverage of privacy issues
• Accuracy of responses to attention-check questions
16
![Page 17: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/17.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
17
![Page 18: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/18.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
18
![Page 19: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/19.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
19
![Page 20: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/20.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
20
![Page 21: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/21.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
21
![Page 22: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/22.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
22
![Page 23: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/23.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
23
![Page 24: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/24.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
24
![Page 25: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/25.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
25
![Page 26: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/26.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
26
![Page 27: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/27.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
27
![Page 28: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/28.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
28
![Page 29: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/29.jpg)
Summary of Results
0 20 40 60 80 100Percent
how_pot_harmful
how_sensitive
how_clever
how_responsible
how_harshly
how_serious
how_harmful
how_wrongful
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
Non-ProfitGovt.Bank
1 Not at all 2 3 4 5 6 7 Extremely
Figure 6: Responses to main Likert questions in the Motivation experiment by condition
result and the results of the experiment on co-responsibility suggest that the factors a↵ecting per-ceptions of organizational responsibility to protect from breach are worthy of further consideration.
5 Discussion
Table 1 summarizes the statistically significant results of the regressions in all experiments.
Table 1: Summary of statistically significant regression results
Experiment & Conditions / How: Wrongful Harmful Serious Harshly Pot. Harm. Sensitive Respons. Clever
Type of Data: High v. Low — 0.971⇤⇤⇤
Scope: log(Records) 0.069⇤⇤ 0.078⇤⇤ 0.159⇤⇤⇤ 0.106⇤⇤⇤ — 0.135⇤⇤⇤ 0.064⇤ 0.058⇤
Motiv.: Profiteer v. Student 0.877⇤⇤⇤ 0.323⇤ 0.593⇤⇤⇤ 0.791⇤⇤⇤
Motiv.: Profiteer v. Activist 0.793⇤⇤⇤ 0.515⇤⇤⇤ 0.485⇤⇤
Motiv.: Student v. Activist �0.306⇤
Conseq.: Acme v. Low 0.408⇤⇤⇤ 0.341⇤⇤
Conseq.: Customers v. Low 0.377⇤⇤ 0.246⇤
Conseq.: Customers v. Acme 0.252⇤
Co-Resp.: Patched v. Not 0.364⇤ �0.420⇤⇤
Context: Gov’t v. Bank
Context: Bank v. Non-Profit: 0.359⇤⇤
Context: Gov’t v. Non-Profit: 0.513⇤⇤⇤
⇤ p < 0.05, ⇤⇤ p < 0.01, ⇤⇤⇤ p < 0.001
Notes: The table lists statistically significant results from ordered probit regressions in all experiments. “Pot. Harm” ismarked o↵ for the Type of Data and Scope experiments because that question was not asked in those experiments.
In various cases, the manipulations produced the expected e↵ects. Changing the data fromdirectory information to health information increased perceived data sensitivity. Increasing thenumber of records generally increased how wrongful, harmful, and serious the crime was perceived
14
29
![Page 30: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/30.jpg)
Conclusions• Participants recommend harsher sentences when cybercrimes:
• Involve more data or more sensitive data
• Have costlier consequences
• Are motivated by profit
• Attacker motivation and organization type do not seem to significantly affect recommended sentences.
• This may not be in harmony with current prosecutorial practices.
30
![Page 31: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/31.jpg)
Next Steps
• Factorial vignette surveys
• Online vs. offline crime punishment
31
![Page 32: Experimental Measurement of Attitudes Regarding Cybercrime](https://reader035.vdocuments.site/reader035/viewer/2022062306/62a6b67b89934323b7716613/html5/thumbnails/32.jpg)
Questions?
32