Academic journal article International Journal of Cyber Criminology

Criminals and Cyber Attacks: The Missing Link between Attribution and Deterrence

Academic journal article International Journal of Cyber Criminology

Criminals and Cyber Attacks: The Missing Link between Attribution and Deterrence

Article excerpt

Introduction

Many authors have written about the assumption that in the criminal context (as opposed to the strategic context with states as actors) the attribution problem hinders the application of deterrence. Boebert, an information security expert, imagines a situation in which perfect technical attribution is possible. He considers that attribution will deter criminals and non-state actors as 'punishment will be severe' (Boebert, 2010, p. 51). He writes 'perfect technical attribution and the associated fear of likely and unacceptable retribution will act as a deterrent'. Boebert does not base his claim on any evidence that an increase attribution would lead to deterrence. Other cyber security researchers write similarly about deterrence that 'the expectation of detection and redress inhibits data misuse and complements real-time access controls'(Pato, Paradesi, Jacobi, Shih, & Wang, 2011, p. 1072). The cyber security expert Richard Clayton (2005, p. 36) similarly writes in his PhD thesis that 'since defensive measures are unlikely to be effective, it is crucial to have deterrence through tracking and tracing'. The US 2011 strategy for cyberspace also includes deterrence via attribution mechanisms. The strategy reads: 'In the case of criminals and other non-state actors who would threaten our national and economic security, domestic deterrence requires all states have processes that permit them to investigate, apprehend, and prosecute those who intrude or disrupt networks at home or abroad' (The White House, 2011, p. 13). Investigation and prosecution of crimes are part of the attribution process. Robert Knake, the director for cyber security at the White House since 2011, influenced this statement in the strategy. He declared during a hearing in front of the US House of Representatives a year earlier that: 'For deterrence to work, it is critically important that we know who has carried out the attack and thus attribution is a central component of deterrence strategy' (Knake, 2010, p. 2). However, he also acknowledged that deterrence might not be the right way to think for low-level threats (in comparison with nuclear threats), which include criminal attacks. Instead, Knake (2010, p. 2) suggested 'to reduce the scale of the problem by stopping threats as they unfold and by reducing the vulnerabilities that the threat actors make use of in their attacks'.

Yet, none of the authors cited above ground their work in theories of criminal justice and show empirical evidence for their assumptions. Is there any evidence that increasing attribution online will deter criminal behaviors? What theoretical and empirical evidence outside the Internet supports the belief that attribution can lead to deterrence? What evidence on the Internet supports it as well? If there is a lack of evidence that attribution can have a role in deterrence, what role can it play for cyber criminality?

Within the field of cyber criminality, I focus in this paper on cyber attacks. Two quantitative analyses collected evidence to study the missing link between attribution and deterrence. One looked at evidence from data at the unit of the state, while the other looked at data from individual cases. The analyses showed that attribution functions as a deterrent only for a specific population of cyber criminals. Attribution can deter Internet users who have knowledge about attribution mechanisms (legal or technical), and whose perception of the certainty of the police catching them affects their rational decision to commit a crime. Enhancing attribution mechanisms simply for deterrent purposes is likely to fail for other types of criminals. States need therefore to apply different policy to curb cyber crimes than solely based on deterrence.

This paper is divided into four sections. I will first review the different theories of criminal justice that can help explain why and how attribution can be a deterrent. Second, I will explain the methodology of the two experiments. …

Search by... Author
Show... All Results Primary Sources Peer-reviewed

Oops!

An unknown error has occurred. Please click the button below to reload the page. If the problem persists, please try again in a little while.