How to Get Away with Cyberattacks: An Argumentative Approach to Cyberattacks’ Legitimization by Common Users

Title of the Paper

How to Legitimize Cyber Attacks—An Argumentation-Based Approach from the Perspective of Ordinary Users

Bibliographic Information

• Subject Area: Human behavioral factors in cyber attacks and cybersecurity
• Keywords: Cyber attacks, argumentation, cybersecurity, human factors, persuasion

Research Background and Problem

• Problem or Challenge: Ordinary users can be successfully recruited to participate in cyber attacks, posing a significant security threat. This indicates that ordinary citizens may legitimize cyber attacks instead of condemning them. The mechanisms behind this behavior, the logic of legitimization, and strategies to reduce the likelihood of legitimization warrant further exploration.
• Significance: The involvement of ordinary users in cyber attacks amplifies the scale and complexity of attacks and may increase the risk of spreading cyber threats. Understanding how ordinary users perceive and "legitimize" cyber attacks will aid in improving defense strategies.
• Research Motivation and Related Work:
  • Previous studies have primarily focused on the psychological traits of cyber attackers (e.g., antisocial tendencies, psychological biases) or technical dimensions, with limited attention to how ordinary users rationalize their participation.
  • This study seeks to uncover the logical premises used by ordinary users to legitimize cyber attacks through an argumentation-based approach.

Solution

• Main Method: Proposes an argumentation-based analytical method to identify the premises that lead ordinary users to support cyber attacks. The study revolves around narratives of four different types of cyber attacks.
• Innovations:
  • Utilizes argumentation space theory to analyze the dynamic process of stance formation rather than merely summarizing static attitudes.
  • Provides a methodological framework to reveal how ordinary users employ cultural and social cognition to legitimize cyber attacks.
• Implementation Steps and Key Techniques:
  • Participants read four narratives of cyber attacks based on real incidents but stripped of specific names and contextual details (including profit-driven, recreational, revenge-driven, and ideologically motivated attacks).
  • Semi-structured interview questions were designed to collect users' stances and reasoning for each attack scenario.
  • Reflexive thematic analysis was applied to manually code interview transcripts, extracting premises supporting or opposing cyber attacks.

Research Results

• Key Findings:
  • The study identified 15 argumentation premises, with their distribution varying across different attack types.
  • For instance, whether the attack caused severe harm, whether it was ideologically motivated, and whether the target was an innocent individual were critical arguments for users to legitimize or condemn such actions.
  • Some universal premises, such as ideology, target necessity, and legal authority, were supported across cases.
• Comparison with Existing Research:
  • Unlike previous studies focusing on "technical rationalization" in cyber offense and defense, this research emphasizes how cultural and psychological backgrounds of ordinary users influence their stances.
  • Enriches the social learning theory framework by treating legitimization behavior as a specific instance of cultural debate.
• Experimental or Evaluation Results:
  • The frequency of different premises varied across the four cases (e.g., "innocence" was primarily implied in Cases 1 and 4, while "entertainment purposes" predominantly supported Case 2).
  • The cultural context in which these premises emerged demonstrated the dynamic and diverse nature of user stances.
• Limitations and Future Directions:
  • Small sample size (16 participants) and geographic concentration in Italy necessitate validation of the results’ universality across different countries and cultures.
  • As cyber attack technologies evolve, new types of attacks may introduce novel legitimization premises.
  • Future research should integrate psychological modeling to explore legitimization mechanisms in various cultural contexts and develop targeted intervention measures.

Output Format

By situating cyber attacks within a socio-cultural debate space, this study provides a novel perspective for analyzing "legitimization" and offers potential tools for designing defensive cybersecurity education. Combining content accuracy and argumentation completeness, the research advances academic understanding of human factors in cyber attacks.