Even with limited damage, cyber attacks increase public pressure for escalation

In this paper, we suggest that the foremost threat of cyberattacks is not necessarily their first-order consequences—such as the degradation of physical systems, data theft, or loss of access. While these outcomes remain a cause for concern, the fixation on direct effects obscures the more insidious consequences of long-term psychological harm and societal damage. This perspective acknowledges the human dimension of cyberattacks that target individual well-being, morale, and vulnerability. For many cyber perpetrators, ranging from terrorists to state-sponsored hackers and criminal organizations, the primary objective of attacks is to evoke anxiety and terror, and disseminate misinformation among the public. In other words, these are nonphysical aims whose efficacy cannot be simply measured by weighing rubble, counting bodies, or tallying lost funds. Viewing a ransomware attack on a hospital network as minor or unsuccessful, simply because it caused minimal physical destruction and failed to attain a ransom, ignores the extensive psychological and societal damage it can leave in its wake (Shandler and Gomez 2022). Through this lens, the severity of cyber-threats can and should also be measured by the level of psychological distress. We remove from the definition of distress transient or minor emotional responses such as unease or discomfort, and focus our attention on acute psychological distress, including visceral anxiety, enduring anger, and heightened threat perception (Canetti 2017; Byrne et al. 2022).

Currently, there is no consensus whether cyberattacks cause sufficient individual-level harm to constitute a grave threat. Some argue that the bulk of cyberattacks constitute only minor irritants (Lindsay 2013; Gartzke and Lindsay 2015), while other researchers insist that even low-level cyberattacks can levy severe psychological and political consequences (Gross, Canetti, and Vashdi 2016; Canetti et al. 2017). Addressing this dilemma, this paper employs an internal meta-analysis that reviews a series of experimental studies simulating exposure to cyberattacks. An internal meta-analysis is a powerful analytical tool that aggregates and analyzes a pooled collection of experiments conducted by a single researcher or group of researchers. This technique allows us to exploit heightened statistical power to provide precise statistical estimates of treatment effects, and incorporate studies conducted with different population groups at different points of time. We analyze the full gamut of studies conducted by the authors—including null and unpublished findings—to provide accurate, transparent, and conclusive evidence about the individual-level consequences of exposure to cyberattacks. In all, we aggregate and meta-analyze findings from eighteen experimental studies conducted between 2015 and 2021. Over the course of these studies, we exposed 6,020 unique respondents in three countries to simulated cyberattacks and conventional attacks, before measuring the psychological distress that ensued. All studies mimicked how people are exposed to real-world cyberattacks, while maintaining strict ethical standards to ensure participants’ well-being.

Our aggregate findings confirm that cyberattacks cause equally high levels of psychological distress as conventional terrorism and political violence. This finding challenges international and domestic security norms and practices in several ways. First, psychological suffering elicited by cyberattacks might now be sufficient to constitute an armed attack as defined by international law. If this were the case, cyberattacks could trigger the right of armed self-defense in response to attacks that until now have been perceived as limited strikes. At the same time, the newly perceptible psychological harms of cyber-conflict may weigh on calculations of proportionality and so constrain cyber operations. Second, we consider how the extreme psychological distress experienced by the public creates a groundswell of support for military retaliation, thus generating a political tailwind in support of escalation. In this way, we unveil an indirect route by which cyber operations influence foreign policy decision-making.