Criminals and Cyber Attacks: The Missing Link between Attribution and Deterrence

This paper revisits the claim that the state capacity of attribution works as a deterrent for criminals to launch cyber attacks. Motivated by other empirical evidence for other types of crimes that do not support the claim, this research designed two quantitative analyses to test it. The first experiment looked at macro-level variables at the unit of the state and found that attribution can act as a deterrent. However, a second experiment looking at individual cases distinguished between three types of population and identified only one population for which the attribution-deterrence nexus is valid. Grounded in control theory, the claim is valid for individuals with a sufficient knowledge about the attribution process, who act rationally, and who are concerned about the socio-economic cost of the punishment. Enhancing attribution mechanisms is unlikely to result in any change of behaviours for criminals who act without knowledge or only with a limited perception of the attribution mechanisms, or for individuals who do not fear punishments as society praises their technological skills despite their anti-social and unethical behaviours.