Cybersecurity Datasets in International Relations

Summary In order to effectively study the impacts of cyber incidents that affect international relations and security in the interconnected global society, accurate cybersecurity datasets are needed to conduct research. Cybersecurity datasets provide the foundations for researchers to gain necessary insights into patterns of cyber incidents conducted by state and nonstate actors. Research has determined that the predicted prospects of full-scale cyberwar, which would create conventional warfare effects, did not actualize. However, in its place, a continual cyber conflict occurs with varying levels of intensity and a myriad of targets. This has transformed cyberspace into a domain in which cyber attackers operate within a set of de facto norms, where the incidents do not escalate above an implicitly agreed threshold. Offensively, states such as Russia and China strive to engage in cyber conflict without attribution to ensure the incidents cannot be traced back to them, avoiding retaliation. State-sponsored actors, affiliated with a country but not officially representing it, may wage cyberattacks against entities on behalf of a state. The process of attribution enables those who investigate cyber incidents to conclude that a certain state or group carried out the attack and decide whether to publicly announce this through discourse. Many factors contribute to the difficulty of attribution, resulting in incomplete datasets. Cybersecurity datasets comprise cyber incidents including cyber conflict between state dyads, state-sponsored groups such as advanced persistent threat actors, and nonstate actors such as hacker groups and cybercriminals. The datasets contribute to international relations by enabling research that studies whether existing theories related to deterrence, escalation, democratic peace theory, and the offense–defense balance are supported by empirical research. Researchers are discovering patterns over time, which include increases in cyber activity, whether the targets of cyber campaigns change, which states and groups attack the most, and the types of incidents that are most prevalent. The need for both additional data and research continuously exists, as the evolution of cyber threats with the proliferation of artificial intelligence creates new vectors for cyber operations. The insights gained from the cybersecurity datasets inform policy, engendering decisions about effective responses. Given the research results, governments, militaries, economies, and businesses can knowledgeably work together against common cyberthreats. Studying these events empirically and expanding the research into persistent threats, which disrupt everything from banking to air travel, and military defense to critical infrastructure, proves necessary for securing nations. Although cyber incidents might not constitute acts of war, the culmination of their effects seeks to undermine the resilience of populaces.