The Microfoundations of State Cybersecurity: Cyber Risk Perceptions and the Mass Public

Abstract Cybersecurity represents a unique national security challenge for states: data breaches with the potential for national, macro-level consequences are most likely to occur at the micro-level, originating through the security errors of individual computer users. Thus, aspects of national cybersecurity can often critically depend on the personal attitudes and behavior of average citizens connecting online. However, to date, theories of state cybersecurity have almost exclusively focused on the macro-level, and very little is known about how the mass public reacts to—and protects themselves from—cybersecurity threats. This study addresses this gap, drawing on psychological theories of risk perception to explain why the public simultaneously reports great concern about cybersecurity, yet does little to protect their personal safety online. Using a novel survey experiment, we examine how exposure to different types of data breaches impacts citizens’ cyber risk assessments, personal online behavior, and support for various national cybersecurity policies. We find that baseline concerns about cybersecurity and knowledge about safe online practices are very low. However, exposure to a personally relevant data breach heightens risk perception and increases willingness to engage in safer online practices. But these effects are circumscribed—actual online behavior is more resistant to change. These results have important implications for the design of effective state cybersecurity policy.