cyber terrorism research papers

Advertisement

Cyber Attacks and Terrorism: A Twenty-First Century Conundrum

• Original Paper
• Published: 05 January 2017
• Volume 25 , pages 993–1006, ( 2019 )

Cite this article

• Marwan Albahar 1  

7101 Accesses

Explore all metrics

In the recent years, an alarming rise in the incidence of cyber attacks has made cyber security a major concern for nations across the globe. Given the current volatile socio-political environment and the massive increase in the incidence of terrorism, it is imperative that government agencies rapidly realize the possibility of cyber space exploitation by terrorist organizations and state players to disrupt the normal way of life. The threat level of cyber terrorism has never been as high as it is today, and this has created a lot of insecurity and fear. This study has focused on different aspects of cyber attacks and explored the reasons behind their increasing popularity among the terrorist organizations and state players. This study proposes an empirical model that can be used to estimate the risk levels associated with different types of cyber attacks and thereby provide a road map to conceptualize and formulate highly effective counter measures and cyber security policies.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Subscribe and save.

• Get 10 units per month
• Download Article/Chapter or eBook
• 1 Unit = 1 Article or 1 Chapter
• Cancel anytime

Price includes VAT (Russian Federation)

Instant access to the full article PDF.

Rent this article via DeepDyve

Institutional subscriptions

Similar content being viewed by others

Cyber Terrorism: A Growing Threat to India’s Cyber Security

Understanding Cyber Terrorism with a Special Focus on Zero-Day Attacks

The Fragmented Securitization of Cyber Threats

Bieda, D., Riddle, E., & Halawi, L. (2015). Cyberspace: A venue for terrorism. Issues in Information Systems, 16 (3), 33–42.

Google Scholar  

Carr, J., & Shepherd, L. (2010). Inside cyber warfare . Sebastopol, CA: O’Reilly Media Inc.

Denning, D. (2001). Activism, hacktivism, and cyberterrorism: the internet as a tool for influencing foreign policy. In J. Arquilla & D. Ronfeldt (Eds.), Networks and netwars the future of terror, crime, and militancy (1st ed., pp. 239–288). Santa Monica, CA: RAND.

Dhs.gov. (2015). Cybersecurity|Homeland Security . Retrieved from http://www.dhs.gov/topic/cybersecurity . Accessed December 24, 2015.

Dynes, R. (2006). Natural Hazards Observer—November 2006|Natural Hazards Center . Colorado.edu, Retrieved from http://www.colorado.edu/hazards/o/archives/2006/nov06/nov06c.html Accessed December 25, 2015.

Herzog, S. (2011). Revisiting the Estonian cyber attacks: Digital threats and multinational responses. Journal of Strategic Security, 4 (2), 49–60.

Article   Google Scholar  

Kerr, P., Rollins, J., & Theohary, C. (2009). The Stuxnet Computer Worm: Harbinger of an emerging warfare capability . Washington, DC: Department of Homeland Security.

Lewis, J. (2002). Assessing the risks of cybertwrrorism, cyber war, and other cyber threats . Washington, DC: Center for Strategic and International Studies.

Lewis, J. (2009). The “Korean” cyber attacks and their implications for cyber conflict |Center for Strategic and International Studies, Csis.org. Retrieved from http://csis.org/publication/korean-cyber-attacks-and-their-implications-cyber-conflict . Accessed December 26, 2015.

NATO. (2010). Strategic concept for the defence and security of the members of the North Atlantic Treaty Organisation . Lisbon: NATO.

O’Harrow, R. (2013). Zero day . New York: Diversion Books.

Rademacher, K. (2005). Clarke: ID theft prevention tied to anti-terrorism efforts . LasVegasSun.com. Retrieved from http://lasvegassun.com/news/2005/apr/13/clarke-id-theft-prevention-tied-to-anti-terrorism . Accessed December 23, 2015.

Rid, T., & McBurney, P. (2012). Cyber-weapons. The RUSI Journal, 157 (1), 6–13.

Rollins, J., & Wilson, C. (2007). Terrorist capabilities for cyberattack: Overview and policy . Washington, DC: Congressional Research Service.

Rustici, R. M. (2011). Cyberweapons: Leveling the international playing field”. Parameters, 41 (3), 32–42.

Theohary, C., & Rollins, J. (2015). Cyberwarfare and cyberterrorism: In brief . Washington, DC: Congressional Research Service.

Weimann, G. (2005). Cyberterrorism: The sum of all fears? Studies in Conflict & Terrorism, 28 (2), 129–149.

Weimann, G. (2008). Al-Qaida’s extensive use of the Internet , Ctc.usma.edu. Retrieved from https://www.ctc.usma.edu/posts/al-qaida%E2%80%99s-extensive-use-of-the-internet . Accessed December 15, 2015.

Wilson, C. (2003). Computer attack and cyberterrorism: Vulnerabilities and policy issues for congress . Washington, DC: Congressional Research Service.

Download references

Author information

Authors and affiliations.

School of Computing, Kuopio Campus, University of Eastern Finland, P.O. Box 1627, 70211, Kuopio, Finland

Marwan Albahar

You can also search for this author in PubMed   Google Scholar

Corresponding author

Correspondence to Marwan Albahar .

Rights and permissions

Reprints and permissions

About this article

Albahar, M. Cyber Attacks and Terrorism: A Twenty-First Century Conundrum. Sci Eng Ethics 25 , 993–1006 (2019). https://doi.org/10.1007/s11948-016-9864-0

Download citation

Received : 15 February 2016

Accepted : 19 December 2016

Published : 05 January 2017

Issue Date : 15 August 2019

DOI : https://doi.org/10.1007/s11948-016-9864-0

Share this article

Anyone you share the following link with will be able to read this content:

Sorry, a shareable link is not currently available for this article.

Provided by the Springer Nature SharedIt content-sharing initiative

• Cyber terrorism
• Cyber attack
• Counter measure
• Risk prediction
• Find a journal
• Publish with us
• Track your research

Demystifying Cyber terrorism: Causes, Costs & its impact on individuals’ psyche and public confidence

Ieee account.

• Change Username/Password
• Update Address

Purchase Details

• Payment Options
• Order History
• View Purchased Documents

Profile Information

• Communications Preferences
• Profession and Education
• Technical Interests
• US & Canada: +1 800 678 4333
• Worldwide: +1 732 981 0060
• Contact & Support
• About IEEE Xplore
• Accessibility
• Terms of Use
• Nondiscrimination Policy
• Privacy & Opting Out of Cookies

A not-for-profit organization, IEEE is the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity. © Copyright 2024 IEEE - All rights reserved. Use of this web site signifies your agreement to the terms and conditions.

• Search Menu
• Sign in through your institution
• Conflict, Security, and Defence
• East Asia and Pacific
• Energy and Environment
• Global Health and Development
• International History
• International Governance, Law, and Ethics
• International Relations Theory
• Middle East and North Africa
• Political Economy and Economics
• Russia and Eurasia
• Sub-Saharan Africa
• Advance Articles
• Editor's Choice
• Special Issues
• Virtual Issues
• Reading Lists
• Archive Collections
• Book Reviews
• Author Guidelines
• Submission Site
• Open Access
• Self-Archiving Policy
• About International Affairs
• About Chatham House
• Editorial Board
• Advertising & Corporate Services
• Journals Career Network
• Journals on Oxford Academic
• Books on Oxford Academic

Article Contents

Expectations: the emergence of research fields and their relationship to policy, a field in the making: cyberconflict studies in academic journals, diversification: from strategic studies to international affairs, expansion: the europeanization of cyberconflict studies, method over theory: influx of quantitative studies and experimental designs.

• < Previous

The evolution of cyberconflict studies

This article is part of a special section in the November 2024 issue of International Affairs on ‘Cybersecurity and International Relations: developing thinking tools for digital world politics’, guest-edited by Tobias Liebetrau and Linda Monsees. This research was funded through the Cyber Security, Knowledge and Practices (CYKNOW) project, project number 325297, supported by the Research Council of Norway. We would also like to thank Rob Gorwa. This article draws on an earlier version: Robert Gorwa and Max Smeets, ‘Cyber conflict in political science: a review of methods and literature’, SocArXiv Papers (March 2019), https://osf.io/preprints/socarxiv/fc6sg .

• Article contents
• Figures & tables
• Supplementary Data

Myriam Dunn Cavelty, Tobias Pulver, Max Smeets, The evolution of cyberconflict studies, International Affairs , Volume 100, Issue 6, November 2024, Pages 2317–2339, https://doi.org/10.1093/ia/iiae175

• Permissions Icon Permissions

In our increasingly digital world, cyberconflict poses a significant challenge to global security, prompting the emergence of an academic field dedicated to its study. Understanding the trajectory, evolution and dominant characteristics of cyberconflict studies is vital for scholars and policy-makers alike. By means of a thorough analysis of articles from the 125 top political science and International Relations journals, we illuminate the field's conceptual and methodological landscape. Our findings uncover a notable Europeanization of the field and a shift towards more rigorous methodologies, particularly experimental designs. While early research focused primarily on conceptual development and strategic topics, the contemporary field of studies exhibits a broader scope and greater diversity of scholarship. While the field has progressed beyond its nascent stages, it has yet to reach its full potential. We address several potential issues facing its growth and relevance. Firstly, there is a lack of global representation among researchers and in the incidents studied. Secondly, embracing interdisciplinary approaches is crucial for addressing newly emerging issues effectively. Thirdly, the diversification of research identities within the field of cyberconflict studies in the US and Europe must be bridged to foster collaboration and exchange of ideas. To overcome these challenges, adopting a pragmatic middle-ground approach is essential.

Cyberconflict, characterized by the intrusion of adversaries into computer networks to achieve political, military or economic objectives, has become a significant concern in international affairs. This prominence has grown over the years, with an increasing number of state actors developing the capabilities to strategically exploit cyberspace for political advantage. Political agendas, military strategies and economic aspirations converge in the virtual realm, presenting high stakes and far-reaching consequences.

From the moment cyberconflict emerged as an issue of concern, knowledge about it formed at the intersection between research and policy. Ideally, the two realms exist in a symbiotic relationship: policies grounded in robust research findings tend to be more effective in achieving their intended goals, while research gains depth and relevance through its practical application to real-world challenges. When optimized, such a symbiosis not only enhances the overall quality and impact of both research and policy, but also promotes positive societal change. 1 Even if in reality the relationship is often challenged by divergent approaches to knowledge in the two realms 2 and by fundamental debates among academics as to what the role of academia in relation to policy can and should be, 3 academic disciplines are increasingly expected to deal with politically, economically and socially relevant issues, and to commit to outreach and science communication strategies to produce impact. 4

The act of naming, categorizing, producing and presenting specific realities or ‘truths’ within the system of knowledge production inevitably influences the formation of entities and relationships in the world. Comprehending the dynamics of this knowledge creation process is therefore vital for fostering reflexive scholarly practices, evaluating scholarly significance and grasping the potential for fruitful interaction with the policy realm. 5 However, despite academia's increasing attention to the issue of cyberconflict, the lack of clarity surrounding the dominant characteristics, trends and overall maturity of the field presents a significant gap in our understanding. By addressing it, we provide a comprehensive analysis of the evolution of cyberconflict studies. We ask: how have cyberconflict studies evolved, what are the field's dominant characteristics and what does this signify for the science–policy interface?

We answer these questions by carrying out a systematic analysis of all relevant articles published in the top 125 political science and International Relations (IR) journals. This way, we can make an empirically grounded statement about the dominant conceptual underpinnings, theoretical advancements and methodological approaches in the academic sphere. 6 What distinguishes this article from previous attempts to map the field of cybersecurity is twofold. Firstly, it concentrates on cyberconflict as a distinct subset of other concerns about cyberspace in international relations, which is justified by the topic's significant policy relevance. Secondly, it is based on a systematic bibliometric analysis. 7 This allows us to approach the evolution of cyberconflict studies in an objective manner, instead of providing a snapshot view of its current state based on a subjective view of the field. The results will benefit both scholars and policy-makers. For scholars, understanding the evolution and dominant characteristics of cyberconflict studies helps to guide future research directions and foster interdisciplinary collaboration. 8 For policy-makers, insights into the science–policy interface shed light on how academic research can inform policy decisions and contribute to more effective strategies in addressing cyberconflict challenges.

The article is structured into five sections. Firstly, we establish expectations for the field based on general insights into the development of research fields, setting the stage for our analysis. Secondly, we discuss the construction of our corpus and provide an initial overview of the collected data. In the subsequent sections, we present the findings of our bibliometric analysis. We trace the evolution of cybersecurity studies from an initial focus on strategic topics to a more diverse and Europeanized field. Additionally, we explore the methodological approaches employed, noting a shift towards greater scientific rigour. Finally, we revisit the alignment of cyberconflict research with the needs of the policy community in the concluding section, offering insights into potential implications and future directions.

To formulate expectations that can guide the analysis, we combine micro and macro insights from two different bodies of research: (quantitative) scientometrics 9 and (qualitative) literature on the sociology of International Relations. 10 Scientometrics addresses the ‘natural process of the dynamics of science’ 11 across all fields of research. Its generic observations should apply to cyberconflict studies, especially as visible in top journals. On the other hand, the sociology of IR literature delves into the evolution and organization of the discipline across various geographic contexts and often focuses on differences, not commonalities. 12 In addition, we explore the implications of these general observations regarding the evolution of academic research for the science–policy interface.

Scholars in scientometrics have embraced a ‘life cycle’ perspective on the evolution of research fields, drawing inspiration from innovation theory. According to this view, all research fields transition through four phases: creation, adoption, peak and decay. 13 During the creation phase, research is marked by high levels of innovation and interdisciplinarity. Foundational texts, often the most cited articles, are typically produced at this stage, predating the field's maturity. In this phase, innovative individuals, driven by a willingness to explore new topics, play a crucial role as the drivers for research directions and approaches. 14

As research fields transition into the adoption and peak phases, two significant expansions become apparent: an increase in scholarly literature encompassing a broader range of topics, and a rise in the number of scholars situated across various geographical regions, reflecting an expanded geographical spread. Also, the establishment of dedicated academic departments, research centres and professional organizations becomes more prevalent, solidifying the institutional presence of the field. 15 As knowledge accumulates, research fields move from an empirical emphasis towards the development of theories, which evolve and expand as researchers delve deeper into phenomena. 16 Unlike the interdisciplinary nature of the initial phase, the second and third phases are characterized by having fewer references to external fields, as knowledge becomes internally integrated over time. The ability to set topics and trends moves from individuals to research groups or clusters, and, consequently, ‘schools of thought’ emerge in specific locations. 17 Moreover, methodological rigour becomes increasingly imperative to ensure the reliability and replicability of studies, as well as to secure publication in top journals. This emphasis on rigour is accompanied by greater attention to data and the inclusion of case-studies.

The decay of research fields typically stems from two main causes. The first cause is intellectual stagnation, which occurs when innovation becomes minimal, and new publications do not ‘lead to turnover of central ideas in a field, but rather to ossification of canon’. 18 Second, even if research remains dynamic and continues to address emerging questions and challenges, a field can become less coherent to the extent that it ceases to be observable as a distinct entity. Controversies and debates may challenge established paradigms, causing old questions to lose their relevance. Subsequent exploration of new directions may result in the dissolution of the old field in favour of a new, distinct one, or the fragmentation of the old field into numerous subfields, ultimately leading to the loss of a coherent common research focus. As the field of cyberconflict studies is still relatively new, we did not consider the possibility of an imminent dissolution of the field or its fragmentation into subfields. However, as the field matures even further, it will be important to monitor for signs of such changes and adapt research and policy approaches accordingly.

In accordance with these theoretical perspectives, we anticipate seeing three developments in cyberconflict studies over the years: 19

Diversification : during the creation phase of a research field, attention is typically focused on a limited number of key topics. As the field progresses into the adoption and peak phases, the scope of topics expands and diversifies.

Expansion : in the creation phase, research efforts tend to be concentrated in a few specific locations. However, as the field advances into the adoption and peak phases, this geographical concentration diminishes, leading to a more dispersed and global research landscape. Different regions may develop their own distinct research identities.

Methods over theory : during the creation phase, there is often an emphasis on conceptual exploration and theory development. However, as the subfield evolves, there is a noticeable shift towards the prioritization of rigorous methodologies and empirical data.

Overall, increasing maturity of a field correlates with the richness of its content. However, in this process, tensions are likely to arise between the rigorous academicization of research and its practical relevance, encapsulated by the ‘rigour’ vs ‘relevance’ dilemma. 20 The three trends can therefore have ambiguous implications for the science–policy interface, as summarized in table 1 and as discussed further in the conclusion. 21

Summary of challenges, needs and opportunities for the science–policy interface

This article relies on a comprehensive examination of the pertinent body of cyberconflict research published in the top political science and IR journals. In this section, we outline the methodology employed to identify this corpus of texts. Subsequently, we analyse the number of articles published per year to glean initial insights into the formation of the field.

Constructing the corpus: methodology and data

We used the SCImago journal rankings for 2022 to select the top 125 journals of relevance. 22 Several steps were necessary to identify the corpus thereafter. First, we used the Scopus database to find journal articles published up to December 2022 23 and related to cyberconflict by using a set of keywords that we searched for in the title or abstract. 24 This search resulted in 345 articles. Second, we manually refined the initial list by keeping only those who fulfilled the following selection criteria: 1) articles that were of typical journal length (e.g. very short articles of one or two pages were excluded); 2) articles that focused predominantly on cyberconflict issues; and 3) articles that were stand-alone articles, and not the editorial introductions for a special issue. 25 After this exclusion, the final corpus included 174 articles published across 44 journals.

Table 2 provides the list of journals with five or more publications in the corpus and their rankings. Almost one out of four articles in the corpus are from the Journal of Cybersecurity , followed by the Journal of Strategic Studies and Contemporary Security Policy . 26 Apart from International Security , none of the outlets with five or more cyberconflict articles are in the top twenty, a clear indication that the field has not (yet) become mainstream.

Overview of all journals with five or more articles in the corpus

Leveraging text files, 27 we conducted a semi-automated text analysis to explore diversification, expansion and methodological preferences. For the first aspect (diversification), we identified the most widely discussed topics and incidents, using the frequency of mentions. For the second (expansion), we coded the primary institutional affiliation of the authors for each article (North America, United Kingdom, rest of Europe, Asia, other) to calculate the share of authors from different regions by article. 28 For the third (methodological preferences), we coded the articles according to the methodology used by the authors (qualitative, quantitative and mixed methods approaches).

It is important to mention two limitations of this study. First, our analysis reflects only a segment of the academic discourse—the portion that is documented within the most recognized journals. Our methodology inherently favours well-established and often western perspectives that dominate mainstream scholarship. Consequently, it overlooks fringe theories and emerging schools of thought that have yet to gain prominence within leading publications. Such works are usually published on less conventional platforms or in languages other than English, resulting in a systemic bias in the analysis. Additionally, bibliometric trends primarily rely on quantifiable data, such as keywords, to gauge the influence of specific topics within the field. While this approach allows for objective assessments of the general acceptance of ideas within mainstream scholarship, it overlooks the quality or transformative potential of the ideas themselves. Thus, while our analysis aims to minimize subjectivity and provide a structured overview of the field's evolution, it may inadvertently perpetuate the status quo by prioritizing scholarship that aligns with prevailing intellectual norms.

Second, it is crucial to acknowledge the limitations of our sample itself. While our approach guarantees the inclusion of all articles from the top 125 journals in the field, it is important to recognize that the field itself is still relatively young and 174 articles does not constitute a large sample. Consequently, we have aggregate data for only a limited number of years, which likely means that certain trends are not yet fully apparent. Additionally, it is worth considering that with a relatively small number of articles, specific topic clusters within the field can be heavily influenced by a small number of prolific authors. 29

Identifying the take-off point: number of articles per year

Upon plotting the number of articles over time, we observe a notable uptick in cyberconflict publications around 2009–2010, followed by another significant and consistent rise around 2017–2018 (see figure 1 ). We hypothesize that the period spanning 2011–2017 corresponds to the creation phase, while the years 2018 to 2022 signify the adoption phase (and in certain cases, an early peak phase). The downward trend in 2022 does not continue for 2023.

Total articles per year in the top 125 journals

The apparent delay in the ‘take-off’ of cyberconflict research after 2008 may seem surprising when considering the longstanding recognition of cyberconflict within the (especially United States) policy community. Indeed, proactive measures to institutionalize responses to the cyber threat were initiated as early as the 1980s, with notable militarization trends emerging from 2003. 30 However, such lags between policy-relevant topics and the emergence of scientific literature are commonly observed in security studies. The immediate need to address perceived ‘new threats’ often drives a demand for policy-relevant and ‘actionable’ knowledge, a demand typically met by think tanks before these concerns are picked up by academia. 31 These policy-oriented publications are usually focused on concepts, rather than empirics. In addition, due to long peer-review processes, social sciences are generally slower to publish.

Also important for the evolution of cyberconflict research are key cyber events that validated the longstanding expectation that states would leverage cyberspace for political and strategic purposes. 32 In fact, ‘incidents’ remain a key driver for the development of the field throughout the years: they bring to light previously unknown aspects about adversaries, their intentions and capabilities, and usually prompt new directions in research. We conducted an additional analysis of the incidents that are mentioned in the articles, to understand which ones hold the most prominent position. Overall, there are only a handful of prominent incidents discussed in most journal articles. Undoubtedly of the greatest significance for the field's development is Stuxnet, first discovered in 2010, which is mentioned in almost 50 per cent of the articles. Conceived jointly by the US and Israel, Stuxnet was specifically engineered to inflict physical damage on Iran's nuclear centrifuges in Natanz, with the aim of thwarting Iran's pursuit of nuclear weapons. 33 Most importantly, Stuxnet served as an illustrative example on a wide spectrum of strategically relevant themes. It highlighted both the significant and less impactful aspects of cyber operations; stimulated conversations regarding the necessity for cyber norms, especially in safeguarding critical infrastructure; raised discussions about the nuances of international law in the context of cyberspace; and offered insights into the militarization of cyberspace. 34

The second most mentioned incident (20 per cent of articles) is the series of distributed denial-of-service (DDoS) attacks against Estonia in early 2007. The goal of DDoS attacks is to flood the target with so much traffic asking for services that it consumes all the target's resources, causing disruption in services. These attacks spanned a 22-day period and were directed at a range of political, financial and media websites, and other electronic services. They were triggered by the Estonian government's decision to relocate a significant two metre-tall bronze statue, which commemorated the Soviet victory over Nazi Germany, from the centre of the capital, Tallinn, to a cemetery situated on its outskirts. Though a clear attribution to the Russian government remains elusive, the circumstances and the tactics employed point to—at a minimum—wilful ignorance by the Russian state. 35 A year later, in July and August 2008, DDoS attacks targeted Georgian news and government websites, subsequently expanding to other targets in the country, including educational institutions, finance companies and western media outlets. 36 These DDoS attacks, mentioned in 13.9 per cent of all articles in our corpus, coincided with the entry of Russian troops into the Georgian oblast of South Ossetia. It is thus often discussed in the literature as the first case of hybrid warfare with a cyber element.

As the field of cyberconflict studies matures, we anticipate an expansion and diversification of the topics under discussion. Indeed, the data reveals that cyberconflict studies initially emerged as a narrow subfield within strategic studies, with early scholarship predominantly published in a limited number of outlets such as Strategic Studies , Security Studies and International Security . During this nascent period, the literature primarily focused on the concept of ‘cyberwar’, notably on the idea that ‘strong powers [could] be brought to their knees by weaker ones, perhaps bloodlessly’. 37 However, between 2011 and 2017 the field witnessed the publication of foundational texts that aimed to challenge what some scholars perceived as an overhyped discourse surrounding cyberwar. 38 Critical and constructivist scholarship emerged, engaging with questions regarding the presentation of cyberconflict in the political arena and its implications. This line of inquiry applied variations of securitization theory to cybersecurity, seeking to understand why and how the issue was framed in particular ways and the resulting consequences. 39

Figure 2 illustrates the topics that garnered attention during the creation phase and those that experienced shifts in significance during the adoption phase. Figure 2 shows a marked decrease in the discourse surrounding ‘cyberwar’ after 2018, paralleled by a significant decline in writing about ‘cyber deterrence’ and ‘cyber defence’. A cyberconflict article published between 2015 and 2017 mentioned ‘cyber deterrence’, on average, between 23 times (in 2015) and 36 times (in 2017). These articles often discussed the difficulty in deterring cyber attacks while also pointing out the range of strategies available to policy-makers to dissuade potential attackers. 40 However, there was a notable decline in the average mentions of deterrence in the following years, dropping to as few as five times per article in 2018 and 15 times in 2020. 41 The decline in discussions of cyber defence was even more pronounced than that for deterrence, signalling an even more significant shift in scholarly attention within this period.

Prevalence of specific strategic issues in cyberconflict research across separate periods 42

This waning interest may partially be explained by the growing scepticism among scholars regarding the direct connection between cyberspace and destructive, warlike attacks. It is noteworthy that we see the rise of a new term, ‘cyber operations’, to describe strategic activities in cyberspace at the same time. Conversely, since 2018 we have seen discussions about cyber persistence theory, a conceptual framework that emphasizes the continuous and strategic nature of cyber operations, suggesting that states engage in a constant state of competition in cyberspace. 43 This approach highlights the importance of sustaining presence and influence in cyberspace to achieve long-term strategic objectives, and vocally questions the credibility and effectiveness of deterrence approaches.

While some strategic topics exhibit a decrease in prominence ( figure 2 ), there is a slight increase in topics that align with IR more broadly, particularly in the period after 2018 (as depicted in figure 3 ). Although the decline in strategic topics outweighs the growth of non-strategic topics, this overall trend indicates the expected diversification of the field.

The prevalence of non-strategic issues in cyberconflict research across separate periods 44

Notable clusters of scholarship have emerged around the examination of cyber governance mechanisms 45 and intelligence within the field of cyberconflict studies. Indeed, a growing segment of academic scholarship has started to view cyberconflict through the lens of an intelligence contest rather than conventional warfare. 46 Some scholars suggest that the essence of cyber operations is inherently subversive, indicating that while these operations may hold strategic promise, their effectiveness is limited by challenges related to speed, intensity and control. 47 This understanding has been enriched by insights from the (technically oriented) threat intelligence community, contributing to a more comprehensive comprehension of the evolving landscape of cyberconflict.

This increased interest in ‘intelligence’ may be partially attributed to the privatization of spyware and a series of high-profile cases that have shed light on its impact on global surveillance practices, both domestically and internationally. Additionally, we can observe a notable shift within the field of intelligence studies itself. Traditionally characterized by its practitioner-oriented approach, intelligence studies has increasingly embraced theoretical frameworks and gained traction within the academic mainstream. This evolution has been evident in the publication of high-impact journal articles and award-winning books from prestigious university presses. 48 The theoretical advancement within intelligence studies, moving from field reports towards structured empirical research, has facilitated a deeper exploration of intelligence operations in the digital age. As cyber operations become an integral component of intelligence work, the boundaries between cyberconflict and intelligence activities become increasingly blurred, rendering this topic more pertinent for scholars in IR.

In aggregate, these trends reflect a shift from the confrontational aspects of cyberconflict towards a more comprehensive debate that encompasses collaborative and normative dimensions. This expansion not only signifies a closer alignment with general debates and topics within IR, but also underscores greater cross-disciplinary interactions, drawing insights from diverse fields such as computer science and international law. Moreover, the diversification of cyberconflict studies has prompted a renewed engagement with post-structuralist and other critical theories. 49 Although it is not high in volume, this type of literature continues to contribute new conceptual dimensions to the study of cyberconflict and security, enriching the scholarly discourse in meaningful ways.

In maturing fields, research institutions are typically expected to expand and diversify. In this section, we demonstrate that alongside the shifting thematic focus within the field of cyberconflict studies, there has been a discernible trend towards Europeanization. We highlight that this transformation can be attributed to a relative decline in scholarly output originating from the US and the UK, juxtaposed with a substantial increase in contributions from scholars affiliated with institutions across continental Europe. Furthermore, we delve into the implications of this phenomenon of Europeanization and explore potential explanations that may underlie this transformative process.

Figure 4 depicts the distribution of authors from continental Europe compared to those from North America and the UK per article per year. During the field's initial creation phase, most articles were authored by scholars affiliated with North American or UK institutions. However, the figure illustrates a steady decline in the relative share of North American and UK-based authors in the field. While the proportion of continental European authors has shown a steady increase since the early 2010s, disaggregating the data for the UK and US reveals a relative decrease in scholarly contributions from both regions. Notably, from 2019 the representation of UK authors per article dipped below that of the rest of Europe for the first time; it has remained lower ever since. By 2021 an almost equal proportion of scholarship was being generated by scholars affiliated with institutions in continental Europe, compared to those in North America and the UK. This shift in authorship distribution underscores the growing influence and participation of continental European scholars in shaping the discourse and research agenda within the field of cyberconflict studies.

Average share of authors based in the US or the UK vs continental Europe over time 50

Once again, while we can only offer speculative insights, there appears to be a correlation between the expansion of the field, as previously noted, and the increasing influence of European authors within it. Specifically, while scholars from the US and UK tend to gravitate towards strategic topics, their counterparts in continental Europe often lean towards broader IR themes. This inclination has been recognized for some time. While it was perhaps most famously articulated by Robert Kagan in his 2002 article ‘Americans are from Mars and Europeans are from Venus’, 51 it was also expressed by those researching the evolution of security studies and the different research traditions that have emerged. 52

To bolster our observation of this trend, we underscore the correlation between the proportion of European authors and the prevalence of specific topics within the corpus. Figure 5 underscores that themes typically linked with strategic studies are primarily investigated by scholars affiliated with institutions in the US or UK, rather than by their counterparts in other European regions. In contrast, figure 6 underscores that topics like securitization, surveillance, discourse and norms are more frequently examined by European scholars. 54 Other ‘European’ topics, such as intelligence, may not have such straightforward explanations for why they receive more attention within Europe. However, as previously mentioned, the presence of a few individuals with a significant research output based in Europe could potentially account for this outcome.

Relationship between the share of continental European authors and strategic topic prevalence in the corpus, 2011–2022 53

Relationship between the share of continental European authors and non-strategic topic prevalence in the corpus, 2011–2022 55

Lastly, we look at the key methodological approaches employed in the field of cyberconflict studies. Initially, during its creation phase, significant emphasis was placed on conceptual development. Scholars endeavoured to define and refine core terminologies and concepts integral to understanding cyberconflict, such as ‘cyberwar’, ‘cyber coercion’, ‘cyber deterrence’ and ‘cyber weapon’. Concurrently, theoretical frameworks addressing the strategic value of cyber capabilities began to emerge. However, as the field matured, a noticeable shift occurred in its methodological orientation. As expected, contemporary research demonstrates a heightened commitment to case-study design and empirical data collection. Scholars have transitioned from mere conceptualization to the rigorous testing and validation of theories. This transformation is further highlighted by the increased prevalence of quantitative studies utilizing survey or experimental designs, reflecting a broader evolution towards empirical inquiry within the field.

From theory-building to quantitative studies

The political science literature often distinguishes between theory-building and theory-testing studies. Within the corpus of cyberconflict articles, a predominant focus appears to be on theory-building—in a broad sense, these articles aim to offer new insights into cyberconflict phenomena through innovative theoretical perspectives or by delineating causal mechanisms. Additionally, a considerable number of articles, particularly during the creation phase, were descriptive in nature. Rather than constructing or testing theoretical frameworks or causal mechanisms, these articles primarily sought to elucidate concepts or specific incidents related to cyberconflict. 56 This pronounced emphasis on conceptual development, description and theory-building aligns with our initial expectations. It also suggests that many experts, particularly during the formative years of the field, perceived cyberconflict dynamics as markedly distinct from traditional forms of conflict, necessitating novel theoretical approaches to comprehend and expound upon these nuances.

Once theoretical frameworks are established, the research community typically shifts towards empirically validating or refuting these theories through empirical research. Case-study selection becomes crucial in elucidating the generalizability of findings. However, contrary to expectations, only a few articles in the corpus justify their case selection using methodological approaches rooted in positivist political science—such as selecting cases based on their likelihood to test a specific theory, such as ‘most likely’, ‘least likely’ or ‘crucial’. 57 Instead, the majority of articles opt for ‘illustrative’ cases. 58 For example, cyber-enabled political warfare against the United States in 2016 is used as an illustrative case to explain how escalation can occur as a second-order effect of cyber operations. 59 Or, the Dutch public attribution of the attempted hacking of the Organisation for the Prohibition of Chemical Weapons (OPCW) is used to explain the complexity of the public attribution process. 60 In another instance, a case-study of Estonia is utilized as a ‘rudimentary plausibility test’ to demonstrate how cyberspace is susceptible to certain cognitive biases. 61

Rather than delving into a few comprehensive case-studies, these articles incorporate historical examples, alongside primary and secondary source materials, which include government reports, reports from threat-intelligence companies and news coverage to bolster their arguments. While this approach is understandable, given the limited number of well-known cases widely recognized as significant, it lacks systematicity, leaving room for the cherry-picking of cases to suit the argument being presented. One frequently cited reason for the absence of theory-testing during the creation phase is the scarcity of empirical data. Indeed, the secrecy surrounding government organizations and their capabilities, coupled with the anonymity of attackers, complicates research aimed at testing theories. Much of the available data and reporting on cyber operations stems from cybersecurity firms like Microsoft, Kaspersky Lab, Crowdstrike and Mandiant. However, it is crucial to note that much of this reporting is undertaken for marketing purposes, introducing an economic and political dimension. Notably, few of these firms have reported on western operations, particularly those based in the US. 62

Despite these limitations, there remains a wealth of untapped raw data and other documents that awaits further analysis. 63 For instance, in recent years, several significant leaks from non-state actors have occurred. In 2015 the entire email archive of Hacking Team, an Italian-based spyware company with ties to government intelligence and law enforcement agencies worldwide, was compromised. 64 Similarly, in 2022 the internal messages of the Conti Group, then the largest criminal ransomware group considered a ‘national security threat’ by multiple countries, were leaked. 65 However, academic research in political science and IR journals has yet to fully leverage these type of sources to elucidate their operational activities and impacts. 66 Disciplinary constraints—such as what constitutes relevant research in political science—likely contribute to this gap. Many intriguing and pertinent research questions in the field of cyberconflict studies (and beyond) are challenging to address using mainstream theories, as they may not neatly fit into established categories or parsimonious mechanisms favoured in dominant IR theories. Although there have been notably fewer quantitative studies compared to qualitative ones on cyberconflict, aiming to comprehend conflict dynamics at either the international or subnational level, it is evident that quantitative research has steadily gained momentum since 2018 (see figure 7 ).

Number of articles leveraging quantitative (orange) vs qualitative (green) methods over time 67

A review of existing quantitative studies reveals several substantial challenges encountered when coding cyberconflict events. 68 To begin with, difficulties arise in categorizing cyber operations into distinct types, as many operations serve multiple objectives simultaneously. For instance, a single operation may include both intelligence-gathering and the deployment of destructive tactics, such as a data-deletion ‘wiper’ component. Additionally, the pairing of tactics, such as launching DDoS attacks with ransomware—malicious software that encrypts a victim's files or systems demanding a payment for decryption—further complicates classification efforts. Second, there is often a lack of attribution data in country-level datasets, making it challenging to determine the origin of cyber attacks. This lack of attribution information makes distinguishing between state and non-state actors difficult, especially considering that many cyber groups have members spanning multiple countries.

Thirdly, compiling dyadic data on cyberconflict faces challenges due to the widespread impact of cyber operations across multiple countries. Determining the criteria for establishing a dyadic relationship, such as the extent of impact or the number of compromised systems, presents dilemmas that can significantly affect dataset outcomes. Consider the case of NotPetya, a devastating cyber attack launched in June 2017 which ultimately caused an estimated US$10 billion in damages and severely affected companies across the world. 69 The decision whether NotPetya should be represented as a single dyadic relationship between Russia and Ukraine, where the attack was initially detected, or should include its effects on multiple countries, can greatly influence dataset interpretations. In light of these challenges, careful interpretation of results is necessary; or, alternatively, a preference for mixed-method or qualitative designs may be preferable.

Experimental research designs

In recent years, one of the most notable advancements in methodology within the field of cyberconflict studies has been the adoption of experimental research designs, reflecting a broader trend observed in the social and political sciences. 70 These experimental approaches aim to employ micro-foundational reasoning to elucidate the decision-making processes that precede the use of cyber operations. This is particularly pertinent given the significant role that cognitive heuristics and motivated reasoning play in shaping judgments related to cyberspace. 71 Moreover, experimental designs offer a valuable tool for exploring public perceptions and attitudes towards cyber issues, providing critical insights into how different segments of society perceive and respond to cyber threats and challenges. 72

Experimental designs indeed offer several strengths, characterized by clear research designs and high standards of methodological rigour. These studies typically feature explicit discussions on case selection, the generalizability of findings and a clear articulation of theory and hypotheses. One notable advantage is their often simultaneous engagement in both theory-building and testing, allowing for the derivation of concrete hypotheses and their empirical verification. These articles are particularly valuable in addressing gaps related to psychological mechanisms and public opinion. By emphasizing perceptions alongside actual events, experimental designs offer nuanced insights that complement more macro-level studies, enriching our understanding of the complexities inherent in cyberconflict scenarios.

While experimental designs offer significant strengths, they also have notable weaknesses. These studies typically focus on a limited aspect of cyberconflict, making it challenging to address broader strategic questions comprehensively. They may struggle to tackle the ‘big questions’ of cyberconflict and are less likely to lead to significant theoretical breakthroughs or insights. Additionally, the practical relevance of studies examining public opinion depends on the extent to which public sentiment influences outcomes in cyberconflict scenarios. Understanding the relationship between public and elite opinion is crucial, yet authors often overlook discussing this connection. 73

In this article, we undertook an in-depth analysis of the progression of cyberconflict studies as a prerequisite for understanding what kind of academic contributions hold the potential to exert influence on policy-making. Despite its relative youth, characterized by a significant increase in scholarly publications since approximately 2017, the field has moved beyond its creation phase. Our investigation underscores the broadening scope of academic literature, covering diverse topics and attracting a growing number of scholars across two main regions. Furthermore, there is a noticeable trend towards the adoption of quantitative methodologies. This suggests that the field continues to evolve and expand, indicating that it has not yet reached its full maturity. This observation is reinforced by the limited representation of cyberconflict articles in the top ten ranked journals.

We also observe a significant diversity within the field, further suggesting that its boundaries are not yet clearly defined and that the field remains flexible to addressing important issues. While some segments align closely with traditional IR scholarship, others embrace interdisciplinary perspectives, especially when exploring emerging topics. Despite the increasing popularity of quantitative studies, qualitative research remains prevalent, indicating the field's multifaceted nature. Additionally, while certain incidents may attract more attention, the field exhibits adaptability in addressing new challenges arising from real-world threat activities and cyber incidents. Notably, innovation thrives through cross-disciplinary collaboration, drawing insights from fields like technical threat intelligence and academic intelligence studies.

Despite the observable and increasing diversity within the field, there are several potential issues for the policy/science interface. First, while the field exhibits diversity in its scholarly contributions, it lacks global representation in terms of both researchers and the incidents studied. The predominance of western perspectives and a small number of incidents reflects a bias towards what is considered relevant, potentially excluding valuable insights from non-western contexts. Moreover, disparities in access to data about incidents, often linked to technical capabilities and network visibility, further exacerbate this issue. Addressing this gap will be crucial for ensuring a more comprehensive understanding of cyberconflict dynamics and mitigating potential biases in research and policy-making.

Second, a notable dynamic within cyberconflict studies is the contrast between the perspectives originating from the United States and Europe. While strategic studies primarily emerged in the US and was subsequently exported to Europe, the situation with cyberconflict studies is slightly more nuanced. Europe has developed its own distinct research identity within the field, often focusing on different topics compared to its American counterpart. This diversification signifies a positive development in fostering a multifaceted understanding of cyberconflict. However, it is essential to ensure effective communication and collaboration between these differing perspectives to promote a comprehensive and cohesive approach to addressing cyber threats on a global scale.

Third, if the use of quantitative methodologies becomes dominant, it may impose constraints on the breadth of inquiries the field can explore, potentially stifling innovation and limiting the adaptation to emerging challenges. This trend exacerbates the ‘rigour’ vs ‘relevance’ dilemma, where a singular focus on quantitative methods may overlook qualitative aspects essential for understanding complex phenomena. Quantitative approaches typically rely on easily measurable and statistically analysable data, potentially excluding qualitative research questions that delve into experiences, social dynamics or subjective phenomena. The emphasis on predefined variables and measurable outcomes might discourage exploration of novel ideas or unexpected findings, limiting the field's capacity for innovation. Moreover, policy issues in cyberconflict often entail social, ethical and cultural dimensions that may not lend themselves well to quantitative analysis. Overreliance on quantitative data could result in technically sound but inadequately human-centred policies that fail to address underlying societal concerns.

To address these challenges, it is crucial for scholars in cyberconflict studies to advocate for the use of diverse research methods, including qualitative and mixed-method approaches. Prioritizing research questions that drive the methodology, rather than letting available data dictate the focus, can facilitate a more nuanced and comprehensive understanding of cyberconflict dynamics. By embracing methodological diversity, the field can better navigate the complexity of cyber threats and contribute to the development of more effective and socially responsible policies.

There is a further academic bias to be aware of: cyberconflict studies are clearly influenced by the state-centric nature of IR and security studies. Despite the formal acknowledgment of non-state actors' importance, the field remains predominantly focused on state actors, which overlooks the growing role of non-state actors in cyberconflicts. These include criminal groups, ‘hacktivists’, and even private companies. This can lead to an incomplete picture of the cyber threat landscape. Furthermore, non-state actors, such as tech companies and security researchers, possess valuable knowledge and resources. A state-centric approach can hinder collaboration and information-sharing with these crucial players.

In sum, a pragmatic middle-ground approach that reconciles disciplinary conventions with the imperative for interdisciplinary relevance is needed. Embracing this approach will empower the emerging field of cyberconflict studies, enabling it to uphold its academic rigour while promoting adaptability and responsiveness. Bridging the gap between academic research and practical policy needs will be paramount for leveraging the potential of cyberconflict studies to offer valuable insights and solutions to pressing cybersecurity issues worldwide. However, achieving this alignment demands deliberate efforts to effectively communicate scholarly findings through science communication, translate them into actionable policies and integrate them into decision-making processes within the policy community. Therefore, fostering closer collaboration and dialogue between academics, policy-makers and practitioners is crucial in addressing the complex and dynamic nature of cyber threats in the digital age.

The literature on this relationship is vast. As a starting point, see: Paul Cairney, The politics of evidence-based policy making (London: Palgrave Pivot, 2016).

The two approaches can be characterized by ‘knowing’ versus ‘deciding’. Academia focuses on questioning established knowledge and the systematic generation of new knowledge. In contrast, government entities seek ‘usable’ knowledge that can offer guidance for optimal decision-making. See Andreas Wenger, Myriam Dunn Cavelty and Ursula Jasper, eds, ‘The politics and science of the future: assembling future knowledge and integrating it into public policy and governance’, in Andreas Wenger, Ursula Jasper and Myriam Dunn Cavelty, eds, The politics and science of prevision: governing and probing the future (Abingdon and New York: Routledge, 2022), p. 3.

Stephen M. Walt, ‘The relationship between theory and policy in International Relations’, Annual Review of Political Science , vol. 8, 2005, pp. 23–48, https://doi.org/10.1146/annurev.polisci.7.012003.104904 . Even most critical scholars argue that connecting academic research with policy practice is important. See for example: Marieke de Goede, ‘Engagement all the way down’, Critical Studies on Security 8: 2, 2020, pp. 101–115; or Sam Weiss Evans, Matthias Leese and Dagmar Rychnovská, ‘Science, technology, security: towards critical collaboration’, Social Studies of Science 51: 1, 2021, pp. 189–213, https://doi.org/10.1177/0306312720953515 .

Christina Boswell and Katherine Smith, ‘Rethinking policy “impact”: four models of research-policy relations’, Humanities & Social Sciences Communications 3: 44, 2017, http://doi.org/10.1057/s41599-017-0042-z .

Fabio Cristiano et al., ‘Cybersecurity and the politics of knowledge production: towards a reflexive practice’, Journal of Cyber Policy 8: 3, 2023, pp. 331–64, https://doi.org/10.1080/23738871.2023.2287687 .

We intentionally exclude think tank publications and policy-oriented works from our analysis, as while valuable for knowledge production, they do not necessarily exhibit the academic rigour and characteristics we are specifically interested in examining. Likewise, we omit books from our sample, as even those published by academic presses frequently adhere less closely to academic standards and conventions.

For other examples, see Robert Reardon and Nazli Choucri, ‘The role of cyberspace in International Relations: a view of the literature’, Proceedings of the 2012 ISA Annual Convention , San Diego, CA, 1 April 2012; Ron Deibert, ‘Trajectories for future cyber security research’, in Alexandra Gheciu and William C. Wohlforth, eds, Oxford handbook of international security (Oxford: Oxford University Press, 2018), pp. 531–46; Myriam Dunn Cavelty and Andreas Wenger, ‘Cyber security meets security politics: complex technology, fragmented politics, and networked science’, Contemporary Security Policy 41: 1, 2020, pp. 5–32, https://doi.org/10.1080/13523260.2019.1678855 ; Max Smeets and Robert Gorwa, ‘Cyber conflict in political science: a review of methods and literature’, Proceedings of the 2019 ISA Annual Convention , Toronto, March 2019.

Also see the introduction to this special section: Linda Monsees and Tobias Liebetrau, ‘Cybersecurity and International Relations: developing thinking tools for digital world politics’, International Affairs 100: 6, 2024, pp. 2303–14, https://doi.org/10.1093/ia/iiae232 .

As an example, see Xiaoling Sun et al., ‘Social dynamics of science’, Scientific Reports 3: 1069, 2013, pp. 1–6, http://doi.org/10.1038/srep01069 .

George Lawson and Robbie Shilliam, ‘Sociology and International Relations: legacies and prospects’, Cambridge Review of International Affairs 23: 1, 2010, pp. 69–86, https://doi.org/10.1080/09557570903433647 .

Mario Coccia, ‘General properties of the evolution of research fields: a scientometric study of human microbiome, evolutionary robotics and astrobiology’, Scientometrics , vol. 117, 2018, pp. 1265–83, https://doi.org/10.1007/s11192-018-2902-8 .

See e.g. Knud Erik Jørgensen and Tonny Brems Knudsen, International Relations in Europe: traditions, perspectives and destinations (Abingdon and New York: Routledge, 2006); Arlene Tickner and Ole Wæver, International Relations scholarship around the world (Abingdon and New York: Routledge, 2009).

Chakresh Kumar Singh et al., ‘Quantifying the rise and fall of scientific fields’, PLoS ONE 17: 6, 2022, https://doi.org/10.1371/journal.pone.0270131 .

Lingfei Wu, Dashun Wang and James A. Evans, ‘Large teams develop and small teams disrupt science and technology’, Nature 566: 7744, 2019, pp. 378–82, https://doi.org/10.1038/s41586-019-0941-9 .

Barry Buzan and Lene Hansen, The evolution of international security studies (Cambridge, UK: Cambridge University Press, 2009), pp. 60–65.

David L. Hull, Science as a process: an evolutionary account of the social and conceptual development of science (Chicago: University of Chicago Press, 1990).

C.A.S.E., ‘Critical approaches to security in Europe: a networked manifesto’, Security Dialogue 37: 4, 2006, pp. 443–87, https://doi.org/10.1177/0967010606073085 .

Johan S. G. Chu and James A. Evans, ‘Slowed canonical progress in large fields of science’, Proceedings of the National Academy of Sciences 118: 41, 2021, https://doi.org/10.1073/pnas.2021636118 ; Michael Park, Erin Leahey and Russell J. Funk, ‘Papers and patents are becoming less disruptive over time’, Nature 613: 7942, 2023, pp. 138–44, https://doi.org/10.1038/s41586-022-05543-x .

Delineating clear-cut phases of adoption, peak and decay poses challenges due to the limitations of the data and variations across different areas of study and geographical regions. However, indicative trends can be identified through our data analysis.

See for example Michael Desch, ‘Technique trumps relevance: the professionalization of political science and the marginalization of security studies’, Perspectives on Politics 13: 2, 2015, pp. 377–93, https://doi.org/10.1017/S1537592714004022 ; Stephen M. Walt, ‘Rigor or rigor mortis? Rational choice and security studies’, International Security 23: 4, 1999, pp. 5–48, https://doi.org/10.1162/isec.23.4.5 .

There are four possible modes of interrelations between research and policy according to Boswell and Smith: 1) research shapes policy; 2) policy and politics shape the production of research; 3) research and policy are mutually constitutive; 4) there is no direct causal relationship between research and policy. In this article, we only focus on the first mode. See Boswell and Smith, ‘Rethinking policy “impact”’.

The ranking is based on a widely used size-independent indicator of scientific journal prestige (SJR2 indicator). For a description see Vicente P. Guerrero-Bote and Félix Moya-Anegón, ‘A further step forward in measuring journals' scientific prestige: the SJR2 indicator’, Journal of Informetrics 6: 4, 2012, pp. 674–88, https://doi.org/10.1016/j.joi.2012.07.001 . The selection of 125 journals assures that we have relevant articles from key journals in our sample.

The analysis includes articles that were indexed by Scopus as ‘in press’ at the time of data collection (June 2023). These articles are typically already available online. Further, note the resulting list might not be complete. Scopus articles are occasionally indexed with a delay of multiple months after their publication. Therefore, for the year 2022, the corpus may not contain all articles that would in theory fulfil our search criteria. To the extent that it can be assumed that late indexing is random across articles and journals, this has no bearing on subsequent analysis.

The list of keywords was developed through an iterative and exploratory process, guided by inductive reasoning, to ensure the inclusion of the most relevant contributions. Articles included in this study are those that mention any of the following terms in the title or abstract (including all variations of spellings): ‘cyber conflict’, ‘cyberwar’, ‘cyber operation’, ‘offensive cyber’, ‘cyber weapon’, ‘cyber security’, ‘cyber attack’, ‘cyberspace’, ‘cyber deterrence’, ‘cyber terrorism’, ‘cyber coercion’, ‘computer network operation’, ‘computer network attack’, ‘computer network exploitation’, ‘cyber espionage’, ‘cyber threat’, ‘cyber revolution’ and ‘cyber offence’. We also included terms such as ‘information warfare’, ‘netwar’ and similar variations, but paid particular attention to manually exclude articles that primarily focus on disinformation, rather than the core concept of cyber conflict as conceptualized in this study.

The following are some examples of what we excluded: articles discussing the radicalization of Islamic State fighters on the internet; articles about right-wing populism in the online sphere; discussions on the concept of online citizenship; explorations of economic prosperity in cyberspace; and analyses of gender patterns observed on social media platforms. In our reading, these topics are not part of cyber conflict as we define it.

Given the disproportionately large number of articles from the Journal of Cybersecurity , we conducted a sensitivity test to our results by excluding the articles from this journal. There are a few very minor aspects that change (indicated in footnotes throughout the text); otherwise, the results are robust.

To conduct the text analysis, we either extracted the content of these articles from the HTML versions of the articles or, in instances where only PDF versions were available, manually transformed these PDFs into plain text files. The text files were manually cleaned prior to analysis where necessary, by removing e.g. the list of keywords, tables containing results of quantitative analysis or translated versions of abstracts.

Using the share of authors is preferable to counting the number of authors from different regions per paper, as the latter would result in giving more weight to articles with more authors.

As pointed out most prominently by Wæver, it is important to look at the people behind research to understand why certain topics emerge in certain places and not in others: Ole Wæver, ‘Towards a political sociology of security studies’, Security Dialogue 41: 6, 2010, pp. 649–58, https://doi.org/10.1177/0967010610388213 . While we do not do this in this article due to space limitations, it is an important follow-up project. Likewise, an article tracing networks of citations and publications that examines who cites whom would also add important facets to the analysis.

Jason Healey, ed., A fierce domain: conflict in cyberspace, 1986 to 2012 (Arlington, VA: Cyber Conflict Studies Association, 2013).

Waever, ‘Towards a political sociology of security studies’.

Dunn Cavelty and Wenger, ‘Cyber security meets security politics’.

Kim Zetter, Countdown to zero day: Stuxnet and the launch of the world's first digital weapon (New York: Crown, 2014).

For prominent examples see: Jon R. Lindsay, ‘Stuxnet and the limits of cyber warfare’, Security Studies 22: 3, 2013, pp. 365–404, https://doi.org/10.1080/09636412.2013.816122 ; Gary McGraw, ‘Cyber war is inevitable (unless we build security in)’, Journal of Strategic Studies 36: 1, 2013, pp. 109–19, http://doi.org/10.1080/01402390.2012.742013 ; Clare Stevens, ‘Assembling cybersecurity: the politics and materiality of technical malware reports and the case of Stuxnet’, Contemporary Security Policy 41: 1, 2020, pp. 129–52, https://doi.org/10.1080/13523260.2019.1675258 ; Rebecca Slayton, ‘What is the cyber offense-defense balance? Conceptions, causes, and assessment’, International Security 41: 3, 2017, pp. 72–109, https://doi.org/10.1162/ISEC_a_00267 .

Rain Ottis, ‘Analysis of the 2007 cyber attacks against Estonia from the information warfare perspective’, (Tallinn: Cooperative Cyber Defence Centre of Excellence, 2018), https://ccdcoe.org/uploads/2018/10/Ottis2008_AnalysisOf2007FromTheInformationWarfarePerspective.pdf . (Unless otherwise noted at point of citation, all URLs cited in this article were accessible on 13 Sept. 2024.)

Ronald Asmus, A little war that changed the world: Georgia, Russia and the future of the West (Basingstoke and New York: Palgrave Macmillan, 2010); Paulo Shakarian, ‘The 2008 Russian cyber campaign against Georgia’, Military Review , Nov./Dec. 2011, pp. 63–8.

David J. Betz and Tim Stevens, Cyberspace and the state: towards a strategy for cyber-power (Abingdon and New York: Routledge, 2011), p. 76.

The most cited article in the field is: Thomas Rid, ‘Cyber war will not take place’, Journal of Strategic Studies 35: 1, 2012, pp. 5–32, https://doi.org/10.1080/01402390.2011.608939 .

Lene Hansen and Helen Nissenbaum, ‘Digital disaster, cyber security, and the Copenhagen School’, International Studies Quarterly 53: 4, 2009, pp. 115–75, https://doi.org/10.1111/j.1468-2478.2009.00572.x ; Myriam Dunn Cavelty, ‘From cyber-bombs to political fallout: threat representations with an impact in the cyber-security discourse’, International Studies Review 15: 1, 2013, pp. 105–22, https://doi.org/10.1111/misr.12023 .

Jon R. Lindsay, ‘Tipping the scales: the attribution problem and the feasibility of deterrence against cyberattack’, Journal of Cybersecurity 1: 1, 2015, pp. 53–67; Uri Tor, ‘“Cumulative deterrence” as a new paradigm for cyber deterrence’, Journal of Strategic Studies 40: 1–2, 2017, pp. 92–117, https://doi.org/10.1080/01402390.2015.1115975 .

The year 2021 experienced a noticeable increase in the average mentions of deterrence, primarily attributed to an outlier article by Lupovici, which cited deterrence over 400 times, significantly distorting the analysis: Amir Lupovici, ‘The dog that did not bark, the dog that did bark, and the dog that should have barked: a methodology for cyber deterrence research’, International Studies Review 23: 4, 2021, pp. 1672–98, https://doi.org/10.1093/isr/viab032 .

Calculated using the average number of times keywords are mentioned in an article in each of the periods. There is no drop in ‘deterrence’ if we exclude the articles from the Journal of Cybersecurity ; all other trends stay the same.

For a comprehensive discussion of main ideas, see Michael P. Fischerkeller, Emily O. Goldman and Richard J. Harknett, Cyber persistence theory (New York: Oxford University Press, 2023). Also see Richard J. Harknett and Max Smeets, ‘Cyber campaigns and strategic outcomes’, Journal of Strategic Studies 45: 4, 2022, pp. 534–67, https://doi.org/10.1080/01402390.2020.1732354 .

There is a drop, instead of an increase, in ‘resilience’ if we exclude the article from the Journal of Cybersecurity , but an even more marked increase in governance and intelligence. The overall trends are robust.

Milton Mueller, Andreas Schmidt and Brenden Kuerbis, ‘Internet security and networked governance in international relations’, International Studies Review 15: 1, 2013, pp. 86–104, https://doi.org/10.1111/misr.12024 ; Chelsey Slack, ‘Wired yet disconnected: the governance of international cyber relations’, Global Policy 7: 1, 2016, pp. 69–78, https://doi.org/10.1111/1758-5899.12268 ; Tarun Chaudhary, Jenna Jordan, Michael Salomone and Phil Baxter, ‘Patchwork of confusion: the cybersecurity coordination problem’, Journal of Cybersecurity 4: 1, 2018, https://doi.org/10.1093/cybsec/tyy005 .

Joseph M. Brown and Tanisha M. Fazal, ‘#SorryNotSorry: why states neither confirm nor deny responsibility for cyber operations’, Journal of International Security 6: 4, 2021, pp. 401–17, https://doi.org/10.1017/eis.2021.18 ; Ilina Georgieva, ‘The unexpected norm-setters: intelligence agencies in cyberspace’, Contemporary Security Policy 41: 1, 2020, pp. 33–54, https://doi.org/10.1080/13523260.2019.1677389 ; Jon R. Lindsay, ‘Demystifying the quantum threat: infrastructure, institutions, and intelligence advantage’, Security Studies 29: 2, 2020, pp. 335–61, https://doi.org/10.1080/09636412.2020.1722853 .

Lennart Maschmeyer, ‘The subversive trilemma: why cyber operations fall short of expectations’, International Security 46: 2, 2021, pp. 51–90, https://doi.org/10.1162/isec_a_00418 ; Lennart Maschmeyer, ‘A new and better quiet option? Strategies of subversion and cyber conflict’, Journal of Strategic Studies 46: 3, 2023, pp. 570–94, https://doi.org/10.1080/01402390.2022.2104253 .

For example, Lindsay A. O'Rourke, Covert regime change: America's secret Cold War (Ithaca, NY: Cornell University Press, 2018); Austin Carson, Secret wars: covert conflict in international politics (Princeton: Princeton University Press, 2018).

For example, Jeppe T. Jacobsen, ‘Lacan in the US cyber defence: between public discourse and transgressive practice’, Review of International Studies 46: 5, 2020, pp. 613–31, https://doi.org/10.1017/S026021052000008X ; Stevens, ‘Assembling cybersecurity’; Tobias Liebetrau and Kristoffer Kjærgaard Christensen, ‘The ontological politics of cyber security: emerging agencies, actors, sites, and spaces’, European Journal of International Security 6: 1, 2021, pp. 25–43, https://doi.org/10.1017/eis.2020.10 ; James Shires, ‘Cyber-noir: cybersecurity and popular culture’, Contemporary Security Policy 41: 1, 2019, pp. 82–107, https://doi.org/10.1080/13523260.2019.1670006 .

The dotted line shows a simple three-year moving average. Years prior to 2012 are omitted as they only include zero or one paper per year, except for 1999.

Robert Kagan, ‘Power and weakness: why the United States and Europe see the world differently’, Policy Review , no. 113, 2002.

Ole Wæver and Barry Buzan, ‘After the return to theory: the past, present, and future of security studies’, in Alan Collins, ed., Contemporary security studies , 5th edn (Oxford: Oxford University Press, 2019).

Point estimate and 80 % confidence intervals shown. A separate linear regression was run for each topic. Prior to calculation, mention data was log-transformed to reduce the influence of outliers. Coefficient estimates are not intended to be interpreted substantially.

Not all associations are statistically significant at the 80% confidence level.

Point estimate and 80% confidence intervals shown. A separate linear regression was run for each topic. Prior to calculation, mention data was log-transformed to reduce the influence of outliers. Coefficient estimates are not intended to be interpreted substantially.

Also note that articles with an explicit normative angle are rare, but there are exceptions, for example Forrest B. Hare, ‘Precision cyber weapon systems: an important component of a responsible national security strategy?’, Contemporary Security Policy 40: 2, 2019, pp. 193–213, https://doi.org/10.1080/13523260.2018.1529369 .

Theory-testing studies (which are not explicit about their case-selection) tend to select most-likely rather than least-likely cases.

Jack S. Levy, ‘Case studies: types, designs, and logics of inference’, Conflict Management and Peace Science 25: 1, 2008, pp. 1–18, https://doi.org/10.1080/07388940701860318 .

Christopher Whyte, ‘Beyond tit-for-tat in cyberspace: political warfare and lateral sources of escalation’, European Journal of International Security 5: 2, 2020, pp. 195–214, https://doi.org/10.1017/eis.2020.2 .

Florian J. Egloff and Max Smeets, ‘Publicly attributing cyber attacks: a framework’, Journal of Strategic Studies 46: 3, 2021, pp. 502–33, https://doi.org/10.1080/01402390.2021.1895117 .

Mischa Hansel, ‘Cyber-attacks and psychological IR: explaining misperceptions and escalation risks’, Journal of International Relations and Development 21: 4, 2016, pp. 523–51, http://doi.org/10.1057/s41268-016-0075-8 .

It might not be surprising that many significant western Advanced Persistent Threats—such as Equation Group and the Mask—are uncovered by Kaspersky Lab, headquartered in Russia.

See also Lucas Kello, ‘The meaning of the cyber revolution: perils to theory and statecraft’, International Security 38: 2, 2013, pp. 7–40, https://doi.org/10.1162/ISEC_a_00138 .

James Shires, The politics of cybersecurity in the Middle East (New York: Oxford University Press, 2022).

Max Smeets, Ransom war: how cyber crime became a threat to national security (New York: Oxford University Press, forthcoming).

One notable exception is Shires, The politics of cybersecurity in the Middle East.

Articles using a mixed-methods approach (n=5) were counted as qualitative and quantitative with a score of .5 each, meaning each contributing half. Trend lines calculated with a locally weighted polynomial regression, a flexible method that fits a smooth curve to the data.

Brandon Valeriano and Ryan Maness, ‘The dynamics of cyber conflict between rival antagonists, 2001–11’, Journal of Peace Research 51: 3, 2014, pp. 347–60, https://doi.org/10.1177/0022343313518940 ; Nadiya Kostyuk and Yuri M. Zhukov, ‘Invisible digital front: can cyber attacks shape battlefield events?’, Journal of Conflict Resolution 63: 2, 2019, pp. 317–47, https://doi.org/10.1177/0022002717737138 .

Andy Greenberg, Sandworm: a new era of cyberwar and the hunt for the Kremlin's most dangerous hackers (New York: Doubleday, 2019).

Trenton D. Mize and Bianca Manago, ‘The past, present, and future of experimental methods in the social sciences’, Social Science Research , vol. 108, 2022, https://doi.org/10.1016/j.ssresearch.2022.102799 .

Miguel Alberto N. Gomez, ‘Sound the alarm! Updating beliefs and degradative cyber operations’, European Journal of International Security 4: 2, 2019, pp. 190–208, https://doi.org/10.1017/eis.2019.2 ; Miguel Alberto N. Gomez, ‘Past behavior and future judgements: seizing and freezing in response to cyber operations’, Journal of Cybersecurity 5: 1, 2019, https://doi.org/10.1093/cybsec/tyz012 .

Ryan Shandler, Michael L. Gross, Sophia Backhaus and Daphna Canetti, ‘Cyber terrorism and public support for retaliation—a multi-country survey experiment’, British Journal of Political Science 52: 2, 2022, pp. 850–68, https://doi.org/10.1017/S0007123420000812 ; Ryan Shandler, Michael L. Gross and Daphna Canetti, ‘A fragile public preference for cyber strikes: evidence from survey experiments in the United States, United Kingdom, and Israel’, Contemporary Security Policy 42: 2, 2021, pp. 135–62, https://doi.org/10.1080/13523260.2020.1868836 ; Sarah Kreps and Jacquelyn Schneider, ‘Escalation firebreaks in the cyber, conventional, and nuclear domains: moving beyond effects-based logics’, Journal of Cybersecurity 5: 1, 2019, https://doi.org/10.1093/cybsec/tyz007 .

A notable exception is Miguel Alberto Gomez and Christopher Whyte, ‘Breaking the myth of cyber doom: securitization and normalization of novel threats’, International Studies Quarterly 65: 4, 2021, pp. 1137–50, https://doi.org/10.1093/isq/sqab034 .

Author notes

Email alerts, citing articles via.

• X (formerly Twitter)
• Recommend to Your Librarian
• Advertising and Corporate Services

Affiliations

• Online ISSN 1468-2346
• Print ISSN 0020-5850
• Copyright © 2024 The Royal Institute of International Affairs
• About Oxford Academic
• Publish journals with us
• University press partners
• What we publish
• New features  
• Open access
• Institutional account management
• Rights and permissions
• Get help with access
• Accessibility
• Advertising
• Media enquiries
• Oxford University Press
• Oxford Languages
• University of Oxford

Oxford University Press is a department of the University of Oxford. It furthers the University's objective of excellence in research, scholarship, and education by publishing worldwide

• Copyright © 2024 Oxford University Press
• Cookie settings
• Cookie policy
• Privacy policy
• Legal notice

This Feature Is Available To Subscribers Only

Sign In or Create an Account

This PDF is available to Subscribers Only

For full access to this pdf, sign in to an existing account, or purchase an annual subscription.

Academia.edu no longer supports Internet Explorer.

To browse Academia.edu and the wider internet faster and more securely, please take a few seconds to  upgrade your browser .

•  We're Hiring!
•  Help Center

Cyber Terrorism

• Most Cited Papers
• Most Downloaded Papers
• Newest Papers
• Last »
• Cyber Warfare Follow Following
• Cyber Security Follow Following
• Cyber crime Follow Following
• Cybercrimes Follow Following
• Cybersecurity Follow Following
• Terrorism Follow Following
• Cyberlaw Follow Following
• Democracy and Cyber-Democracy Theory and Practice Follow Following
• Counter terrorism Follow Following
• Cyberspace Follow Following

Enter the email address you signed up with and we'll email you a reset link.

• Academia.edu Journals
•   We're Hiring!
•   Help Center
• Find new research papers in:
• Health Sciences
• Earth Sciences
• Cognitive Science
• Mathematics
• Computer Science
• Academia ©2024