 A lot of the discussion here is always about the technical dynamics, the way in which systems are being attacked, but we don't often give as much attention perhaps as is necessary to that overlap between physical and virtual. So what we're going to do today is walk through some of that and actually touch on how those two areas might intersect and in what ways somebody who's going to attack a system online might also be willing to do something offline and what those kinds of relationships might mean. We think about the virtual environment as its own animal, but realistically speaking they could be entirely different. They could have some distinct drivers that are in common, they could have some very distinct differences, and so that's the point of today's talk. So to tell you a little bit about myself, I'm Tom Holt, I'm the first guy on the slide. I'm an associate professor at Michigan State University in the School of Criminal Justice. I do a lot of research on cyber crime and the social dynamics of the internet and how that affects criminal behavior, whether it's hacking, whether it's prostitution or something else. And so our interest, both Max and I, was in trying to understand a little bit more about what is going on in the context of physical attacks and cyber attacks. I'm just going to jump right into the first slide since a lot of this is relatively introductory anyway. When you think about the historical, at least within the last decade, range of attacks that we've seen, based on real world conflict spilling over into the virtual environment, the Danish cartoon attacks are an excellent example of this. Posting the image of the prophet with a bomb in his turban leads to mass defacement from a variety of different hacker communities, but with a specific emphasis on the Turkish community. You could go all the way back to the U.S. spy plane that crashed in China in 2001 and sparked that sort of brief hacktivist debate between Chinese attackers and American hackers, defacing one another's websites. Then we have Russia and Estonia, that conflict which began over the removal of a statue in a cemetery, leads to both boots on the ground kind of conflict and serious denial of service attacks, compromises, spamming, list goes on. Over the last year with the Arab Spring, where we've seen mass protests in the street, physical violence that's being taped, that's being posted, that's being reposted, that's organized in part through Facebook or Twitter or other kinds of social media. The intersection of the internet is really critical and we shouldn't just give short shrift to it. And then over the last few months, with the anonymous and lull sack attacks, how many of you have seen a lot about this week with Black Hat and everything else? Probably tons, this is probably old news, but it continuously occurs and they're getting a lot of press and they're getting a lot of attention from a variety of different outlets. When you have hacker groups like anonymous and the lull sack being discussed on the daily show, even though in jest, that really says something about the tenor of what is happening. So what we are interested in trying to understand is why there's this increasing emphasis placed on the cyber environment. The frequency of attacks is increasing, even just anecdotally. There are more resources being targeted in a variety of different ways. They might be simple attacks, they might be more serious, regardless. It seems as though there is a distinct change in the tenor of the attacks. In addition, just over the last decade, since we have so much connectivity globally, pretty much now the only parts of the world that aren't well connected appears to be Sub-Saharan Africa. Otherwise, both at the tips of Africa, there's high speed connectivity, there's good general ability to access information. As a result, the use of technology as a force multiplier and as a mechanism for civilian actors is increasingly important. And you could argue that it's forcing a shift in both policies at the nation state toward other nations, as well as toward prospective citizen attackers. Now, we've got the little Stuxnet picture up here to emphasize that point. Now, Stuxnet, nobody knows quite for sure who created it. There's lots of arguments about where it might have came from and who is responsible. But if nothing else, the fact that this kind of very targeted, weaponized malware that's out there that could be adapted by skilled actors suggests the cat is out of the bag. And how do we deal with it? How do we determine what might occur? When we think about technology in political conflict in general, we've got to look at it both as a mechanism of communication and as an attack vector. For communications, it's perfect. It's excellent for the citizen to use because you've got access to phones, you've got various kinds of connections for the internet, and you can do real-time communications. So getting a group together, having a flash mob, having the ability to organize, come together, and disband quickly is pivotal. These are cheap things to do. How many of you have a cell phone plan and how many of you carry more than one phone at any point in time? Anybody? Good. I used to have two myself. Carry around a lot of gear, a lot of equipment. How many of you have a tablet PC and a laptop? iPads? Whatever? Okay, there we go. The anonymity that's afforded by these devices is also important. You can find a variety of different ways to get online, whether you're using a proxy, whether you are going through a tour, whatever the case might be. You can find ways to access share information and get around. The lull sec Twitter feed is always interesting to read and somewhat unusual. When we think about technology, this is particularly true with the jihad movement, with a variety of different extremist groups, but this point should be emphasized also. Technology gives a voice to the marginalized group. It allows them to control the message and spin it in their own way. So you could think of the camera phone that's directly recording violence on the street and posting it to YouTube or other resources is going to put a message out. The fact that anonymous and lull sec can post their own messages and tweak how people take their point of view. Even in the last couple of years, we've seen the jihadi movement directly posting comments, videos, taking questions from the media, and then posting them online. So this is a vehicle to control how you are perceived or at least how you engage with the broader society. And then from the technological attack vector, it's a great resource. You can damage critical infrastructure or you can damage reputation by itself. If you think about Arizona being hacked, the infregard attack, the HB Gary attacks, all these things provide a mechanism to embarrass, if not cause harm. Some of you might have read a couple of weeks ago on the wired threat down, the fact that DHS is now concerned about a Stuxnet attack here in the United States, or at least a modification of Stux for some kind of attack. This is not expensive in order to obtain. If you read anything or heard anything about operation payback, which was early in 2010 and late 2009, where Anonymous was attacking both the business community and governments, the tool that you downloaded was absolutely free, very easy to use, and it just helped in denial of service. So it's not an expensive type of attack, but it can still be effective. So the anonymity that's provided, the attack capability, this is really, really critical. And as a consequence, we're arguing that this confluence of technology and society as a whole is enabling the development of the civilian cyber warrior, an individual who is both emboldened by all of these resources and sees the attack potential with technology and is using it as a mechanism to go after nation states, private industry, or whatever target they feel is deserving. That doesn't necessarily mean that these are lone wolf actors. They can be. They could be organized based around a philosophy. They could be working in tandem with a nation state, whether with tacit or other approval, or they could be totally opposed to what's going on in their own home country and decide that this is the time to act. Regardless, with the emergence of the cyber warrior, the civilian actor, it's not quite clear what drives this behavior. Why do some go online? And does the individual who's willing to act in a cyber environment have any relationship to what we might view as kind of the traditional protester or the individual who engages in civil disobedience? What's the relationship between these two things? So what I'm going to walk you through today are some findings from research we've been conducting. We've collected a sample of students from a Midwestern University, a large one at that, and we've got a mix of both U.S. citizens and foreign nationals. We're also working with some partners in different countries to develop samples based on their student populations. Right now we've got Italy, Russia, and Taiwan on board, so we're hoping to understand a little bit about different dynamics in different nations and understand what might drive someone in another country. We're still looking for potential collaborators. So if what I go through today sounds interesting and you might have the capability to help us with this research, please let me know. We'd be happy to have you on board. We're really excited about this project. We think it's a very interesting and innovative kind of thing. Our goal is to really get at this phenomenon in depth. So let me take you through what exactly we've set up. We've tried to understand four interrelated phenomena. Individuals who are willing to attack a country, specifically their home country in the physical world, whether they're willing to engage in cyber attacks against their home country, and whether they'd be willing to attack a foreign nation online or offline. So it creates this kind of four-celled table. The type of attack, the target of the attack. So a foreign nation or their home country. And in trying to get at these mechanisms, we've had to figure out a way that would get past perhaps national identity or individual biases against other countries. It's hard to survey a population of individuals and get past personal prejudices. So when I walk through a little bit about the foreign country example, I'll show you what I mean. So let me take each one of these in turn. We'll start with the physical attack against the homeland item. Here, on the right-hand side of the screen, you will see the percentages for individuals willing to engage in certain kinds of attacks. We provided a scenario. Imagine that the country that you most closely associate with your home country or homeland. Given the population of students we had are from a variety of different places, we wanted to make sure that we didn't specify a certain locale. Instead, what country are you from and where do you associate as your home country? Pretend that they've recently promoted national policies and taken physical actions that have had negative consequences to your home country. Caused hardships for the people in your home country. What would you do in order to take action against your home country in these policies? Choose as many as you want and within the scenario, assume you have the skills necessary to complete the act. So you can get the training, you can get the resources, whatever it is, how far would you be willing to go in support of your beliefs? As we go down the column in terms of severity, it's do nothing. Fair amount of people said I'd do nothing. Write a letter. So 70% almost said this. Participate in a protest. Protest at your country's home capital. Confront one of your senior government officials about their policies. You still have a fair proportion of people who do that. Sneak into a military base to write slogans on buildings or vehicles. A relatively small proportion here agreed with that. Physically damage an electrical power substation in your country. Less than 2%. And then damage a government building in your home country with an explosive device. So we only had three say that. So kind of a good news, bad news thing. Not too many are willing to go to extreme lengths. On the bad news side, you really only need one or two people who are willing to go to this length to actually cause some trouble. So this is the physical scale. We use the same scenario to assess physical damage to a foreign nation. Let me walk you through the cyber end of things. So it's the same scenario. Assume that you have the necessary skills to carry out any action below. We start with do nothing. Then post a comment on a social networking site like Facebook or Twitter. 77% were willing to do so. Deface the personal website of a government official for your home country. Only 13%. Deface an important government website. 12%. Compromise the servers of a bank to withdraw money to give to victims of government policies or actions. Only 15%. Search your home country's government servers for secret papers that you might be able to use to embarrass the government. Around 10%. Compromise one or more of your home country's military servers to affect military readiness. So less than 5%. And then these last two are particularly severe. Compromise the power grid to cause a blackout, less than 2%. Or compromise a nuclear power plant system to cause a small release of radio activity. So we only have three here. Again, good news, bad news. Not too many engaging in the most severe types of attacks, but they're still there. So taking both of these examples, we then move on to the foreign question. Now in order to assess without any bias, a foreign nation, we developed a fictitious country called Bulgaria. As a means of providing a non-attribution country that no one has any particular bias against. If you're from China, if you're from Russia, if you're from the United States, just pretend that a foreign country has done something to your homeland. As a consequence, what would you be willing to do? And what do you think would be appropriate for you to do against Bulgaria, based on the physical scenarios? So it's the same activities only against this fictitious country of Bulgaria. So the proportions are about the same. We have a number of people who are willing to write letters, engage in protests, travel to engage in protests, a small proportion, engage in some kind of physical conflict, and a very small number who are willing to travel in support of physical violence against that country. And then we use the same scenario for cyber attack. And the distribution is somewhat similar to the homeland issue. Many people are willing to post a comment publicly on Facebook or Twitter. Some are willing to engage into facements. Server compromises are acceptable to a certain proportion. And the compromising military servers causing harm against power structures and otherwise a small percentage. So if we take this for what it is, this is telling us that a very limited number of individuals, regardless of skill or capacity, are willing to engage in extreme acts of violence. But what we might consider as kind of common forms of protest, a more healthy proportion of people are willing to do this. When we took these items and ran some cross tabs, we didn't find a lot of difference between the geographic actors. So whether you are a U.S. citizen or a foreign national, there were no significant differences between the two. But on gender, we separated this by male and female. And it seems as though males are a little more likely to travel for protest and confront government officials, at least on the physical side of things. On web defacement and server compromises, again this is a little bit more heavily skewed towards men. This fits to a certain degree with what we know about the general demographic composition of the hacker community. If we think about cyber attacks as perhaps an extension of hacker capabilities, this is a somewhat interesting relationship and one that we might expect to see. Moving from the general basic demographics, we've tried to figure out ways to predict who's going to engage in these kinds of attacks based on certain criteria. So I'm going to walk you through some regression analyses through the statistical models that we've created. But first, I want to give you a sense of the measures that we used. We tried to create a variety of different independent variables based on emotional national identity. How much do you attach yourself to your national identity? Your belief in equality for groups. Antagonism towards outgroups to groups who are different from you. The level of nationalistic ethnocentrism, so something akin to national pride or willingness to engage in violence based on your nation. The willingness to engage in either physical or cyber attacks. So taking our cyber items, we want to see if there's any correlation with physical attacks. And vice versa. So we have country of origin. Willingness to engage in software and media piracy. Given the prominence of the anonymous and the lull sec attacks, we wanted to see if there's any relationship at all between piracy and acts of civil disobedience or protest or otherwise. We had some other items for different types of computer crime, but they weren't very correlated. They didn't really show any kind of relationship. The level of technical skill that a person has, and finally demographics based on age and gender. So here's the national identity scale. I'm proud to be a citizen of my home country. I'm emotionally attached to my home country and I'm emotionally affected by its actions. Although at times I may not agree with the government, my commitment to my home country remains strong. I feel a great pride in the land that is my home country. When I see my home country's flying, I feel great. And the fact that I am a citizen of my home country is an important part of my identity. So this was a Likert-scaled item, ranging from one to four. Strongly disagree to strongly agree. The more someone agrees with these statements, the more they have a very high emotive national identity. And we adapted a lot of these items from political science and from military science research on willingness to support military action in general. Belief in group equality. Again, the more heavily skewed towards agree, the more you believe in group equality. Group equality should be our ideal. All groups should be given an equal chance in life. We should do what we can to equalize conditions for different groups. We'd have fewer problems if we treated people more equally. We should strive to make income as equal as possible. And finally, no group should dominate in society. Out-group antagonism. Some groups of, pardon me, sorry. Some groups of people are simply inferior to other groups. If certain groups stayed in their place, we'd have fewer problems. It's probably a good thing that certain groups are at the bottom and other groups are at the top. Inferior groups should stay in their place and sometimes other groups must be kept in their place. So those who are more supportive of out-group antagonism, so this is again scaled towards agree, the more hire their overall willingness to engage in perhaps attacks. Nationalistic ethnocentricity. Other countries should try to make their governments as much like my home country's government as is possible. Generally, the more influence my home country has on other nations, the better off they are. And then finally, foreign nations have done some very fine things, but my home country does things in the best way of all. Now this is actually a measure adapted from some research in political science that included some measures related to performance in the Olympics or in multinational sporting events. We didn't include them here and instead wanted to try to just create as brief a scale as is possible. On the attack side, we have the maximum form of attack an individual is willing to perform against either their home country or Bulgaria. So how far would you go in the context of an attack? We've used this as a correlate to understand if this predicts any form of attack in general. For a country of origin, being a U.S. citizen or a foreign national, within this sample, our foreign nationals comprise about 10% of the overall sample. And this includes students from China, Russia, the Middle East, including Iran and a few other nations. And then finally, participation in piracy. This was how many times in the last 12 months have you knowingly downloaded, used or made copies of software or media? So media being television, music or movies. And this might be of interest, the computer skill item. We included a battery of questions related to how they use technology, what kinds of things they can and can't do with computers, and used these three items to create kind of an advanced skill factor. Can you use an operating system like Unix or Linux? Can you use a standard computer programming or scripting language? And have you ever installed an operating system like Unix or Linux? That way we get those who might have a slightly higher skill set relative to others. And then age and gender. So taking these items, we tried to develop a model to predict the most extreme act that an individual would engage in. So what predicts the most severe attack against their homeland in a physical context? What was significant is cyber skill. So how much computer technology skill do you have? The more skilled the actor, the more willing they were to engage in an extreme form of physical protest. Homeland support, what nation are they from was also related. Willingness to perform a cyber attack, this was a positive relationship. So if you were going to engage in a physical act, you're also likely to engage in a very serious type of cyber attack. Pirating software or media was also significant. So the more they engaged in piracy, the more likely they are to engage in a physical attack, which is kind of interesting. We weren't expecting to find this. And then outgroup antagonism. This was actually a negative relationship. So those with minimal outgroup aggression were more likely to engage in some kind of protest. So this is somewhat interesting. Perhaps there's maybe an activism effect at play. Someone who feels there should be generally little aggression towards other groups and who feels as though cyber and physical attacks are related. When we used this model to predict cyber attacks against the homeland, we found some of the same relationships. And emotive national identity was relatively significant, but it's negative. So those who have a minimal emotional attachment to their home country are willing to engage in cyber attack, which we didn't find in the physical model. U.S. citizens were more likely to engage in cyber attack. Willingness to perform a physical attack was highly related here. So there's a significant correlation between these two acts. And then the pirating software or media was again significant. So we're seeing piracy as a somewhat significant predictor. These homeland models worked really well. There's a problem though. We couldn't get the Bulgarian attack models to work at all. Nothing was significant in terms of predicting the most severe type of attack. It could be that we're missing some important predictors that the items that we have just are not correct. It might be alternatively that it's no specific predictor. So let me walk you through a few other models that we tried to develop to get at this issue. We created a dummy variable for multiple attacks. Would you only do one thing or would you be willing to engage in multiple attacks? And with this we actually found some of the same relationships on the physical end of things engaging in an attack against your homeland. Those who believe in group equality were more likely to engage in multiple forms of physical attack against their homeland. For out group antagonism this is again negative. So those with minimal aggression towards out groups or towards groups that do not resemble them were more likely to engage in physical acts. The homeland variable is significant so U.S. citizens were more likely to do this and then finally cyber attack was also significant. Now given that the U.S. is coming up as a somewhat important predictor here perhaps it has something to do with the perspective of free speech with political expression here in this country. We're not quite sure if this is something distinctive or other ones. On the cyber end of things the homeland issue drops out as does out group aggression but negative emotional national identity is still significant so those who have minimal attachments to their home country are more likely to engage in multiple forms of cyber attack. Piracy is again significant as is a willingness to engage in physical attacks. What's interesting is that we were finally able to get the Bulgarian models to work so this foreign attack finally hung together on the physical end of things out group antagonism is again negative. So the less extreme you feel about out groups the more likely you are to engage in multiple attacks. The cyber attack variable is significant too. On cyber attacks themselves against Bulgaria only two things mattered a willingness to engage in physical attacks and group equality but here we're seeing a negative relationship so those who feel that group equality is not important that we should actually have some kind of apportioning of groups within any given community is significant and this is somewhat different than what we were expecting to find. Now based on this we've just looked at severity and we've looked at multiple types of attacks so we wanted to see what happens with each specific form of behavior and given that the distributions are a little funky we had to only include certain items because otherwise we couldn't get the models to work they're just was not statistical power. So here the signs are a reflection of positive or negative relationships and we have the odds ratio below as well as it's probably hard to see but these little dashes are significance for each variable. So you can see that doing something individuals who are willing to do something on behalf of their nation this is mostly negative. Cyber attacks don't appear to matter for some reason when it comes to doing any type of activity but it is completely important for writing a letter engaging in physical protest traveling to engage in a protest and confronting a government official. These are extremely significant variables and the same with advanced skills so the more skill an individual has the more likely they are to engage in physical attacks. Out-group antagonism is negative here across multiple forms and group equality is only significant when it comes to writing a letter. The other variables are not included here because they were non-significant. In terms of cyber attacks against the homeland we see physical attacks as again being highly significant predictors and the same with piracy. Emotive national identity is also relatively low so it seems as though individuals with minimal attachment to their home country are more likely to engage in cyber attacks. Group equality is only significant for doing something and posting a message on Facebook and it's again negative in a slightly different direction than what we would have expected. On the physical end of things with regard to cyber attack against Bulgaria this was again a very highly related very positive relationship. Age was significant for doing something so the older you are the more likely you are willing to do something against a foreign nation. Out-group antagonism was significant for only writing a letter and participating in a protest and then when it comes to cyber attacks there were only three significant predictors out of all those independent variables. Piracy and engaging in a physical attack predicted web defasements and bank server compromises and posting a message on Facebook relates to group equality as a somewhat significant predictor. So using these different models it seems as though the physical attacks highly significant piracy matters and in general we find very minimal influence of what we might refer to as ethnocentric beliefs. Demographic predictors are not necessarily strong. Gender doesn't seem to matter age doesn't seem to necessarily matter. The relationship between technological skill and the attack type we thought was relatively interesting also given that it's tied to physical attacks overall. Maybe it's something to do with general involvement in technology we might think of the hacker culture as being to a certain degree kind of counterculture this belief in information being free and otherwise maybe that says some influence. The fact that it doesn't matter when it comes to either domestic or foreign cyber attack though is different than what we might have otherwise expected perhaps it's a suggestion that in a virtual environment attackers are willing to do whatever they can regardless of overall skill. In terms of the physical and cyber attack relationship it seems like these two spaces really converge if you're willing to do something in one domain you're probably going to be willing to do it in the other. The piracy relationship was also relatively important noting it both for cyber attack and to a certain degree for physical attacks. This could be some kind of a general reflection maybe of ethical attitudes toward behavior on and offline. Willingness to pirate materials might be some kind of a larger reflection of how you feel about legal strictures the notion of copyright and ownership this is still something we're trying to figure out but it's important to note that this is something that appears to be at play. The significance of being a U.S. citizen also is key this could be just a consequence of the larger sample of U.S. citizens overall but it could be again a reflection of how we perceive the ability to talk about our government and deal with different dynamics and the out group antagonism item for physical attacks and to a certain degree cyber attacks is also very interesting perhaps those who have more sympathy towards others are willing to engage in attacks that they feel are supportive of the entire country or the entire nation not marginalizing one group over another. Group equality also seems to be important those who are less supportive of the group appear more willing to engage in certain kinds of attacks and emotive national identity being low suggests that if you don't really care or have a strong attachment to whatever it is that your nation stands for the more willing you are to act against it because you believe they're doing something wrong or otherwise. If we're to try to take away a general model from this relatively exploratory research we might say that a person who's willing to engage in attacks on or offline believes in social quality has minimal attachments to their homeland engages in different types of piracy and is willing to attack both on and offline but we don't know how stable this is across place or across time and so that's why we are trying to go out and get different samples together as we're putting more and more of this research together we'd like to have as international sample as is possible to get some of these additional variations to understand more of what might be going on. So our relationships with other universities we're trying to build that up to do what we can. We're also trying to be as inclusive as is possible we would love to get some individuals from Middle Eastern nations involved from Africa from different parts of Europe as well. If you know anyone if you find any of this interesting please let us know. In general I'm going to open it up to questions and I thank you all for coming I realize it's very early so fire away. Thank you. Good. The question is age appeared to matter for different kinds of attacks in one circumstance that the older they were the more likely they were to engage in attacks. No we did not bound age by any specific category instead it's just a reflection of the age of the student population as a whole. At the high end we I think it was around 35 but we only have a small number of individuals who are in that age category and this sample includes both undergraduate and graduate students so we get a smattering of people of different age groups. Yes man. Sure the question is are we going to try to be more inclusive with regard to age? If possible we'd like to but just given the general nature of university samples it's hard to get past a certain age bracket and it might also be kind of a sampling bias some people might be if they're working full time they might be less inclined to do a survey like this but yes if we could we'd like to. Yes sir. So the question is you looked at a skill but could it also be something related to anonymity might that be important? It certainly could be we have some other items that are included relating to how they perceive virtual environments but we didn't include them in here instead we thought let's see if any of these sort of political science items might matter since only a few of them are significant it's possible they might so we are going to include these in our further analyses. Yes sir. So the question is we looked at this general perspective of what social group do you belong to? It's possible that being affiliated with or perceiving yourself as a minority group or attached to some other type of small group within a larger population might matter. We don't have that in our initial survey we do have an item for what nation are you from we didn't want to include religion or some other potential hot button issues that might turn someone off from completing it but it's possible that it might and that is something that we definitely will think about including in further survey. Sure that that's very possible that that might matter. Yes ma'am. Absolutely it certainly might the question is does regionality perhaps bound the sample and it might and what we can say is that to a certain degree this is representative of larger midwestern states but yeah it might matter with regard to northeast or west or otherwise. So if we could get some other universities cross country could work. Yes sir. So the question is how do we capture the lone wolf perhaps paranoid actor who suddenly finds an issue and acts on it so sort of in a physical context the Timothy McVeigh's of the world. Not necessarily I don't know that we could find that but it is a question that if we could find a way to address it it would be helpful. I don't know of any ways to do it right off the top of my head but it's possible that there could be some way to get that. Any other questions. I know there were still some hands up. Yes sir. The willingness to engage in attacks in support of another group is that just perhaps part and parcel of being in a college campus maybe just the the general dynamic of being within this age group. It's possible it's hard to say though whether this is just a representation of U.S. college students as a whole. I don't know if we can find other ways to get at this hopefully we can find ways to answer it with the Italian the Russian and the Taiwanese samples we're hoping that that might get at that a little bit more with different regional and national contexts perhaps there are some differences. Yes sir. So if I heard correctly the your point is with regard to policies and how that might affect behavior. Gotcha. Yeah so perhaps the the way that we've operationalized the scenario in terms of some country whether it's your home country another one is using policies that affect the group without specifying policy maybe we're missing some intrinsic motivation that could be important. That certainly could be we've tried to figure out a variety of different ways to capture how we would strategize measuring attack and we didn't want to get too specific in terms of using physical violence against the population or economic sanctions or otherwise. We tried to make it as as kind of nondescript as as possible so that way unfortunately you're right we might be missing some motivation perhaps in a in the context of either an invasion scenario or a repressive regime. It might be a different dynamic it is certainly possible but it's hard to tease out those specific items. Yes are you on the way back. Can you say that again really loud I think I heard you. Are there any causal relationships thus far. So far we can only say that based on these analyses the description that I have here seems to best capture it with these correlates in general the social quality items being significant the emotional attachment to your homeland being significant whether that is truly causal or not I can't say but these appear to be strong correlations for different types of attacks most extreme types of attacks and willingness to engage in multiple attacks. Yes man it's a very good question if we thought about trying to expand it. Yes we have. It's somewhat hard to do if for no other reason than having tried to collect surveys at hacker conferences and things like that before it it can be something of a challenge but yeah we'd love to find a way to access larger populations. We did this as kind of a startup within both of our institutions as a means of seeing if if any of these items would even work and now that they appear to have some salience that's why we're trying to take it international and if we could do something whether telephone or physical conferences or otherwise we'd absolutely love to. And you make a good point perhaps this kind of bounding of a group might have we might find different results with a larger sample. Yes sir. Sure so the first point relates to anonymity maybe that does have some influence here you're absolutely right. The second point is how we are perceived might affect the responses that we get. There is truth to that that's why when we administered the survey we sent it out to a 25 percent stratified sample of the university we offered no kind of payment for participation or otherwise and just clearly elaborated the purpose of the study and our role as researchers within the institution. This was not funded by any particular group or otherwise so we were as transparent as is possible about our motives for conducting the survey. You're right that individual respondents might have their own kind of ideas about this. When I tell people I work in a school of criminal justice that immediately sets off certain bells for some people. So you're right this might influence some of the results. In general however I think this gives us at least an initial window into trying to explain some of this phenomena or identify relevant questions. So though certainly different factors might affect the individual respondent I think this gives us a starting point if nothing else to begin a dialogue about who's going to engage in certain forms of attack. Are there any other questions? Yes sir. Can you say that really loud? I heard something about punishment but good. So the question is did we factor in anything about being caught the potential for harm by government or by some sort of law enforcement agency? No we did not. When we've surveyed students in the past about their perceptions of different types of punishments and the deterrent effect of different punishments it appears to be relatively ineffectual. There's been a variety of different social science studies looking at computer attack and the only time that deterrence has any kind of influence at all appears to be with regard to software piracy by university sanctioned groups but less so from law enforcement and otherwise. So we didn't include those items because we thought we weren't going to get much bang for our kind of instrumental buck but it is something that could matter particularly in other nations where there might be more oppressive or authoritarian kinds of sanctions so certainly it might matter as we branch out into other nations we're going to look at this issue with some depth. There was question over here? Yeah. Was personal or family economic concerns built into this? We did include items for employment. There was are you full time part time unemployed? We didn't include anything about their actual sort of income level but just looking at employment as a measure it was non significant across some of these models so we threw it out so it doesn't appear to matter but it might in some of the other nations that we're looking at so that is something to keep in mind. Yes sir. We did not control for degree program although that is something that we're going to do when we look at some of the other nations particularly because we're working with people in computer science and social sciences. We didn't include it because it hasn't necessarily been a significant predictor aside from early studies of computer crime with regard to being in an IT program appears to be a more significant predictor but it is something that we're going to include later. Yes sir. Yes we do have some validity instruments they can be provided if you're interested in seeing them. In particular the emotive national identity outgroup antagonism and group of quality items were taken from relatively heavily tested research so they have some validity already in the empirical literature so we'd like to say that these are stable. The cybercrime measures that we've included are from different studies within criminal justice and criminology and they have pretty high validity as well. Any other questions? Yes man. Oh okay. Did we measure anything with regard to encouraging others to take action so kind of spurring activity by others. Not necessarily if you wanted to think of it that way perhaps the posting on Facebook or Twitter might be something of an enticement to others or an inducement but not directly spurring action by others. No we didn't include that. We kind of debated back and forth about including things like engaging in denial of service attacks or explicit types of attack but did not include them just for fear about how individuals might perceive it. We included as some control measures have you ever created malicious software have you ever used it but the proportion of respondents who said yes was so low that they provide relatively little in terms of explanatory power but the enticement question is something that we should definitely look into. Any other questions? No? Well good thank you all for coming I hope it was interesting feel free to shoot us some emails if you need anything.