Coping with Digital Extortion: An Experimental Study of Benefit Appeals and Normative Appeals

Abstract

Digital extortion has emerged as a significant threat to organizations that rely on information technologies for their operations. Using human subject experimentation, we study the effectiveness of message appeals in encouraging defenders to adopt two mitigation strategies, investment in security and refusal to pay ransoms, to digital extortion threats. We explore two types of appeals, benefit and normative, for this purpose. We find that the decisions of the defenders (representing any organization that can be a potential victim) deviate from the predictions of game theory. However, given the strategic interactions between the defenders and the attacker as well as noisy decision-making behaviors, it is challenging to untangle the influence of the appeals on the defenders. We develop a structural model based on the quantal response equilibrium framework to measure how message appeals change the defenders’ utilities of investment and payment refusal. Although the interventions may be successful in increasing the utilities of investment and/or payment refusal, their impacts on investment rate and payment rate are mitigated by the attacker reducing ransoms. Thus, it is challenging for an intervention to significantly boost a community’s investment rate or to suppress the ransom payment rate. We characterize how security outcomes of a community (including expected ransom, attack rate, investment rate, and payment rate) vary with the defenders’ utilities of investment and pay refusal. This paper was accepted by Chris Forman, information systems.