Coping with Digital Extortion: An Experimental Study of Benefit Appeals and Normative Appeals

Kay-Yut Chen (), Jingguo Wang () and Yan Lang ()
Additional contact information
Kay-Yut Chen: Information Systems and Operations Management, University of Texas at Arlington, Arlington, Texas 76019
Jingguo Wang: Information Systems and Operations Management, University of Texas at Arlington, Arlington, Texas 76019
Yan Lang: Information Systems and Operations Management, University of Texas at Arlington, Arlington, Texas 76019

Management Science, 2022, vol. 68, issue 7, 5269-5286

Abstract: Digital extortion has emerged as a significant threat to organizations that rely on information technologies for their operations. Using human subject experimentation, we study the effectiveness of message appeals in encouraging defenders to adopt two mitigation strategies, investment in security and refusal to pay ransoms, to digital extortion threats. We explore two types of appeals, benefit and normative, for this purpose. We find that the decisions of the defenders (representing any organization that can be a potential victim) deviate from the predictions of game theory. However, given the strategic interactions between the defenders and the attacker as well as noisy decision-making behaviors, it is challenging to untangle the influence of the appeals on the defenders. We develop a structural model based on the quantal response equilibrium framework to measure how message appeals change the defenders’ utilities of investment and payment refusal. Although the interventions may be successful in increasing the utilities of investment and/or payment refusal, their impacts on investment rate and payment rate are mitigated by the attacker reducing ransoms. Thus, it is challenging for an intervention to significantly boost a community’s investment rate or to suppress the ransom payment rate. We characterize how security outcomes of a community (including expected ransom, attack rate, investment rate, and payment rate) vary with the defenders’ utilities of investment and pay refusal.

Keywords: information security; behavioral economics and experimental economics; game theory; quantal response equilibrium; benefit appeals; normative appeals; descriptive norms; ransomware (search for similar items in EconPapers)
Date: 2022
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
http://dx.doi.org/10.1287/mnsc.2021.4154 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:inm:ormnsc:v:68:y:2022:i:7:p:5269-5286

Access Statistics for this article

More articles in Management Science from INFORMS Contact information at EDIRC.
Bibliographic data for series maintained by Chris Asher ().