Chapter 3 - Research Method

Chapter 3: Research Method

Chapter 3: Research Method

Introduction

The purpose of this qualitative study was to explore the perceptions of terrorism and cybersecurity experts to understand how the United States might better prevent and respond to large-scale cyberterrorism attacks. A major successful cyberterrorism attack has never been conducted against the United States so it remains unseen what guidelines the country will use as the basis for a response. The current lack of guidance could leave the United States in a vulnerable position following a successful large-scale cyberterrorism attack given the unpredictability of potential responses. Through expert interviews, I addressed whether current policies were adequate to respond to large-scale cyberterrorism attacks, or if additional cyberterrorism specific policies should be created to ensure preemptive and palatable options. In Chapter 3, I discuss the research design of the study, the rationale for the design, and the role of the researcher. I also explain the study’s methodology including participant selection, instrumentation, and data collection and analysis. I finally discuss issues of trustworthiness and ethical procedures.

Research Design and Rationale

Research Question: How do terrorism and cybersecurity experts perceive that the United States might better prevent, cope with, and respond to large-scale cyberterrorism attacks?

I chose a qualitative research design for this study. Creswell (2013) explained that qualitative research is used to explore a problem through variables identified as a result of direct communication with participants. The focus of this qualitative study was the exploration of the perceptions of U.S. terrorism and cybersecurity experts to better understand how the country might better prevent and respond to large-scale cyberterrorism attacks. The rationale for this approach was to give these experts latitude to describe in their own words the applicability of better deterrence and response guidelines for a large-scale cyberterrorism attack. I therefore collected data through semistructured one-on-one telephone interviews. I asked open-ended questions in the same order to all participants with the addition of follow-up and probing questions as required to insure full answers to all questions.

Role of the Researcher

As the researcher, I was involved in all aspects of this study. I initially identified the area of study based on my personal interests and determined that a gap in literature existed through an exhaustive literature search. I then identified the study’s topic, conducted a literature review to incorporate all known information on the topic, and purposefully selected knowledgeable participants with whom I had no previous affiliations. It was paramount that I identified potential biases and remained cognizant of them throughout all aspects of the study to uphold the integrity of the research.

I was the sole instrument in the qualitative data collection process. I collected data from in-depth, semistructured telephone interviews which I organized, analyzed, and interpreted. Interview participation was voluntary, and I posed interview questions in a neutral manner as part of an unbiased interview process. I had no personal or professional affiliations with any participants, but I have lived the effects of 9/11 as a military member for 15 years and therefore used bracketing strategies to address any inherent biases gained through previous military experiences as well as to suspend any personal views acquired through the literature review and data collection. I lastly complied with all guidelines outlined in Walden University’s Institutional Review Board (IRB) for ethical research.

Methodology

Participant Selection

After IRB approval, I sent prospective participants study invitations through individual e-mail or LinkedIn messages explaining the study and selection criteria. Participants in this study are experts in their respective government, security, or educational career fields. Targeted participants demonstrated familiarity in the study’s topic by previously relating their expertise to aspects of cyberterrorism. For the purposes of this study, I defined an expert as an individual who has worked professionally in two or all three cyber, terrorism, and national security career fields within the federal government for at least 10 years since 2001. The timespan justification was to ensure that participants had been active in their respective occupations since 9/11 and had practiced their profession over the course of at least two presidencies.

I identified 89 potential participants meeting expert criteria from a multitude of professions including government officials, professors, lawyers, cybersecurity members, and scholars to align with the research question’s focus on the perception of experts. Of these participants, 79% have federal government work experience, 58% hold doctoral degrees, and 61% and 45% are cyber and terrorism professionals, respectively. I did not identify participants by name in this study and I also did not include individual names in transcripts of recorded interviews. I received positive responses from nine participants. Themes began to emerge after the first three interviews and data saturation was firmly established after the completion of the ninth and final interview.

Instrumentation

The instrument for this study was a one-on-one semistructured telephone interview. I chose semistructured interviews to allow leeway for script diversions for clarifications or to grasp deeper meanings to answers. I pilot-tested interview questions with three volunteer peers familiar with aspects of cyberterrorism before conducting interviews with actual participants. I recruited volunteers from friends and co-workers who were familiar with the study’s topic. I refined my interview questions and delivery through the pilot study. Each interview, while not identical, followed the interview protocol in Appendix A which includes the interview questions in Appendix B. I asked follow-up questions for any clarifications and to probe for a deeper understanding of participant responses. The interviews took between approximately 20 to 60 minutes to complete and averaged 38 minutes each. No follow-up procedures or follow-on interviews with the participants were required.

Procedures for Data Collection

I collected data from nine experts over a 6-week interview period from August 27 to October 3, 2020. Before beginning each interview, I established rapport with the participant by introducing myself, discussing my background, explaining the goals and objectives of the study, and clarifying that all shared information would remain confidential. The participants all agreed to an informed consent which was confirmed in the interview protocol before each interview. Audio interview recordings were transcribed to Microsoft Word and compared for accuracy. I then sent the transcribed recordings to the participants to confirm the accuracy and to allow them to make changes or add additional comments. The audio recordings were deleted after each participant approved their transcription. Finally, I sent an Executive Study to each participant after completion of the study along with a personalized thank you message before ceasing communication.

Data Analysis Plan

Qualitative analysis converts data into findings after making sense of the large quantity of data (Patton, 2015). Data analysis began after each transcript was reviewed and returned by the participant, or after one week of no response. I linked the data collected from the interviews to the research question and theoretical framework using the qualitative data analysis software NVivo to identify patterns and themes.

The qualitative NVivo program is used to classify, sort, arrange, and compare data. Using NVivo, I coded the interview data through predetermined codes and emerging codes in order to extract ideas and categories for comparison and analysis. I then exhaustively study all coded NVivo data to interpret categories and themes in order to draw conclusions.

Data analysis ran concurrently with data collection during first-cycle coding to complement the predetermined codes formed through the literature review. A robust data management plan ensured that data were not mismanaged through proper organization and storage. I initially hand coded the interview data to gain a deeper understanding of the data as well as to identify predetermined codes and conceptualize emerging codes. I then used NVivo to extract emergent codes and finally formulated all collected data into themes at the completion of second-cycle coding to complete data aggregation.

Issues of Trustworthiness

I interacted with all study participants in accordance with IRB guidelines. I obtained IRB permission to conduct research before data collection began. I handled the data purposefully throughout the data collection process. I used a transcription service called TranscribeMe to transpose audio recordings into verbatim Microsoft Word documents which I then compared to the audio recordings for accuracy. All TranscribeMe employees sign non-disclosure agreements to keep transcribed data confidential. I deleted audio recordings after the participants approved the transcripts, and I secured printed transcripts in a personal safe until the completion of the study after which I destroyed them. Lastly, electronic copies of transcripts and data will be kept on a password protected hard drive in a safe for five years before also being destroyed.

Ethical Procedures

I treated all participants with the upmost respect. I initially contacted participants through e-mail or LinkedIn messages and conducted all subsequent contact through private phone conversations or personal e-mail correspondence. I ensured participants agreed to an informed consent before conducting each interview. The consent form explained that participation was voluntary and could be stopped at any time. The form also explained the reasoning for the study and the methods used throughout the study. It lastly stated that personal information of each participant would be kept confidential.

Summary

This chapter presented the research design for a qualitative study on the applicability of improved deterrence and response guidelines for a large-scale cyberterrorism attack. I served as the primary research instrument and gathered data through semistructured telephone interviews. Nine participants were interviewed over a 6-week period. I extracted data from interview transcripts and subsequently coded and analyzed the data to draw conclusions using NVivo software. I took thorough care to ensure participants remained anonymous by properly securing data, and that all ethical standards were followed in accordance with IRB guidelines. I present the findings of this research in Chapter 4.