Valuation of confidentiality and availability in a personal ransomware attack scenario

Abstract To understand what is more valuable, availability or confidentiality of the data on a private computer, we conducted an online survey experiment with over 800 German participants assigned to one of the two scenarios: ransomware demanding payment for availability versus for confidentiality of their data. Half of the participants was recruited at the platform Clickworker, and another half was recruited at various German universities. We find that 43.7% of respondents would pay for availability, whereas 38.6% would pay for confidentiality, this difference being not statistically significant and independent of the sample. The median of non-zero payments for Availability is 50 EUR in both samples, whereas for Confidentiality, Clickworkers were willing to pay median 30 EUR, and the University sample median 100 EUR. The probability of paying for young and elderly people is higher than for middle-aged ones, whereas sex, marital status and having children has no influence. Good backup quality and low income predict refusal to pay for availability, but not for confidentiality. In both scenarios, belief that the offenders will keep their promise and feeling scared predict payment, whereas belief that the payment is immoral and feeling strong negative emotions predict refusal to pay. Once the person decided to pay, the high emotional value of their files, as well as high social media usage predict higher payment value.