Enhancing the construction of attacker personas in cybersecurity software designs using case law-based facts: a study on the intersection between jurisprudence and technology.

Thwarting potential attackers is always at the heart of cybersecurity software designs. This study in computing science and law investigates the possibility of building attacker personas through reliance on case law-based facts. To combat the threat of cybercrime, software engineers, cybersecurity professionals, and law enforcement agencies across the globe are turning to attacker profiling. A persona is a model created from archetypal user behaviour, and it identifies patterns and common traits of users using data. By creating personas for both attackers and victims of cybercrime, software engineers can identify the types of people or organisations likely to be cybercriminals and those likely to be targeted for abuse. Similarly, in law, attacker and victim profiles provide specific characteristics of an attacker or victim. Facts compiled by trial courts in case law, on which judges apply legal principles to make decisions, might also serve as data for building personas. Accordingly, the study aims to assess whether and to what extent case–law–based facts can support the creation of an attacker persona. To illustrate the reliability of case law-based facts for offender profiling, motivations are inferred from the considered case laws: McKinnon v Government of the United States of America (2008), Love v United States (2018), and Regina v Steffan Needham (2019). It then revisits the central question of the suitability of case law for building attacker personas that engineers can use in designing software to thwart future attacks.