Saving face in the cyberspace: Responses to public cyber intrusions in the Gulf

Figures & data

Table 1. Rhetorical strategies following a cyber intrusion.

Diminishing	1. Minimizing ("it is not as bad as it seems”):
	Referring to the intrusion itself and its goals, emphasizing that the goals were not achieved or that no serious damage has been done. The text is oriented toward the attack, the perpetrators, and the minimal or insignificant damage that was caused.
	2. Normalizing (“nothing is out of the ordinary”):
	Referring to the fact that other countries suffer from the same phenomenon or to the fact that cyber intrusions take place all the time. Referring to the fact that leaked information does not expose anything that is not already known. The text emphasizes that cyber intrusions are a normal part of world politics or that the consequences of the intrusion are nothing out of the ordinary.
	3. Debunking (“this is a lie”):
	Referring to events or information as fabricated or false. Referring to facts or evidence that contradict the fabricated information. The text is oriented toward preventing the further dissemination of leaked information and toward narrating an alternative story.
Self-complimenting	1. Bolstering (“look how good we are”):
	Referring to the state itself, its attributes, its status, or its successes. Referring to the successful handling of the situation despite difficult conditions. Referring to international ties and support. The text is oriented toward the state and includes adjectives that highlight positive attributes.
	2. Reasserting control (“everything is under control”):
	Referring to current and future steps that deal with cyber intrusions. The text is oriented toward future actions, such as investigations, institutions, committees, training, additional protection, etc. This strategy does not necessarily include positive adjectives and is more technical in nature.
	3. Correcting (“let me tell you what really happened”):
	Providing information to replace false statements. Offering an alternative and beneficial story that presents the state in a good light.
Accusing	1. Exposing (“we have been attacked”):
	Admitting that there was an attack. The text provides details on the intrusion (what happened and when).
	2. Condemning (“they are bullies”):
	Referring to the intrusion or the initiators in delegitimizing and derogatory terms, such as criminals, terrorists, enemies, evil, etc.
	3. Attributing (“this is who did it”):
	Pointing to an actor or a group of actors as the initiator of the intrusion (in specific or general terms).

Table 2. Distribution of strategies per intrusion.

		Hacking (Saudi Arabia 2012)	Hacking (Saudi Arabia 2016-2017)	Hacking (Bahrain 2019)	Hack-and-leak (Saudi Arabia 2015)	Hack-and-fake (Qatar 2017)
Shared strategies	Exposing	•	•	•	•	•
	Condemning	•	•	•	•	•
	Reasserting control	•	•	•	•	•
	Bolstering	•	•	•	•	•
	Normalizing	•	•	•	•	•
Unique strategies	Minimizing	•	•		•	•
	Debunking				•	•
	Attributing			•		•
	Correcting					•