A tale of two cybers - how threat reporting by cybersecurity firms systematically underrepresents threats to civil society

Figures & data

Figure 1. Commercial reporting – reporting volumes and prioritization of civil society targeting

Figure 2. Independent reporting – commercial spyware infrastructure detection 2012

Figure 3. Independent reporting – commercial spyware infrastructure detection 2018

Figure 4. Commercial reporting – civil society targeting by country

Figure 5. Independent reporting – civil society targeting by country

Figure 6. AccessNow – helpline data

Figure 7. Commercial reporting – attribution of targeted threats to civil society

Figure 8. Independent reporting – attribution of targeted threats to civil society

Table 1. Summary of case studies

Cases	TTP	Threat actor	Victim profile	Case type
Tainted Leaks	Unique, high sophistication	High-profile (APT28, Russia)	High-profile (journalist + DNC, Hillary Clinton)	Most-likely
Spying on a Budget	Low sophistication	Low-profile(unknown actor)	Low- profile (Tibetan activists)	Most-likely
Familiar Feeling	Medium sophistication	Medium-profile (TropicTrooper, speculated link to China)	Medium-profile (Tibetan activists + governments)	Least-likely

Data availability statement

A copy of the dataset can be accessed here: https://docs.google.com/spreadsheets/d/1FyzBsZ1UvhR2inK_cKItBgSzY7J-lGHDLbrEQKFD08w/edit?usp=sharing