How Much Harm Can Offensive Cyber Attacks Cause to Civilians?

In recent years offensive cyber attacks have become more common, yet few consider the everyday impact on ordinary people. A research team examined 74 studies on this phenomenon, called "cyber collateral damage" (CCD), to gauge how networks, schools, or hospitals might suffer. The papers fell into four main groups: legal, ethical, targeting‑oriented, and econometric. The legal side looks at laws and rules, the ethical side at what is right or wrong, the targeting side at how targets are chosen, and the econometric side at measuring financial costs. Despite the growth of these studies, big gaps remain: most research focuses on the military perspective, overlooking real harm to civilians. The authors suggest adding collateral‑damage estimates to national cyber defence plans and using new open datasets to pinpoint which cyber tools cause the most trouble. They also note that definitions of CCD differ widely among scholars, making comparisons hard. In short, protecting society requires an integrated approach that blends law, ethics, target analysis, and economic data to minimise the impact on everyday users.

The concept of cyber collateral damage (CCD) was first formalized in the early 2010s, when cyber attacks began targeting critical infrastructures such as power grids and transportation systems. Methodologically, the systematic review followed PRISMA guidelines, ensuring transparency in article selection and quality assessment. Legal categories include analyses of international treaties, like the law of cyber warfare, and national regulations on liability and compensation. The ethical dimension draws on distributive justice principles, evaluating how harms are spread among vulnerable populations. Target‑oriented research uses vulnerability models (CVSS) to predict the impact of exploits on non‑military systems. Econometrically, authors employ dummy‑variable regressions to isolate an attack's effect on macro‑economic indicators such as regional GDP or unemployment rates. However, the lack of open, standardized data hampers the ability to quantify CCD comparably. Future proposals suggest creating a public incident repository with detailed metadata on attack vectors, duration, and socio‑economic impact, alongside a risk‑assessment framework that integrates resilience metrics of civilian infrastructure. A multidisciplinary approach—combining law, ethics, engineering, and social sciences—is essential to develop effective mitigation policies and ensure that future offensive operations are evaluated not only for tactical value but also for civilian consequences.