How would information disclosure influence organizations’ outbound spam volume? Evidence from a field experiment

Shu He, Gene Moo Lee, Vincent Han, Andrew B Whinston

Research output: Contribution to journalArticle (Academic Journal)peer-review

13 Citations (Scopus)
36 Downloads (Pure)


Cyber-insecurity is a serious threat in the digital world. In the present paper, we argue that a suboptimal cybersecurity environment is partly due to organizations’ underinvestment on security and a lack of suitable policies. The motivation for this paper stems from a related policy question: how to design policies for governments and other organizations that can ensure a sufficient level of cybersecurity. We address the question by exploring a policy devised to alleviate information asymmetry and to achieve transparency in cybersecurity information sharing practice. We propose a cybersecurity evaluation agency along with regulations on information disclosure. To empirically evaluate the effectiveness of such an institution, we conduct a large-scale randomized field experiment on 7919 US organizations. Specifically, we generate organizations’ security reports based on their outbound spam relative to the industry peers, then share the reports with the subjects in either private or public ways. Using models for heterogeneous treatment effects and machine learning techniques, we find evidence from this experiment that the security information sharing combined with publicity treatment has significant effects on spam reduction for original large spammers. Moreover, significant peer effects are observed among industry peers after the experiment.
Original languageEnglish
Article numbertyw011
Pages (from-to)99-118
Number of pages20
JournalJournal of Cybersecurity
Issue number1
Publication statusPublished - 30 Dec 2016

Structured keywords

  • ECON Econometrics
  • ECON Applied Economics


  • cybersecurity
  • policy design
  • randomized field experiments
  • information assymetry
  • peer effects
  • regression tree
  • random forest
  • heterogeneous treatment effects


Dive into the research topics of 'How would information disclosure influence organizations’ outbound spam volume? Evidence from a field experiment'. Together they form a unique fingerprint.

Cite this