# Factors Influencing Cybercrime Reporting Behaviour in South African State-Owned Entities

Karabo Pilane, Zainab Ruhwanya, Irwin Brown

► To cite this version:

Karabo Pilane, Zainab Ruhwanya, Irwin Brown. Factors Influencing Cybercrime Reporting Behaviour in South African State-Owned Entities. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.285-299, 10.1007/978-3-031-12172-2_23. hal-05324947

HAL Id: hal-05324947

https://inria.hal.science/hal-05324947v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Factors Influencing Cybercrime Reporting Behaviour in South African State-Owned Entities

Karabo Pilane, Zainab Ruhwanya✉, and Irwin Brown ID

University of Cape Town, Cape Town, South Africa
plnlet001@myuct.ac.za, {zainab.ruhwanya, irwin.brown}@uct.ac.za

**Abstract.** Cybercrime may destabilise organisations and society due to the social, financial, emotional, psychological, and physical impacts. The purpose of this paper was to investigate cybercrime reporting behaviour and the factors that influence it. South African state-owned entities were the focus of attention given their strategic role, which requires that attention be given to improving their cybersecurity practices, such as cybercrime reporting in an increasingly digital society. The conceptual framework was developed using themes from the cybercrime literature, and the Theory of Planned Behaviour (TPB) as a lens. The study used a quantitative method, and data was collected online using a questionnaire survey. One hundred and three complete responses were received from employees working in South African state-owned entities. Factors that were identified as influencing cybercrime reporting behaviour were self-efficacy and facilitating conditions.

**Keywords:** Cybercrime · Cybercrime reporting · Reporting behaviours · South Africa

## 1 Introduction

Many terms such as computer crime, digital crime, internet crime, e-crime (electronic crime), hi-tech crime (high technology), online crime, etc., are synonymous with cybercrime. Cybercrime is defined as a crime that utilises computing devices, including smartphones, wearable technology devices, and many others, to defraud, steal, harass, and destroy the property of society [4]. Similarly, cybercrime can be defined as an illegal activity executed through the cyberinfrastructure (computer, mobile device, smartphone, supervisory control, and data acquisition systems, etc.) or the internet to compromise confidentiality, integrity, availability, and privacy of the data in the cyberinfrastructure [20, 37, 44]. Cybercrime may evolve as cybercriminals become more sophisticated using the high speed of technological innovation [5, 19]. Recent technological innovations include bitcoin, drones, blockchain, cloud systems, and augmented reality [20]. The Internet Live Stats [29] indicates that there are more than five billion Internet users, whilst the number of Facebook users has breached the three billion mark. It is, therefore, unsurprising that cybercrime is committed through the Internet infrastructure [16].
Many cases of identity theft, financial theft, phishing, ransomware, cyber-bullying, cyber-stalking, information privacy violations, zero-day attacks, and online surveillance [4, 25, 44] remain underreported [52]. The law enforcement resources are allocated based on reported crimes [12]. Therefore, underreporting of cybercrime makes the work of law enforcement agencies difficult to manage. Reporting cybercrime may help reduce cybercrime to acceptable levels [33] and restore confidence in law enforcement agencies [12]. At the same time, it is worrying that many companies or institutions may not report cybercrime even though required by law to do so [47]. It is possible that internet users will be confronted with cybercrime victimisation linked to cybercrime reporting [18]. Therefore, cybercrime reporting may amplify or diminish cybercrime victimisation [1].

Cybercrime reporting to law enforcement agencies by cybercrime victims is a serious challenge [40, 52]. Cybercrime victims may not share their experiences with family, friends, and colleagues [18], therefore, not receive support from their social environment. Lack of knowledge of cybercrime amongst colleagues, friends, and family does not assist in escalating or reporting cybercrime incidents experienced by a cybercrime victim to a law enforcement agency. In addition, a cybercrime victim's friends, colleagues, and family may influence cybercrime victims not to report cybercrime [33]. Investigation of cybercrime reporting to law enforcement agencies is hence worthy of research attention [33, 52].

The 2021 Internet Crime report [22] notes that South Africa is ranked 6th out of the top 20 international cybercrime victims. There are negative cybercrime trends in South Africa due to poor public knowledge of cyber threats and poor cybercrime legislation [38]. This study will examine South African state-owned entities, given their strategic nature and the recent cyber-attack incidents aimed at these institutions. The research question is thus: *What factors explain employee cybercrime reporting behaviour in South African state-owned entities?*

The research article is structured as follows. Section 2 reviews the academic literature to identify factors of influence and to propose hypotheses. Section 3 discusses the research methodology adopted, while Sect. 4 delves into findings, analysis, discussion, and implications of the study. Section 5 is the research conclusion, inclusive of ideas for future research.

# 2 Conceptual Background and Hypotheses Development

## 2.1 Perceptions of Law Enforcement Agencies

Perceptions of Law Enforcement Agencies (LEA) competence may play a role in whether cybercrime is reported or not. These perceptions may arise from LEA's inexperience with cybercrime; the inability of LEA to stay up to date with technologies being used by cybercriminals, the perceived inability of LEA to solve cybercrime, and the lack of collaboration between LEA and industry [14, 34]. Furthermore, where society feels that there will be no consequence after reporting a crime, there will be less likelihood of reporting. Perceptions of cybercrime victims or potential cybercrime victims about LEA competence hence influence cybercrime reporting behaviour [8, 14, 34]. The hypothesis supported is.
*H1: Perceptions of law enforcement agencies competence influence employee cybercrime reporting behaviour.*

**2.2 Emotional Response to Cybercrime**

The emotional response is identified as influencing cybercrime reporting behaviour by cybercrime victims and potential cybercrime victims [52]. Emotional responses include a sense of hopelessness that nothing will be done about the cybercrime if the cybercrime is not deemed serious enough [23]. Other emotional responses include guilt, shame, stress, depression, the stigma associated with cybercrime, isolation caused by cybercrime, the fear of disclosure of cybercrime, and fear that they (cybercrime victims) will not be believed [12, 17]. Some emotional responses can be credited as positive influences on cybercrime reporting behaviour, while others may have a negative influence [21, 39]. The hypothesis supported is:

*H2: Emotional response influences employee cybercrime reporting behaviour.*

**2.3 Cybercrime Reporting Awareness**

Cybercrime victims may not know or not be aware that cybercrime has occurred in their digital or network environments and that they are compromised [12]. As a result of not knowing or not being aware of what transpired in their digital spaces, cybercrime victims may not report cybercrime to law enforcement agencies (LEA) or relevant authorities and, therefore, not receive support [23]. The cybercrime victims' lack of awareness of cybercrime may influence cybercrime reporting behaviour [48]. In addition, victims of cybercrime may not know or not be aware of whom to report the cybercrime to [17].

The challenge of reporting cybercrime behaviour may be due to cybercrime's transnational nature, which may be unknown to victims [15, 19, 31, 33, 39]. This may leave the cybercrime victim helpless, exacerbating the cybercrime victimisation problem [18] due to no contact between the cybercrime victim and the cybercriminal.

Equally important is that cybercriminals may make use of the dark web using anonymity tools such as the Tor browser, virtual private networks, and secure socket layer encryption to perform illegal and illicit online activities [30]. The illegal activities against potential cybercrime victims in underground markets may include the use of malware, viruses, worms, ransomware, denial of service, and distributed denial of service attacks. Other illegal services may include trading in stolen bank card PINs (Personal Identification Numbers) for debit and credit cards. Online anonymity influences reporting of cybercrime behaviour because victims do not know the identity of their attackers [17, 33, 52]. Bell, Roger and Pierce [10] claim that intention to report cybercrime may be positively influenced by awareness among employees of an organisation's cybercrime reporting mechanisms. The hypothesis supported is:

*H3: Cybercrime awareness influences employee cybercrime reporting behaviour.*

**2.4 The Cost-Benefit of Cybercrime Reporting**

Cybercrime reporting behaviour by cybercrime victims or potential cybercrime victims is based on assessing the expected benefit versus the cost of cybercrime reporting
[52]. Benefits may be in the form of financial compensation as an incentive for report-
ing cybercrime [32], insurance pay-outs, or prosecution and arrest of cybercriminals.
Organisations may not report cybercrime incidents to law enforcement agencies if they
anticipate reputational damage that may trigger a loss of customers and resultant revenue
drops [36, 47]. It may also be cost-effective for cybercrime victims to report online [52].
The hypothesis supported is:

H4: *Cost-benefit analysis influences employee cybercrime reporting behaviour.*

**2.5 Organisational Subjective Norm**

Subjective norms refer to social pressures or peer influence on whether to perform
a particular behaviour (e.g. cybercrime reporting behaviour) [3, 27]. Subjective norm
plays an important role in cybercrime reporting [33]. The organisation may assume that
reporting cybercrime will not lead to the arrest of cybercriminals [14]. The organisation
and its subjective norms are pivotal in cyber peacekeeping through cybercrime reporting
[41]. A lack of positive organisational norms may negatively influence reporting of
cybercrime behaviour [33]. Cybercrime reporting is a help-seeking behaviour [23] in
the context of organisational norms.

Moreover, cybercrime reporting is a proactive stance that may trigger cybercrime intervention from law enforcement agencies that may improve an organisation's governance. The conduciveness of the organisational culture or control environment to report cybercrime is vital [33]. Where cybercrime victims want to protect their colleagues from cybercrime victimisation, then reporting of cybercrime may improve [33]. Co-workers and other stakeholders of the organisation may either encourage or discourage a cybercrime victim from reporting a cybercrime [17] to law enforcement agencies or any other organisation with a mandate or responsibility of managing cybercrime. Hence the hypothesis:

H5: *Organisational subjective norms influence employee cybercrime reporting behaviour.*

**2.6 Self-Efficacy**

Self-efficacy refers to an individual's confidence in performing a behaviour [35, 53]. Therefore, confidence in the ability to report cybercrime has positive effects on cybercrime reporting behaviour [35]. The hypothesis suggested is:

H6: *Perceived self-efficacy influences employee cybercrime reporting behaviour.*

**2.7 Facilitating Conditions**

Facilitating conditions refer to facilities needed to ensure that employees report cyber-
crime as required of them by the organisation [27, 53]. The knowledge, skills, training,
and education on reporting cybercrime have a positive effect on cybercrime reporting
behaviour [27]. The hypothesis supported is:

H7: *Facilitating conditions influence employee cybercrime reporting behaviour.*
## 2.8 Anonymity of Cybercrime Reporting

A factor influencing intentions related to cybercrime reporting is the Anonymity of cybercrime reporting by cybercrime victims or potential cybercrime victims [9, 50]. Cybercrime victims or potential victims may not report cybercrime if they are not assured of their anonymity. The hypothesis suggested is:

*H8: Anonymity influences employee cybercrime reporting behaviour.*

## 2.9 Research Model

According to the Theory of Planned Behaviour (TPB) [3], the above factors can be grouped into Attitudinal factors, Subjective Norms, and Perceived Behavioural Control (PBC) factors. Attitudinal factors include perceptions of Law Enforcement Agencies (LEA) competence, Emotional Response (ER) to cybercrime, Cybercrime Awareness (AW), and Cost-Benefit (CB) Analysis of cybercrime reporting. Subjective Norm is represented by Organisational Subjective Norm (SN), and Perceived Behavioural Control comprises of Self-Efficacy (SE), Facilitating Conditions (FC), and Anonymity of cybercrime reporting (AR). These factors are deemed influential on behavioural intentions and actual cybercrime reporting behaviour. Figure 1 below illustrates these relationships.

<figure><img src="image_3.png" /><figcaption>Fig. 1. Research model</figcaption></figure>
# 3 Research Methodology

Quantitative methods were used through questionnaire surveys that collected data from participants. The study was cross-sectional due to a limited time frame [11]. Measurement items were identified for all constructs in the research model, as shown in Table 1 below. The research instrument items (questionnaire survey) are shown in Appendix A. A seven-point Likert-type scale [11] was used throughout the questionnaire survey where respondents could indicate their extent of agreement or disagreement (1 = Strongly Disagree, 2 = Disagree, 3 = Somewhat disagree, 4 = Neutral, 5 = Somewhat agree, 6 = Agree 7 = Strongly Agree). Participants' demographic data included age, gender, highest education, industry, size of the organisation, their role in the organisation, number of years working in the organisation, and number of years of internet access in the organisation. A web-based questionnaire survey was sent to participants. Qualtrics was used to develop the questionnaire survey. Before distributing the web-based questionnaire survey to participants, institutional ethics in research clearance was received.

<table><caption>**Table 1.** Items used on the questionnaire survey</caption><thead><tr><td>Measures</td><td>No.</td><td>Source</td></tr></thead><tbody><tr><td>Perceptions of LEA Competence [LEA]</td><td>6</td><td>[24, 33, 51]</td></tr><tr><td>Emotional Response [ER]</td><td>9</td><td>[24, 51]</td></tr><tr><td>Cybercrime Awareness [AW]</td><td>4</td><td>[24]</td></tr><tr><td>Cost-Benefit Analysis [CB]</td><td>3</td><td>[24, 51]</td></tr><tr><td>Organisational Subjective Norm [SN]</td><td>4</td><td>[6, 7, 51]</td></tr><tr><td>Self-efficacy [SE]</td><td>3</td><td>[13, 24, 35]</td></tr><tr><td>Facilitating Conditions [FC]</td><td>3</td><td>[53]</td></tr><tr><td>Anonymity of Reporting [AR]</td><td>5</td><td>[26]</td></tr><tr><td>Behavioural Intentions [BI]</td><td>3</td><td>[6, 7, 51]</td></tr><tr><td>Cybercrime Reporting Behaviour [CRB]</td><td>4</td><td>[27]</td></tr></tbody></table>

## 3.1 Sampling Strategy

This study was targeted at participants from South African State-owned Entities. There are more than 200 South African public institutions [42] approximating about a hundred thousand employees. Some entities have five to ten employees, with others in the thousands. Not all elements of the population had access to the internet. A non-probability snowball sampling technique was adopted. Initial respondents identified as working in State-owned Entities were approached and they provided information about subsequent respondents [43]. The sample size in this study was determined, assuming that the minimum sample criteria of the sample size should be ten times the number of variables in multivariate research [2]. There were ten constructs in this study, implying a minimum
sample of 100 participants was required [2]. The research instrument was pilot tested by ten participants from South African state-owned entities to ensure that the measures were clear and understandable [11]. No changes were suggested, and data collection proceeded. In the end, 132 responses were received, although some were incomplete, leading to 103 complete responses being used.

## 3.2 Data Analysis Methods

Factor analysis was performed for construct validity testing [11, 48]. Factor analysis with case wise deletion was performed using the Statistica software package. The factor rotation method adopted was varimax-normalised rotation. For items to be included, they needed to have a factor-loading of greater than 0.5. The extraction method was principal component analysis, using a minimum eigenvalue of 1 as a cut-off value for extraction.

Cronbach's alpha of 0.7 was used as the cut-off to measure the reliability of the research measures [43]. A Cronbach Alpha of 0.7 is considered acceptable for positivist research in Information Systems [45]. Multiple regression was used to test the hypotheses, with the dependent variable being cybercrime reporting behaviour. A p-value of less than 0.05 was considered significant for a hypothesis to be confirmed.

# 4 Findings

## 4.1 Demographic Profile

Fifty percent (50%) of the respondents were between the ages of 31 and 40, followed by respondents between 40 and 50 at 31.2%. Respondents were 45.2% male and 52.4% female. 30.4% held Bachelor's degree/B-Tech, 26.4% Certificates/Diplomas, and 24% Honours/Postgraduate-Diplomas. Respondents were from organisations of sizes more than 500 (48%), between 300 and 500 (28%), and between 51 and 300 (16%). In terms of roles, respondents were from Governance, Risk, and Compliance (24%), ICT (19%), and Other (43%). Many of the respondents had worked in their organisations for more than ten years (35%), between 5 and 10 years (29%), and between 2 and 5 years (27%). In terms of the number of years of Internet access, the majority had been accessing the internet for more than five years (70%).

## 4.2 Construct Validity

When performing factor analysis, items (see Appendix A) LEA1, LEA2, and LEA3 were dropped due to low factor loading. Moreover, EM2 cross-loaded and was therefore dropped, together with EM7, EM8, and EM9 which loaded poorly. Likewise, AWA1, AWA2, AWA3, AWA4, and CB1 were dropped due to the weakness of factor loading. SN1, SN2, SN3, SN4, BI1, BI2, and BI3 were also dropped due to poor loading. Reliability testing (Table 4) was conducted iteratively with factor analysis, which resulted in items pertaining to Cost-Benefit Analysis (CB1, CB2, CB3) also being dropped. Table 2 below presents the factor structure for the remaining items with loading greater than
0.5 and adequate reliability. Items pertaining to Self-Efficacy (SE) and Facilitating Conditions (FC) loaded on the same factor, so the variance inflation factor (VIF) test was used to check for multicollinearity among the independent variables [46]. Low multicollinearity was noted, as shown in Table 3, where VIFs were all less than 5. Hence these factors were still treated as separate [46].

The items that loaded acceptably and were reliable were hence Perceptions of LEA competency—LEA4, LEA5, LEA6; Emotional response (EM)—EM1, EM3, EM4, EM5, EM6; Perceived self-efficacy (SE)—SE1, SE2, SE3; Perceived facilitating conditions (FC)—FC1, FC2, FC3; Anonymity of reporting (AR)—AR1, AR2, AR3, AR4, AR5 and Cybercrime reporting behaviour (CRB)—CRB1, CRB2, CRB3, CRB4, CRB5.

<table><caption>**Table 2.** Final results of factor loading</caption><thead><tr><th rowspan="2">Variable</th><th colspan="5">Factor Loadings (Varimax normalised)<br>Extraction: Principal components<br>(Marked loadings are &gt;,500000)</th></tr><tr><th>SE/FC</th><th>AR</th><th>EM</th><th>LEA</th><th>CRB</th></tr></thead><tbody><tr><td>LEA4</td><td>0,020</td><td>0,044</td><td>0,023</td><td>-0,749</td><td>0,080</td></tr><tr><td>LEA5</td><td>0,094</td><td>-0,131</td><td>0,014</td><td>-0,821</td><td>-0,252</td></tr><tr><td>LEA6</td><td>-0,196</td><td>-0,059</td><td>0,087</td><td>-0,744</td><td>0,238</td></tr><tr><td>EM1</td><td>-0,314</td><td>-0,043</td><td>0,511</td><td>0,098</td><td>0,315</td></tr><tr><td>EM3</td><td>-0,017</td><td>-0,078</td><td>0,653</td><td>-0,180</td><td>-0,004</td></tr><tr><td>EM4</td><td>-0,047</td><td>0,053</td><td>0,628</td><td>-0,128</td><td>0,103</td></tr><tr><td>EM5</td><td>0,234</td><td>-0,052</td><td>0,667</td><td>0,103</td><td>-0,153</td></tr><tr><td>EM6</td><td>0,110</td><td>-0,021</td><td>0,837</td><td>0,085</td><td>-0,133</td></tr><tr><td>SE1</td><td>0,709</td><td>0,148</td><td>-0,028</td><td>-0,086</td><td>0,058</td></tr><tr><td>SE2</td><td>0,766</td><td>0,147</td><td>0,022</td><td>-0,184</td><td>0,184</td></tr><tr><td>SE3</td><td>0,704</td><td>0,182</td><td>0,005</td><td>0,008</td><td>0,251</td></tr><tr><td>FC1</td><td>0,738</td><td>0,056</td><td>0,091</td><td>0,223</td><td>0,164</td></tr><tr><td>FC2</td><td>0,730</td><td>0,192</td><td>0,010</td><td>0,104</td><td>0,252</td></tr><tr><td>FC3</td><td>0,790</td><td>0,085</td><td>0,049</td><td>0,103</td><td>0,326</td></tr><tr><td>AR1</td><td>0,201</td><td>0,719</td><td>0,095</td><td>0,172</td><td>0,372</td></tr><tr><td>AR2</td><td>0,204</td><td>0,770</td><td>0,015</td><td>0,157</td><td>0,266</td></tr><tr><td>AR3</td><td>0,086</td><td>0,823</td><td>0,009</td><td>-0,039</td><td>-0,080</td></tr><tr><td>AR4</td><td>0,144</td><td>0,868</td><td>-0,118</td><td>-0,017</td><td>-0,023</td></tr><tr><td>AR5</td><td>0,126</td><td>0,890</td><td>-0,098</td><td>-0,031</td><td>0,012</td></tr><tr><td>CRB1</td><td>0,467</td><td>0,047</td><td>-0,003</td><td>0,048</td><td>0,630</td></tr><tr><td>CRB2</td><td>0,363</td><td>0,098</td><td>-0,051</td><td>0,049</td><td>0,612</td></tr><tr><td>CRB3</td><td>0,307</td><td>0,051</td><td>-0,067</td><td>-0,129</td><td>0,784</td></tr><tr><td>CRB4</td><td>0,449</td><td>0,146</td><td>0,077</td><td>-0,147</td><td>0,652</td></tr></tbody></table>
<table><caption>**Table 3.** Tests for multicollinearity (variance inflation factor)</caption><thead><tr><td>Construct</td><td>VIF</td></tr></thead><tbody><tr><td>LEA</td><td>1,045</td></tr><tr><td>EM</td><td>1,016</td></tr><tr><td>SE</td><td>1,870</td></tr><tr><td>FC</td><td>1,861</td></tr><tr><td>AR</td><td>1,177</td></tr></tbody></table>

## 4.3 Reliability

Table 4 presents the composite reliability of each valid construct in Table 2. A Cronbach alpha of 0.70 or higher is considered reliable [45]. All these constructs exhibited adequate reliability.

<table><caption>**Table 4.** Reliability of research items</caption><thead><tr><td>Factor</td><td>Mean</td><td>No.</td><td>No. (refined)</td><td>Cronbach alpha</td></tr></thead><tbody><tr><td>LEA</td><td>3.3</td><td>6</td><td>3</td><td>0.71</td></tr><tr><td>EM</td><td>6.4</td><td>9</td><td>5</td><td>0.70</td></tr><tr><td>SE</td><td>5.3</td><td>3</td><td>3</td><td>0.80</td></tr><tr><td>FC</td><td>4.8</td><td>3</td><td>3</td><td>0.88</td></tr><tr><td>AR</td><td>4.3</td><td>5</td><td>5</td><td>0.90</td></tr><tr><td>CRB</td><td>5.5</td><td>4</td><td>4</td><td>0.83</td></tr></tbody></table>

## 4.4 Correlation Analysis

Table 5 below shows the Pearson correlations between the refined measures of Law Enforcement Agency competence (LEA), Emotional Response (EM), Self-Efficacy (SE), Facilitating Conditions (FC), Anonymity of Reporting (AR), and Cybercrime Reporting Behaviour (CRB). Factors correlating significantly (p < 0.05) with the dependent variable CRB are FC, SE and AR. FC, SE and AR are in turn significantly correlated with each other.
<table><caption>**Table 5.** Correlation analysis</caption><thead><tr><th>Variable</th><th>CRB</th><th>AR</th><th>FC</th><th>LEA</th><th>EM</th><th>SE</th></tr></thead><tbody><tr><td>CRB</td><td>1,00</td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>AR</td><td>0,29</td><td>1,00</td><td></td><td></td><td></td><td></td></tr><tr><td>FC</td><td>0,59</td><td>0,32</td><td>1,00</td><td></td><td></td><td></td></tr><tr><td>LEA</td><td>0,03</td><td>-0,11</td><td>-0,12</td><td>1,00</td><td></td><td></td></tr><tr><td>EM</td><td>-0,01</td><td>-,083</td><td>0,04</td><td>0,04</td><td>1,00</td><td></td></tr><tr><td>SE</td><td>0,58</td><td>0,35</td><td>0,66</td><td>0,01</td><td>-0,02</td><td>1,00</td></tr></tbody></table>

**4.5 Hypotheses Testing**

Table 6 illustrates the outcomes of multiple linear regression analysis. Hypotheses H3, H4 and H5 were not tested as associated items failed construct validity and/or reliability testing. In addition, hypotheses H1, H2 and H8 were not supported, with only H6 and H7 supported. The adjusted R² was 39%, meaning Self-efficacy (SE) and Facilitating Conditions (FC) accounted for 39% of the variance in Cybercrime Reporting Behaviour.

<table><caption>**Table 6.** Hypotheses testing</caption><thead><tr><th rowspan="2">Hypothesis</th><th rowspan="2">Intercept</th><th colspan="4">Regression Summary for Dependent Variable:CRB<br>Adjusted R²= 39,15%</th><th rowspan="2">Supported?</th></tr><tr><th>B</th><th>Std.Err.</th><th>t(103)</th><th>p-value</th></tr></thead><tbody><tr><td>H1</td><td>LEA</td><td>-0,06</td><td>0,060</td><td>-0,99</td><td>0,320</td><td>No</td></tr><tr><td>H2</td><td>EM</td><td>-0,02</td><td>0,12</td><td>-0,15</td><td>0,884</td><td>No</td></tr><tr><td>H3</td><td>AWA</td><td>-</td><td>-</td><td>-</td><td>-</td><td>Not tested</td></tr><tr><td>H4</td><td>CB</td><td>-</td><td>-</td><td>-</td><td>-</td><td>Not tested</td></tr><tr><td>H5</td><td>SN</td><td>-</td><td>-</td><td>-</td><td>-</td><td>Not tested</td></tr><tr><td>H6</td><td>SE</td><td>0,25</td><td>0,08</td><td>2,94</td><td>0,004</td><td>Yes</td></tr><tr><td>H7</td><td>FC</td><td>0,26</td><td>0,07</td><td>3,68</td><td>0,000</td><td>Yes</td></tr><tr><td>H8</td><td>AR</td><td>0,06</td><td>0,06</td><td>0,91</td><td>0,365</td><td>No</td></tr></tbody></table>

**4.6 Discussion and Implications**

Self-efficacy (SE) of employees in South African state-owned entities has a significant and positive influence on cybercrime reporting behaviour. This is consistent with research that shows perceived self-efficacy influences information security behaviour [13, 24, 35]. Facilitating conditions (FC) in South African state-owned entities also
resulted in a positive and significant influence on cybercrime reporting behaviour. The
results are consistent with prior literature that suggests facilitating conditions as an
influence on information security behaviour [53]. Perceptions of LEA (law enforcement
agencies) competence was found not to have a significant influence on cybercrime report-
ing behaviour. This is inconsistent with previously discussed literature that suggested
that cybercrime victims' negative perceptions of law enforcement agencies may nega-
tively influence cybercrime reporting behaviour [8, 14, 34]. Emotional Response (EM)
was found not to have a significant influence on cybercrime reporting behaviour. This is
inconsistent with the previous body of work performed by researchers that claimed that
emotional factors influence cybercrime victims to report cybercrime [17, 20, 21, 28, 39].
The anonymity of reporting was found not to have a significant influence on cybercrime
reporting behaviour. This was inconsistent with previous research [9, 50].

5 Conclusion

The study empirically tested a research model for explaining cybercrime reporting in South African state-owned entities. The research model hypothesised eight factors that were deemed to influence cybercrime reporting behaviour, grouped as (1) Attitudinal factors (Perceptions of LEA, Emotional Response, Awareness and Cost-Benefit Analysis); (2) Subjective Norms and (3) Perceived Behavioural Control (Self-efficacy, Facilitating Conditions and Anonymity of Reporting). This study shows that only the Perceived Behavioural Control Factors—Self-efficacy and Facilitating Conditions influence cybercrime reporting behaviour, suggesting that organisations should focus attention on these two issues to improve cybercrime reporting behaviour amongst employees. To understand how to improve self-efficacy, further research can be conducted to investigate what influences this factor. Facilitating conditions pertain to the various organisational support mechanisms that are put in place to facilitate employee reporting of cybercrime. mechanisms put in place to facilitate employee reporting of cybercrime. Future studies can explore further the most effective support mechanisms.

For the tested hypotheses that are not supported, it may be that as per the Theory
of Planned Behaviour, their influence is on behavioural intentions and not behaviour
directly. Since the measure for behavioural intention did not exhibit adequate psycho-
metric properties, the effects could not be tested. Future research may hence consider
an improvement in the operationalisation of behavioural intentions and those other fac-
tors that did not exhibit adequate psychometric properties, i.e. Awareness, Cost-Benefit
Analysis and Organisational Subjective Norm.
Appendix A: Research Instrument

<table><thead><tr><th>Item</th><th>Description [Italicised Items dropped]</th></tr></thead><tbody><tr><td>LEA1</td><td>The Law Enforcement Agencies lack the capacity to deal with cybercrime effectively</td></tr><tr><td>LEA2</td><td>Cybercriminals are more advanced than Law Enforcement Agencies</td></tr><tr><td>LEA3</td><td>Law Enforcement Agencies are too busy to deal with cybercrime</td></tr><tr><td>LEA4</td><td>The Law Enforcement Agencies know how to catch cybercriminals (R)</td></tr><tr><td>LEA5</td><td>The Law Enforcement Agencies do their utmost to help address cybercrime (R)</td></tr><tr><td>LEA6</td><td>The Law Enforcement Agencies are easy to approach for cybercrime cases (R)</td></tr><tr><td>EM1</td><td>I fear becoming a victim of cybercrime</td></tr><tr><td>EM2</td><td>I am concerned that I can become a victim of cybercrime</td></tr><tr><td>EM3</td><td>If I became a victim of cybercrime, it could have serious consequences</td></tr><tr><td>EM4</td><td>I want cybercriminals to be caught</td></tr><tr><td>EM5</td><td>I want to prevent cybercriminals from doing harm to the organisation</td></tr><tr><td>EM6</td><td>I want to prevent cybercrime incidents from happening to me</td></tr><tr><td>EM7</td><td>I am afraid cybercriminals can take revenge</td></tr><tr><td>EM8</td><td>I would be ashamed if I fell victim to the cybercrime</td></tr><tr><td>EM9</td><td>I think cybercrime victimisation would be my own fault</td></tr><tr><td>AWA1</td><td>I am aware of my role in keeping the company protected from potential cybercriminals</td></tr><tr><td>AWA2</td><td>It is hard to know how I can help protect the organisation from cybercrime</td></tr><tr><td>AWA3</td><td>I understand the risks of cybercrime to individuals in the organisation</td></tr><tr><td>AWA4</td><td>I do not pay attention to company material about cybercrime threats</td></tr><tr><td>CB1</td><td>Cybercrime might damage the reputation of the company affecting revenue</td></tr><tr><td>CB2</td><td>Reporting cybercrime will get the cybercrime damage compensated</td></tr><tr><td>CB3</td><td>Cybercriminals only target a company when there is a financial gain</td></tr><tr><td>SN1</td><td>I will report cybercrime if I see people around me report it</td></tr><tr><td>SN2</td><td>I would never report cybercrime regardless of how many colleagues report it</td></tr><tr><td>SN3</td><td>I feel like I should do according to what my colleagues think about cybercrime</td></tr><tr><td>SN4</td><td>reporting</td></tr><tr><td>SN4</td><td>My colleagues would disapprove of me not reporting cybercrime</td></tr><tr><td>SE1</td><td>I feel confident that I could quickly retrieve accurate contact information of who to report cybercrime</td></tr><tr><td>SE2</td><td>I am confident of my ability to report cybercrime</td></tr><tr><td>SE3</td><td>I am confident that I would be able to report the signs of cybercrime</td></tr><tr><td>FC1</td><td>I have the necessary resources to report cybercrime</td></tr><tr><td>FC2</td><td>I have the necessary knowledge to report cybercrime</td></tr><tr><td>FC3</td><td>I have enough experience to report cybercrime incidents</td></tr></tbody></table>

(continued)
(continued)

<table><thead><tr><th>Item</th><th>Description [Italicised Items dropped]</th></tr></thead><tbody><tr><td>AR1</td><td>When I report cybercrime in my organisation, I am confident that others do not know who I am</td></tr><tr><td>AR2</td><td>When I report cybercrime in my organisation, I believe that my personal identity remains unknown to others</td></tr><tr><td>AR3</td><td>When I report cybercrime in my organisation, I am easily identified as an individual by others (R)</td></tr><tr><td>AR4</td><td>When I report cybercrime in my organisation, others are likely to know who I am (R)</td></tr><tr><td>AR5</td><td>When I report cybercrime in my organisation, my personal identity is known to others (R)</td></tr><tr><td>BI1</td><td>I intend to report cybercrime to inform against its illegal activities</td></tr><tr><td>BI2</td><td>My reporting against cybercrime would positively benefit the victim</td></tr><tr><td>BI3</td><td>My non-involvement in cybercrime reporting saves lives, prevents trauma, distress, depression, and discomfort to others</td></tr><tr><td>CRB1</td><td>I assist my colleagues in reporting cybercrime</td></tr><tr><td>CRB2</td><td>I always recommend other colleagues to report cybercrime</td></tr><tr><td>CRB3</td><td>I practise recommended cybercrime reporting behaviour as much as possible</td></tr><tr><td>CRB4</td><td>I comply with cybercrime reporting policies when performing my daily work</td></tr></tbody></table>

References

1. Abdullah, A.T.M., Jahan, I.: Causes of cybercrime victimization: a systematic literature review. Int. J. Res. Rev. 7(5), 89–98 (2020)

2. Ahmad, A., Ahmad, R., Hashim, K.F.: Innovation traits for business intelligence successful deployment. J. Theor. Appl. Inf. Technol. 89(1), 96 (2016)

3. Ajzen, I.: The theory of planned behavior. Organ. Behav. Hum. Decis. Process. 50(2), 179–211 (1991)

4. Al-Khater, W.A., Al-Maadeed, S., Ahmed, A.A., Sadiq, A.S., Khan, M.K.: Comprehensive review of cybercrime detection techniques. IEEE Access 8, 137293–137311 (2020)

5. Almazkyzy, K., Esteusizov, Y.N.: The essence and content of cybercrime in modern times. J. Adv. Res. Law Econ. 9, 834 (2018)

6. Alotaibi, N.B.: Cyberbullying and the expected consequences on the students’ academic achievement. IEEE Access 7, 153417–153431 (2019)

7. Alrwais, O., Alhodaib, E.: What derives people to use reporting functions on social networks? Int. J. Appl. Inf. Syst. 12(25), 10–16 (2019)

8. Apau, R., Koranteng, F.N.: Impact of cybercrime and trust on the use of ecommerce technologies: an application of the theory of planned behavior. Int. J. Cyber Criminol. 13(2), 228–254 (2019)

9. Baror, S.O., Ikuesan, R.A., Venter, H.S.: A defined digital forensic criteria for cybercrime reporting. In: International Conference on Cyber Warfare and Security, pp. 617–626. Academic Conferences International Limited (2020). https://doi.org/10.34190/ICCWS.20.056

10. Bell, A.J.C., Rogers, M.B., Pearce, J.M.: The insider threat: Behavioral indicators and factors influencing likelihood of intervention. Int. J. Crit. Infrastruct. Prot. 24, 166–176 (2019). https://doi.org/10.1016/j.ijcip.2018.12.001

11. Bhattacherjee, A.: Social Science Research: Principles, Methods, and Practices. University of South Florida (2012)
12. Bidgoli, M., Grossklags, J.: End-user cybercrime reporting: what we know and what we can do to improve it. In: 2016 IEEE International Conference on Cybercrime and Computer Forensic (ICCCF), pp. 1–6. IEEE (2016)

13. Burns, S., Roberts, L.: Applying the theory of planned behaviour to predicting online safety behaviour. Crime Prev. Community Saf. **15**(1), 48–64 (2013). https://doi.org/10.1057/cpcs.2012.13

14. Cheng, C., Chan, L., Chau, C.L.: Individual differences in susceptibility to cyber-crime victimization and its psychological aftermath. Comput. Hum. Behav. **108**, 106311 (2020)

15. Christou, G.: The challenges of cybercrime governance in the European Union. Eur. Polit. Soc. **19**(3), 355–375 (2018)

16. Collier, B., Thomas, D.R., Clayton, R., Hutchings, A., Chua, Y.T.: Influence, infrastructure, and recentering cybercrime policing: evaluating emerging approaches to online law enforcement through a market for cybercrime services. Policing Soc. **32**(1), 103–124 (2021)

17. Cross, C.: Expectations vs reality: responding to online fraud across the fraud justice network. Int. J. Law Crime Justice **5**, 1–12 (2018)

18. DeKimpe, L., Ponnet, K., Walrave, M., Snaphaan, T., Pauwels, L., Hardyns, W.: Help, I need somebody: examining the antecedents of social support seeking among cybercrime victims. Comput. Hum. Behav. **108**, 106310 (2020)

19. Dlamini, S., Mbambo, C.: Understanding policing of cybercrime in South Africa: the phenomena, challenges and effective responses. Cogent Soc. Sci. **5**(1), 1675404 (2019)

20. Dremliuga, R.I., Korobeev, A.I., Mamychev, A.Y., Miroshnichenko, O.I.: Trends and methods of fighting cybercrime in the Russian Federation in terms of the transition to a digital economy. Laplage em Rev. **7**(2), 191–200 (2021)

21. Eboibi, F.E.: Concerns of cybercriminality in South Africa, Ghana, Ethiopia and Nigeria: rethinking cybercrime policy implementation and institutional accountability. Commonw. Law Bull. **46**(1), 78–109 (2020)

22. FBI IC3: Internet Crime Report 2021. Technical report I, FBI Internet Crime Complaint Center (IC3) (2021)

23. Fissel, E.R.: The reporting and help-seeking behaviors of cyberstalking victims. J. Interpers. Violence **36**(11–12), 5075–5100 (2021)

24. Hadlington, L.: Human factors in cybersecurity; examining the link between Internet addiction, impulsivity, attitudes towards cybersecurity, and risky cybersecurity behaviours. Heliyon **3**(7), e00346 (2017)

25. Hall, T., Sanders, B., Bah, M., King, O., Wigley, E.: Economic geographies of the illegal: the multiscalar production of cybercrime. Trends Organized Crime **24**(2), 282–307 (2021)

26. Hite, D.M., Voelker, T., Robertson, A.: Measuring perceived anonymity: the development of a context-independent instrument. J. Methods Meas. Soc. Sci. **5**(1), 22–39 (2014)

27. Humaidi, N., Balakrishnan, V.: Indirect effect of management support on users’ compliance behaviour towards information security policies. Health Inf. Manag. J. **47**(1), 17–27 (2018)

28. Ibrahim, S.: Social and contextual taxonomy of cybercrime: socioeconomic theory of Nigerian cybercriminals. Int. J. Law Crime Justice **47**, 44–57 (2016)

29. Internet live stats: internet live stats-internet usage social media statistics (2020)

30. Jadoon, A.K., Iqbal, W., Amjad, M.F., Afzal, H., Bangash, Y.A.: Forensic analysis of Tor browser: a case study for privacy and anonymity on the web. Forensic Sci. Int. **299**, 59–73 (2019)

31. Jerome, B.: Criminal investigation and criminal intelligence: example of adaptation in the prevention and repression of cybercrime. Risks **8**(3), 99 (2020)

32. Jhaveri, M.H., Cetin, O., Gaiian, C., Moore, T., Eeten, M.V.: Abuse reporting and the fight against cybercrime. ACM Comput. Surv. (CSUR) **49**(4), 1–27 (2017)

33. Kemp, S.: Fraud reporting in Catalonia in the Internet era: determinants and motives. Eur. J. Criminol. 1477370820941405 (2020)
34. Kshetri, N.: The simple economics of cybercrimes. IEEE Secur. Priv. 4(1), 33–39 (2006)

35. Kwak, Y., Lee, S., Damiano, A., Vishwanath, A.: Why do users not report spear-phishing emails? Telematics Inform. 48, 101343 (2020)

36. Lagazio, M., Sherif, N., Cushman, M.: A multi-level approach to understanding the impact of cybercrime on the financial sector. Comput. Secur. 45, 58–74 (2014)

37. MacDermott, A., Baker, T., Buck, P., Iqbal, F., Shi, Q.: The Internet of Things: challenges and considerations for cybercrime investigations and digital forensics. Int. J. Digital Crime Forensics 12(1), 1–13 (2020)

38. Mcanyana, W., Brindley, C., Seedat, Y.: Insight into the cyberthreat landscape in South Africa. Technical report (2020). https://www.accenture.com/_acnmedia/PDF-125/Accenture-Insight-Into-The-Threat-Landscape-Of-South-Africa-V5.pdf

39. Monteith, S., Bauer, M., Alda, M., Geddes, J., Whybrow, P.C., Glenn, T.: Increasing cybercrime since the pandemic: concerns for psychiatry. Curr. Psychiatry Rep. 23(4), 1–9 (2021)

40. Riek, M., Bohme, R.: The costs of consumer-facing cybercrime: an empirical exploration of measurement issues and estimates. J. Cybersecurity 4(1), tyy004 (2018)

41. Robinson, M., Jones, K., Janicke, H., Maglaras, L.: Developing cyber-peacekeeping: observation, monitoring and reporting. Gov. Inf. Q. 36(2), 276–293 (2019)

42. RSA National Treasury: Public Institutions Listed in Pfma Schedule 1, 2, 3a, 3B, 3C and 3D As At 30 April 2015. Technical report May, RSA National Treasury (2015). http://www.treasury.gov.za/legislation/pfma/publicentities/2015-04-30PublicinstitutionsSch1-3D.pdf

43. Saunders, M.: Research Methods for Business Students. Pearson (2014)

44. Stratton, G., Powell, A., Cameron, R.: Crime and justice in digital society: towards a ‘digital criminology’? Int. J. Crime Justice Soc. Democr. 6(2), 17 (2017)

45. Straub, D., Boudreau, M.C., Gefen, D.: Validation guidelines for IS positivist research. Commun. Assoc. Inf. Syst. 13(1), 24 (2004)

46. Tan, M.T., Teo, T.S.: Factors influencing the adoption of Internet banking. J. Assoc. Inf. Syst. 1(1), 5 (2000)

47. Touhill, G.: New study reveals cybercrime may be widely underreported even when laws mandate disclosure (2019)

48. Umlauf, M.G., Mochizuki, Y.: Predatory publishing and cybercrime targeting academics. Int. J. Nurs. Pract. 24, e12656 (2018)

49. Venkatesh, V., Brown, S.A., Bala, H.: Bridging the qualitative-quantitative divide: Guidelines for conducting mixed methods research in infomation systems. MIS Quart. Manag. Inf. Syst. 37(1), 21–54 (2013). https://doi.org/10.25300/MISQ/2013/37.1.02

50. Wang, H., He, D., Liu, Z., Guo, R.: Blockchain-based anonymous reporting scheme with anonymous rewarding. IEEE Trans. Eng. Manage. 67(4), 1514–1524 (2020). https://doi.org/10.1109/TEM.2019.2909529

51. Van de Weijer, S., Leukfeldt, R., Van der Zee, S.: Reporting cybercrime victimization: determinants, motives, and previous experiences. Policing 43(1), 17–34 (2020). https://doi.org/10.1108/PIJPSM-07-2019-0122/FULL/XML

52. Van de Weijer, S.G., Leukfeldt, R., Bernasco, W.: Determinants of reporting cybercrime: a comparison between identity theft, consumer fraud, and hacking. Eur. J. Criminol. 16(4), 486–508 (2019). https://doi.org/10.1177/1477370818773610

53. Srirama, S.N., Lin, J.-W., Bhatnagar, R., Agarwal, S., Reddy, P.K. (eds.): BDA 2021. LNCS, vol. 13147. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-93620-4