# Collateral Damage from Offensive Cyber Operations-- A Systematic Literature Review
## 4 Results
### Categories and Thematic Analysis  
The 74 included papers were read and analyzed from two perspectives: first according to the category or theme in which the paper discussed CCD and then according to the degree of prominence that this subject had within the scope of the text. The category of each publication was determined by first analyzing the title, keywords, abstract, and publication venue. The categorization was also informed by and drawn from the CCD research areas identified by [PERSON], [PERSON], and [PERSON] [28], given in Figure 3. The full text was then read with the goal of finding underlying themes--the \"red thread of underlying meanings, within which similar pieces of data can be tied together\" [22]. These themes were determined by first coding the text into keywords, e.g., as described by [PERSON], [PERSON], and [PERSON] [26]. The thematic coding process for an included paper is visualized in Figure 4. Recurring themes from the papers were then added to the list of surface categories to form the final list of categories. As an example, _legal research_ was identified in titles, abstracts, and publication venues, but taxonomies of cyber collateral damage were developed as a theme recurrently coded in the text. The thematic coding was considered complete when all codes that were found to recur both within and between papers had been identified and mapped to a theme. Themes recurring within three or more papers were assigned as a category. Figure 3: Research challenges in cyberwarfare according to [28]. The subject matter categories identified in the text can be expressed by the following questions, which describe the recurring subject matter among the papers:  
* Does this paper concern legal aspects of CCD and the (legal, rather than ethical) permissibility and constraints at play? * Does this paper concern the targeting of cyber operations specifically to avoid or minimize CCD? * Does this paper concern ethical aspects of CCD (frameworks and processes to determine whether an attack is justified)? * Does this paper concern the economically adverse outcomes of CCD and the potential costs to the target and civil society, e.g., by quantifying it? * Does this paper attempt to model and estimate CCD from the perspective of the attacker? * Does this paper seek to create a taxonomy or definition of CCD types? The distribution of papers matching each category is given in Table 2, and the corresponding papers are described in their respective subsections. Few papers covered more than one of these questions in depth, and several papers covered none of them. The disjunct nature of these clusters can be taken to mean that the research areas are only weakly interrelated in current practice. The level of prominence afforded to CCD in the paper was evaluated, and the papers were categorized according to whether they took cyber collateral damage as their main topic (numerically represented as 3), whether they repeatedly or deeply touched upon the topic (2), or whether they mentioned it only briefly or in passing or discussed collateral damage \begin{table}
\begin{tabular}{c c} \hline \hline
**Topic (Cluster)** & **Number of Papers** \\ \hline Legal & 24 \\ Targeting & 16 \\ Ethical & 14 \\ Econometric & 8 \\ Estimation, modeling, and assessment & 5 \\ Taxonomy & 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Categories of subjects in CCD papers. Figure 4: Statements, keywords, codes, and themes in [29]. without distinguishing it as a separate topic (1). The distribution of papers according to prominence is given in Table 3.  
The included papers and their respective levels of prominence are listed in Table 2. The rest of Section 4 describes each category of papers listed in Table 2 in turn and describes the relevant contents of each paper with a prominence rating of two or higher. The following subsections begin with tables (Tables 4 and 5) listing key papers in the described categories, with some papers appearing in multiple categories.