Pew Research Center Cybersecurity Report: Data, Trends, and Analysis

This report summarizes the findings of the Pew Research Center's study, "Americans and Cybersecurity," released in January 2017. The study, based on a national survey of 1,040 adults conducted in the spring of 2016, explores Americans' experiences with and attitudes toward cybersecurity. Key findings reveal that a majority of Americans have experienced data breaches, lack trust in institutions like the federal government and social media sites to protect their data, and often neglect cybersecurity best practices, such as using password management software. The report also highlights concerns about the security of personal information, the use of public Wi-Fi, and the ongoing debate around encryption. Despite these concerns, many Americans do not express profound worries about cybersecurity in their personal lives. The report offers insights into the public's perception of cybersecurity threats and the actions they take, or fail to take, to protect their digital lives, providing valuable information about current trends and challenges in the digital landscape.

FOR RELEASE JANUARY 26, 2017
Americans and
Cybersecurity
Many Americans do not trust modern institutions to protect their
personal data – even as they frequently neglect cybersecurity best
practices in their own personal lives
BY Kenneth Olmstead and Aaron Smith
FOR MEDIA OR OTHER INQUIRIES:
Lee Rainie, Director, Internet, Science and
Technology Research
Aaron Smith, Associate Director, Research
Dana Page, Senior Communications Manager
202.419.4372
www.pewresearch.org
RECOMMENDED CITATION: Pew Research Center, January, 2017, “Americans and Cybersecurity”
NUMBERS, FACTS AND TRENDS SHAPING THE WORLD

1
PEW RESEARCH CENTER
www.pewresearch.org
About Pew Research Center
Pew Research Center is a nonpartisan fact tank that informs the public about the issues, attitudes
and trends shaping America and the world. It does not take policy positions. The Center conducts
public opinion polling, demographic research, content analysis and other data-driven social
science research. It studies U.S. politics and policy; journalism and media; internet, science and
technology; religion and public life; Hispanic trends; global attitudes and trends; and U.S. social
and demographic trends. All of the Center’s reports are available at www.pewresearch.org. Pew
Research Center is a subsidiary of The Pew Charitable Trusts, its primary funder.
© Pew Research Center 2017

2
PEW RESEARCH CENTER
www.pewresearch.org
Americans and Cybersecurity
Many Americans do not trust modern institutions to protect their
personal data – even as they frequently neglect cybersecurity best
practices in their own personal lives
Cyberattacks and data breaches are facts of life for government agencies, businesses and
individuals alike in today’s digitized and networked world. Just a few of the most high-profile
breaches in 2016 alone include the hacking and subsequent release of emailsfrom members of the
Democratic National Committee; the release of testing records of dozens of athletes conducted by
the World Anti-Doping Agency; and the announcement by Yahoo that hackers had accessed the
private information associated with roughly 1 billion email accounts. Finally, in late 2016 and ear
2017 U.S. intelligence agencies (the FBI, CIA and Department of Homeland Security) both issued
statements andtestified before Congress that the Russian government was involved in the hack of
the DNC with the aim of influencing the 2016 presidential election.
Previous Pew Research Center studies of the digital privacy environment have found that many
Americans fear they have lost control of their personal information and many worrywhether
government agencies and major corporations can protect the customer data they collect. As part
thisongoing series of studies on the state of online privacy and security, the Center conducted a
national survey of 1,040 adults in the spring of 2016 to examine their cybersecurity habits and
attitudes. This survey finds that a majority of Americans have directly experienced some form of
data theft or fraud, that a sizeable share of the public thinks that their personal data have become
less secure in recent years, and that many lack confidence in various institutions to keep their
personal data safe from misuse. In addition, many Americans are failing to follow digital security
best practices in their own personal lives, and a substantial majority expects that major
cyberattacks will be a fact of life in the future. Among the key findings:
A majority of Americans (64%) have personally experienced a major data breach, and
relatively large shares of the public lack trust in key institutions – especially the federal
government and social media sites – to protect their personal information
Data security is a personal issue for many Americans: The survey finds that a majority of the
public has noticed or been notified of a major data breach impacting their sensitive accounts or
personal data. The survey examined several different types of data theft and found that 64% of
U.S. adults have been impacted by at least one of them:
 41% of Americans have encountered fraudulent charges on their credit cards.

3
PEW RESEARCH CENTER
www.pewresearch.org
 35% have received notices
that some type of sensitive
information (like an
account number) had been
compromised.
 16% say that someone has
taken over their email
accounts, and 13% say
someone has taken over
one of their social media
accounts.
 15% have received notices
that their Social Security
number had been
compromised.
 14% say that someone has
attempted to take out
loans or lines of credit in
their name.
 6% say that someone has
impersonated them in
order to file fraudulent tax
returns.
And beyond these specific experiences, roughly half of Americans (49%) feel that their personal
information is less secure than it was five years ago. Around one-in-five (18%) feel that their
information has gotten more secure in recent years, while 31% feel that their information is abou
as safe as it was five years ago. Americans age 50 and older are especially likely to feel that their
personal information has become less safe in recent years: 58% of Americans in this age group
express this opinion, compared with 41% of those ages 18 to 49.
In addition, many Americans lack faith in various public and private institutions to protect their
personal information from bad actors. They express some level of concern about a variety of
entities, ranging from telecommunications firms to credit card companies. But their fears are
especially pronounced for two institutions in particular: the federal government and social media
platforms. Some 28% of Americans are not confident at all that the federal government can keep
their personal information safe and secure from unauthorized users, while 24% of social media
users lack any confidence in these sites to protect their data. By contrast, just 12% of Americans
Roughly half of Americans do not trust the federal
government or social media sites to protect their data
% of U.S. adults/tech users (see note below) who are ___ in the ability of the
following institutions to protect their data
Note: Data on cellphone manufacturers and service providers based on cellphone owners;
data on email providers based on internet users; data on social media sites based on social
media users. Data for credit card companies recalculated to exclude “does not apply”
responses. Otherwise, refusals and “does not apply” responses not included in this chart.
Source: Survey conducted March 30-May 3, 2016.
“Americans and Cybersecurity”
PEW RESEARCH CENTER

4
PEW RESEARCH CENTER
www.pewresearch.org
(and 9% of social media users) have a very high level of confidence that these entities can keep
their personal information safe and secure.
Many Americans fail to follow cybersecurity best practices in their own digital lives
At the same time that they express skepticism about whether the businesses and institutions they
interact with can adequately
protect their personal
information, a substantial
share of the public admits
that they do not always
incorporate cybersecurity
best practices into their own
digital lives.
This lack of adherence to best
practices begins with the
ways that Americans keep
track of the passwords to
their online accounts.
Cybersecurity experts
generally recommend
password management
software as the safest and
most secure way to track and
maintain online passwords.
Still, just 12% of internet
users say that they ever use password management software themselves – and only 3% say that
this is the password technique they rely on most. Instead, roughly two-thirds (65%) of internet
users say that memorization is the main or only way they keep track of their online passwords –
and another 18% rely primarily on writing their passwords down on a piece of paper. In other
words, fully 84% of online adults rely primarily on memorization or pen and paper as their main
(or only) approach to password management.
A substantial share of Americans are taking steps or following password protection strategies tha
experts recommend against:
Most Americans keep track of their online passwords
by either memorizing them or writing them down
% internet users who keep track of their online passwords in the following
ways
Note: Results for “use most often” category include those who use only one technique to
manage their passwords.
Source: Survey conducted March 30-May 3 2016.
“Americans and Cybersecurity”
PEW RESEARCH CENTER

5
PEW RESEARCH CENTER
www.pewresearch.org
Cybersecurity resources
Cybersecurity experts recommend a
number of “best practices” and
resources for consumers to minimize
their exposure to security breaches.
General information on cybersecurity:
National Cyber Security Alliance
StaySafeOnline.org
Consumer information on online security
from the Federal Trade Commission
Top-10 safe computing tips from
Information Systems and Technology at
MIT
Password management:
7 password experts on how to lock down
your online security
PC Magazine: The best password
managers of 2017
Using public Wi-Fi:
How to stay safe on public Wi-Fi
If your account has been hacked:
FBI Internet Crime Complaint Center
 41% of online adults have shared the password to one of their online accounts with a friend or
family member.
 39% say that they use the same (or very similar) passwords for many of their online accounts.
 25% admit that they often use passwords that are
less secure than they’d like, because simpler
passwords are easier to remember than more
complex ones.
The survey also finds that Americans are not always
vigilant in the context of mobile security. For
instance, 28% of smartphone owners report that they
do not use a screen lock or other security features in
order to access their phone, while around one-in-ten
report that they never install updates to their
smartphone’s apps or operating system. Meanwhile,
54% of online adults report that they utilize
potentially insecure public Wi-Fi networks – with
around one-in-five of these users reporting that they
use these networks to perform sensitive activities
such as e-commerce or online banking.
To be sure, the story of cybersecurity is far from
universally negative. For instance, roughly half of
online adults (52%) report that they use two-step
authentication on at least some of their online
accounts. And majorities indicate that they do in fact
take recommended steps such as utilizing different
passwords from site to site or placing a security
feature on their smartphones. But overall, the way
that users treat and manage their online passwords
and their overall digital security can be described as
mixed at best.

6
PEW RESEARCH CENTER
www.pewresearch.org
Cybersecurity is not a top-of-mind worry for most Americans
Despite their concerns and experiences, most Americans do not express profound worries about
cybersecurity in their personal lives or in their expectations for various public institutions.
In the context of their personal lives, fully 69% of online adults say they do not worry about how
secure their online passwords are – more than double the share (30%) that admits to having
worries about their personal password security. And Americans who have personally experienced
major data breach are generally no more likely than average to take additional means to secure
their passwords (such as using password management software).
More broadly, a substantial majority of Americans anticipate major cyberattacks in the next five
years on our nation’s public infrastructure (70% expect that this will happen) or banking and
financial systems (66%). Yet a majority of Americans feel that the U.S. government is at least
somewhat prepared to handle cyberattacks on our public infrastructure (62%) or government
agencies (69%), while 61% have some confidence that U.S. businesses are prepared to handle
attacks on their own systems. However, it is worth noting that this survey was fielded prior to the
revelations of some more recent, high-profile data breaches, including the hacking of the DNC
email system and the breach of email accounts of Yahoo customers.
Americans continue to be highly divided on the issue of encryption
Americans remain divided on the issue of encryption: 46% believe that the government should be
able to access encrypted communications when investigating crimes, while 44% believe that
technology companies should be able to use encryption tools that are unbreakable even to law
enforcement. Democrats and younger adults tend to express greater support for strong encryptio
while Republicans tend to express greater support for encryption protocols that can be accessed
law enforcement in the context of criminal investigations.

7
PEW RESEARCH CENTER
www.pewresearch.org
Younger Americans express elevated support for unbreakable encryption standards
% of U.S. adults who agree with each statement
Source: Survey conducted March 30-May 3 2016.
“Americans and Cybersecurity”
PEW RESEARCH CENTER

8
PEW RESEARCH CENTER
www.pewresearch.org
1. Americans’ experiences with data security
Virtually any digital action that internet users may take – from using credit cards to logging into
social media sites – creates data that is stored by companies, governments or other organizations
And when those data are stored, they present opportunities for theft or misuse. This chapter
examines the basic contours of the cybersecurity environment for individuals, including: the types
of online accounts Americans have, their experiences with various types of data theft, and their
overall concerns about the safety and security of their digital information.
The survey illustrates the wide-reaching exposure that many Americans have to the world of
cybersecurity. Nearly two-thirds of all Americans (64%) have at least one online account that hold
their health, financial or other sensitive personal information. And a similar share (64%) have
experienced or been notified of a significant data breach pertaining to their personal data or
accounts. More broadly, roughly half the public feels their data have gotten less secure in recent
years. Any many Americans express a lack of confidence in various institutions – most notably, the
federal government and social media platforms – to safeguard and protect their personal
information.
64% of Americans have an online account involving health, financial or other sensitive data
All sorts of online services – from email or social media sites to news or e-commerce platforms –
require users to create an account in order to take advantage of them. But some of these services
compel users to submit highly personal or sensitive information, such as details of users’ financial
records or medical history. And these highly sensitive records can be especially damaging if other
gain access to them and exploit them. The survey asked about four general categories of these
“high value” accounts and found that:
 55% of Americans report having an online account with banks or other financial service
providers.
 36% have an online account with household utility providers.
 32% have an online account with their healthcare providers.
 39% have some other kind of online account that involves bill payments or transactions.
All told, 64% of Americans maintain at least one of the online accounts listed above. College
graduates and those with higher household incomes are especially likely to report having all four
types of online accounts. For example, half or more of Americans with annual household incomes
of $50,000 or more indicate having an online account with banks or financial institutions (73%),
utility providers (55%), healthcare providers (50%) or some other type of institution with which
they make online transactions (54%). Meanwhile, 42% of Americans in households earning less

9
PEW RESEARCH CENTER
www.pewresearch.org
41
35
16
15
14
13
6
64
Noticed fraudulent charges
on their credit card
Received a notice that
personal information had
been compromised
Had their social media account
taken over without permission
Had their email account
taken over without permission
Received notice their social
security number was
compromised
Had a loan or line of credit
taken out in their name
Had a tax refund taken
out in their name
Any of these
than $50,000 per year have an online account with banks or financial institutions and only around
one-quarter have an account with utility providers (22%), healthcare providers (18%) or other
types of service providers (27%).
Similarly, around three-quarters of college graduates (77%) have an online account with financia
institutions, while half or more have online accounts with healthcare providers (53%), utility
providers (52%) or some other types of service providers (58%).
Nearly two-thirds of Americans have
experienced some form of data theft
The broader debate over cybersecurity and the
safety of Americans’ personal data is taking
place in an environment where a significant
share of the public has personally experienced
some type of data theft.
The survey asked about seven different types
of identity or data theft that Americans might
be exposed to and found that several are
particularly widespread. Some 41% of
Americans have learned they were the victims
of a data breach by seeing fraudulent charges
on their credit or debit cards. Around one-
third (35%) of Americans have received
notices that some sort of sensitive personal
information – like an account number – had
been compromised, and 15% have received
notices that their social security number,
specifically, had potentially fallen into the
wrong hands.
In other cases, the public experiences data
breaches in the context of their major online
accounts: 16% of Americans have had
someone take over their email accounts
without their permission, while 13% say that
someone has hacked or taken over one of their social media accounts.
Many Americans have experienced
some form of data theft
% of U.S. adults who have ever …
Source: Survey conducted March 30-May 3 2016.
“Americans and Cybersecurity”
PEW RESEARCH CENTER

10
PEW RESEARCH CENTER
www.pewresearch.org
In addition to these breaches, a notable share of Americans have experienced even more severe
forms of data theft. Some 14% of Americans report that someone has attempted to open lines of
credit or take out loans using their name, while 6% have had someone impersonate them to try
and claim tax refunds. All told, nearly two-thirds of Americans (64%) report that they have
experienced at least one of these seven types of data theft.
Americans in their early 30s through mid-60s are especially likely to have encountered many of
these forms of data theft. Nearly half (48%) of Americans ages 30 to 64 have noticed fraudulent
charges on their credit cards, while around one-in-five (19%) have received notices that their soci
security number was compromised. Overall, nearly three-quarters of Americans in this age range
(72%) have experienced at least one of the seven types of breaches (compared with 55% of those
ages 18 to 29 and 50% of those 65 and older). Along with Americans in this age range, college
graduates (78% of whom have experienced at least one of these breaches) and those with
household incomes of $75,000 or more per year (77%) are also relatively likely to have
encountered these various types of data theft.
Many Americans lack trust in key institutions – especially the federal government and
social media sites – to protect their personal information
When asked whether they have confidence in various companies and institutions to keep their
personal records safe from unauthorized users, Americans’ views are decidedly mixed. Some
institutions – such as telecommunications firms and credit card companies – inspire relatively
broad confidence. In total, around seven-in-ten cellphone owners are very (27%) or somewhat
(43%) confident that the companies that manufactured their cellphones can keep their personal
information safe; a similar share is very (21%) or somewhat (47%) confident that the companies
that provide their cellphone services will protect their information.
Similarly, around two-thirds of online adults are either very (20%) or somewhat (46%) confident
that their email providers will keep their information safe and secure. And roughly six-in-ten
Americans are very (23%) or somewhat (36%) confident that their credit card companies can
protect their personal information. Other companies and retailers are viewed slightly less
confidently: 14% of Americans are very confident (and 46% are somewhat confident) that these
entities will keep customers’ information safe.

11
PEW RESEARCH CENTER
www.pewresearch.org
But even as a majority of Americans express at least some confidence in each these institutions, in
each instance a notable minority expresses no confidence at all in the ability of these entities to
protect their personal data.
And some institutions – in
particular, the federal
government and social media
platforms – are viewed with
skepticism by a substantial
share of the public when it
comes to protecting users’
personal records. Fully 28% of
Americans are not at all
confident that the federal
government can protect their
personal information (just 12%
are very confident). And 24%
of social media users are not at
all confident in the ability of
these sites to keep their
personal information safe –
nearly three times the share of
social media users (9%) who
have a great deal of confidence
in these companies.
Overall, there is relatively little variation in Americans’ attitudes towards these entities based on
their demographic characteristics. However, users who have directly experienced certain types o
data theft in their own lives tend to have lower levels of confidence in the institutions that were
involved in these experiences – particularly when it comes to digital institutions, such as email an
social media. Some 22% of Americans who have had their email accounts accessed without their
permission are not at all confident in the ability of their email providers to keep their personal
information secure – that is double the share (11%) among those who have not directly
experienced an email breach themselves. And 40% of those who have experienced a breach of the
social media accounts are not at all confident that these platforms can protect their personal
information – again double the share (20%) among those who have not had their social media
accounts accessed in this way.
Roughly half of Americans do not trust the federal
government or social media sites to protect their data
% of U.S. adults/tech users (see note below) who are ___ in the ability of the
following institutions to protect their data
Note: Data on cellphone manufacturers and service providers based on cellphone owners;
data on email providers based on internet users; data on social media sites based on social
media users. Data for credit card companies recalculated to exclude “does not apply”
responses. Otherwise, refusals and “does not apply” responses not included in this chart.
Source: Survey conducted March 30-May 3, 2016.
“Americans and Cybersecurity”
PEW RESEARCH CENTER