In this chapter, we present the research design of the two survey waves, which were administered between June and August 2016 and November 2017 and February 2018, respectively. We start with a brief discussion of the contents of the surveys, and continue with the sample construction process and some information about the final sample. Next, we describe how we constructed the scales from the items questioned. In the final section, we explain the analytical procedures we have followed.

QUESTIONNAIRE

In both waves, we have operationalized the key concepts in a questionnaire, which we have administered via a web-based survey. In the first part of the questionnaire, we have asked several general questions to enable the categorization of the businesses according to, inter alia, their size and economic sector. In both waves, the bulk of the questionnaire was structured on the basis of the cybercrime typology introduced in the earlier sections. For each type of cybercrime, the questionnaire followed a similar format and entailed five (sets of) questions to fulfil the study objectives.

The first question asked the respondents how oft en their business had been confronted with the selected cybercrime type in the past 12 months. The eight possible answers– ranging from never to hundreds of times a day – served to direct respondents to the next set of questions. If the answer was never, the survey immediately proceeded to the fift h set of questions. In the case of single (once) or multiple victimization (a few times up to a hundreds of times a day), respondents were expected to answer the following sets of questions for this incident. In the case of multiple victimization, we asked the respondents to distinguish in the following sets of questions between the last and the most serious incident for all types.29 As illegal access to IT systems occurs much more frequently than the others (e.g., Clough, 2010: 59; Wall, 2007: 53–54), we asked the respondents to consider also all the “illegal access to IT systems” incidents that occurred during the past 12 months together.

The second set of questions entailed a specification of the incident. We started with a question to specify the incident.