Critical Discourse Analysis

We employed critical discourse analysis to examine the primary sources, focusing on words and phrases with ideological associations and metaphorical content in framing security crises (Gill 2000). This method allowed us to identify the values, beliefs, and assumptions communicated within and across the cases. Our aim with discourse analysis was to understand the “creation and composition” of data breaches as security crises (Liebetrau & Christensen 2021) and how the framing of data breaches in this way connects to the social, political and historical contexts in which these events circulate.¹

Using discourse analysis, the research team employed a two-fold approach to data collection and analysis. First, for each data breach case, we created summaries for each primary source and developed a higher-level narrative for each case, noting the descriptions and metaphors used to characterize perpetrators, breach framing, perceived risk, victims, and data. Second, we entered these observations into an Excel spreadsheet, tracking the language and expressions used to describe the victims, perpetrators, breach, data compromised, and crisis framing.¹

The analysis focused on how news media construe data breaches as crises. However, we did not aim to define data breaches solely through these representations or track discursive changes over time. Instead, we understand these security crisis discourses as examples of what Michel Foucault described as “normalizing discourses.”^{2 3} In short, we traced the factors that contributed to framing a data breach as a security crisis. Our research reveals how the production, negotiation, and management of data breaches as security crises emerge from a cultural matrix of meaning.^{1 4}

---