Depends on selection criteria
How would you do it?
Stopping people in the street is inherently biased as it only surveys people who will stop, and who the researchers feel able to ask.
Self-selected (online) surveys like El Reg, newspapers and the like runs are statistically useless for population, as you only survey people who feel strongly about the issue and know about the survey, so you can easily get the result you want by how you advertise it.
Which leaves phone surveys. These have other problems of course, as not everyone has a phone or would answer it.
The ONS are reasonably good at both selection and understanding - and publishing - the errors it creates.
There's also other places to cross-check whether the numbers are plausible, like phishing reporting systems and the like.
Eg they say it's probably an underestimate, presumably because someone who's suffered from a data breach is unlikely to talk to a survey.
Biting the hand that feeds IT
