Cyber Security Politics

Socio-Technological Transformations and Political Fragmentation

Myriam Dunn Cavelty, Andreas Wenger, Myriam Dunn Cavelty, Andreas Wenger

• Editorial: Routledge
• Año: 2022
• ISBN:
  9781000567137
• Edición: 1
• Categoría: Politica e relazioni internazionali
• Categoría: Sicurezza nazionale

This book examines new and challenging political aspects of cyber security and presents it as an issue defined by socio-technological uncertainty and political fragmentation.

Structured along two broad themes and providing empirical examples for how socio-technical changes and political responses interact, the first part of the book looks at the current use of cyber space in conflictual settings, while the second focuses on political responses by state and non-state actors in an environment defined by uncertainties. Within this, it highlights four key debates that encapsulate the complexities and paradoxes of cyber security politics from a Western perspective – how much political influence states can achieve via cyber operations and what context factors condition the (limited) strategic utility of such operations; the role of emerging digital technologies and how the dynamics of the tech innovation process reinforce the fragmentation of the governance space; how states attempt to uphold stability in cyberspace and, more generally, in their strategic relations; and how the shared responsibility of state, economy, and society for cyber security continues to be re-negotiated in an increasingly trans-sectoral and transnational governance space.

This book will be of much interest to students of cyber security, global governance, technology studies, and international relations.

The Open Access version of this book, available at www.taylorfrancis.com, has been made available under a Creative Commons Attribution-Non Commercial-No Derivatives 4.0 license.

1 IntroductionCyber security between socio-technological uncertainty and political fragmentation

Myriam Dunn Cavelty and Andreas Wenger

DOI: 10.4324/9781003110224-1

In the past decade, cyber security has consolidated its position as one of the top national security issues of the 21st century: The dynamic interaction between technological vulnerabilities and the possibilities of their political misuse creates a problem space with little stability. Due to enduring uncertainties about the scope and tempo of ongoing socio-technological transformations, an increasing willingness to use disruptive cyber tools in the context of great power rivalry, and significant fragmentation of authority and accountability on different levels, managing cyber insecurities continues to be a most challenging governance issue in contemporary politics.

Cyber security is challenging because it is a so-called “wicked problem”. Cyber security is “transboundary in nature, occur[s] at multiple levels across sectors, between institutions, and will impact all actors, both public and private, in complex, interconnected, and often highly politicised ways” (Carr and Lesniewska 2020: 392). Wicked problems avoid straightforward definitions and are impossible to solve in simple or final ways because they are composed of many interdependent factors that are often in flux (Rittel and Weber 1973). In addition, involved stakeholders have divergent values, goals, and motivations when it comes to the issue, making it difficult to find solutions that satisfy everyone to a sufficient degree.

As a politically relevant problem, cyber security evolves at the intersection between fast-paced technological development, the political and strategic use of these tools by state and non-state actors, and the various attempts by the state and its bureaucracies, society, and the private sector to define appropriate responsibilities, legal boundaries, and acceptable rules of behavior for this space. Our edited volume sheds light on socio-technical uncertainties and political responses. In 16 chapters, we highlight different facets of this problem space, showing how cyber security challenges states, private actors, and civil society in multiple ways because of dynamic, unforeseeable changes arising from the complex interactions between technical and social systems that have mounting political significance.

Socio-technical uncertainties in complex systems

Cyberspace is a complex socio-technical system. Three points are important in this context: First, cyberspace is brought into being by technologies that are made by humans. What might seem like a somewhat banal statement at first has considerable consequences that are not in the least banal consequences for how to conceptualize cyber security. The intentions, norms, and values of technological developers find their way into the artifacts during the design stage, while existing power structures influence the desirability of specific aspects or forms of technology (Matthewman 2011; Krause 2019). Hence, technologies are to be treated as inseparable from politics and vice versa, which necessitates analytical approaches that are sensitive to how technologies are shaped by political contexts and in turn enable specific political actions in the security domain. Just as importantly, economic forces influence many aspects of technical innovation and shape the availability of products and services to counter cyber risks (Lindsay 2017; Burkart and McCourt 2017). There is no thorough understanding of how economic and political factors interact in the literature yet.

Second, cyberspace is not independent but is closely intertwined with other systems such as the energy network – which in turn depends on communication infrastructure, creating co-dependencies. Important infrastructures and services and their respective interdependencies with digital infrastructures matter in the security discourse because they are crucial for the functioning of society – in fact, cyber security has reached the level of a key national security issue predominantly due to how the topic was interlinked with the critical infrastructure debate in the political process (Collier and Lakoff 2008). In addition, the cyber security discourse has changed considerably over the last 20 years: Cyber security is moving upward in the political agenda and expanding sideways as a problem area to a multitude of additional policy domains with advancing digitalization (Dunn Cavelty and Egloff 2019). As the currently last, important development, the cyber-incidents during the US elections in 2016 – attributed to the Russian government as well as semi-state actors – started a new chapter in the cyber security debate. The hack and leak operations highlighted the issue of strategic manipulation – also called influence operations – as a threat to democratic processes (Whyte 2020). While influence operations are far from new, the current technological environment affords different actors with new opportunities.

Third, cyberspace consists of multiple interactions between the underlying technology and its human users and operators. It is human interaction with technology – and the interaction between humans by means of technologies – that creates cyberspace in the first place. Furthermore, the growing complexity and nonlinear behavior of a complex system, like cyberspace, leads to a growing probability of unexpected disruptive events – from internal accidents to malicious attacks from both inside and outside the system (Hiermaier and Scharte 2019). Growing complexity offers new incentives and possibilities to threat actors to target people and assets in and through cyberspace. These varied interactions with technology introduce a specific type of uncertainty: It is an ontologically intrinsic type of uncertainty linked to human decisions, making us “part of the problem, system and potential solutions” (Sword Daniels et al. 2018: 291).

Political responses and emergent governance arrangements

As a wicked problem, cyber security is notoriously hard to pin down and is contested politically on conceptual and practical grounds in both national and international arenas. This is little surprising, given that security is an essentially contested concept to begin with – one whose proper use “inevitably involves endless disputes about their proper uses on the part of their users” (Gallie 1956: 169). If we consider security politics as “interactions through which values are allocated authoritatively for a society” (Easton 1965: 21), it becomes clear that defining the parameters of any type of security is always about difficult political choices, because the identification of valuable objects in need of protection from particular threats assigns legitimate claims to protection to some security objects and political subjects, but not to others.

In line with this, the “security” in cyber security means fundamentally different things to different communities. On a basic level, the security of digital technologies is grounded in risk management practices developed by computer specialists to make computers and computer networks more secure. Yet, cyber security is more than information security: Rather than just seeking to protect information assets it also extends to humans and their interests (Von Solms and Van Niekerk 2013). Moreover, decisive for the elevation of the issue from a technical to a security political issue was the realization in the 1990s that a set of high-value assets, so-called critical infrastructures, whose disruption or destruction could have severe consequences for a nation, were getting increasingly dependent on digital technologies for a variety of functions (Dunn Cavelty 2008). The related threat discourse that emerged consists of two interlinked factors, linking technical systems to more traditional threat politics: An outward-looking focus that sees an increasing willingness of malicious actors to exploit the weaknesses inherent in our societies without hesitation or restraint. This is coupled with an inward-looking focus on system-inherent vulnerabilities in (computer) systems. Beyond the technical realm, cyber security has become a type of security that refers to offensive and defensive activities of state and non-state actors in cyberspace, serving the pursuit of wider security political goals through the exploitation of various related opportunities (Deibert and Rohozinski 2010).

That said, the right role of the state in cyber security matters remains politically contested because cyber security is not only about national security. The question is not whether there is a role for the state – but who should have what kind of role and responsibility in different governance arrangements that aim to enhance national and international security (Dunn Cavelty and Egloff 2019). Obviously, states alone cannot ensure an increase of cyber security, not least because many crucial networks are in private hands. Hence, cyber security politics are defined by national and international negotiation processes about the boundaries of the responsibilities of state, economic, and societal actors and the agreement or disagreement over the means these actors use (Dunn Cavelty and Wenger 2020).

Fragmentation of political power can occur through decentralization when government tasks and authority are delegated downward (localization), upward (supranationalization), or sideway (privatization). It also takes place inside the government itself through ever-increasing functional differentiation of the administration. Increasingly, performing tasks requires highly specific expert knowledge. The increasing division of labor, a hallmark of modern societies, blurs the lines between the public and the private sectors. Many tasks that were previously performed by the state are now handled by specialized companies. This reshuffling of responsibility and power is ongoing and probably one of the defining features of cyber security politics.

The objective and structure of the book

The main objective of this book is to portray how technological developments interact with broader sociopolitical and socioeconomic dynamics that call for different national and international political responses. To that end, we bring together innovative, interdisciplinary conceptualizations of a changing threat landscape and explore how national and international governance solutions interact with this environment.

We understand the politics of cyber security as follows: As the interplay between digital technologies, their development, their use and misuse by human actors in conflictual economic, social, and political contexts, and the enduring negotiation processes between politically relevant actors about their roles and responsibilities in governing this problem space. There is an international security dimension, with state actors trying to shape and use cyberspace in accordance with their strategic goals – while at the same time attempting to stabilize the strategic environment through the development of behavioral norms (Dunn Cavelty and Wenger 2020). In addition, there is a domestic dimension, where states and their bureaucracies negotiate roles and responsibilities with civil society actors and the private sector. Our volume will combine national and international, state and non-state, technical, social, economic, and political perspectives, paying tribute to the complex environment in which cyber security is situated. The book has two main parts: the first focuses on the changing socio-technical environment and its implications for political action, while the second deals with the political responses.

Part I: The changing socio-technological environment and its impact on cyber threats

A first group of chapters focuses on the choice for and effects of cyber influence operations against the backdrop of domestic and international political fragmentation, heightened geopolitical tensions, and international disagreements about accepted political behavior in cyberspace. Though the use of disinformation in conflictual contexts is not a novel phenomenon, it has emerged as a new focal point in contemporary cyber security politics. One of the key questions that the scholarly community should strive to answer is why cyber influence operations have become so interesting of late, what actual impact they have and how we can best study said impact, and what can be done against potentially destabilizing effects. Three chapters in the book give partial answers to these questions.

Marie Baezner and Sean Cordey outline recent trends in cyber operations, showing how different actors in conflictual settings exploit conceptual and legal grey zones (Baezner and Cordey 2022). The chapter thus explores why cyber influence operations have become one of the more interesting tools for both state and non-state actors, even if purposeful strategic impact might be elusive. At the macro level, this trend is due to the overarching political fragmentation, intensification of international rivalries, costly and complex interdependences, relative imbalance in military power/capabilities, and socio-technological vulnerabilities. At the micro and operational-technical level, the relative availability and accessibility of cyber tools coupled with the flexibility, customizability, rapidity, scalability, and limited escalation potential of cyber operations is the main driver for their use. Supported by examples from a range of operations observed in the last few years, the chapter shows the reader that cyber operations, which include cyber influence operations, are efficient and effective tools for disruption and at the same time enhance and transform traditional grey zone activities, such as espionage and influence. It is rather likely therefore that we will see more of this kind of operations in the future. But what are their impacts?

In his chapter, Wolf Schünemann adds to our understanding of the phenomenon and its political impact (Schünemann 2022). Analyzing the existing literature about influence operations, he asks what the contributions and findings are in terms of theory, methods, and empirics and looks at whether there is good empirical evidence that disinformation has a destabilizing effect on democracies. With a three-layered distinction between a micro, a meso, and a macro level of analysis at which distortion and influence can be measured, the chapter includes three perspectives of importance for a solid threat assessment of disinformation campaigns. Moreover, with echo chambers and automation, Schünemann refers to phenomena that are widely associated with the structural transformation of the digital public sphere and are assumed to be facilitating factors for the spread of disinformation. The chapter finds, however, that just like with disinformation in general, their alleged effects are very difficult to prove – thereby adding to the overall uncertainty political actors find themselves in.

Noting that countermeasures need to be drafted carefully since our understanding of the overall challenge is incomplete at best, Schünemann passes the ball to the next chapter in the volume. Based on the notions of cultural violence and cultural peace, the chapter by Jasmin Haunschild, Marc-André Kaufhold, and Christian Reuter shows the potential for political fragmentation through social media, focusing on fake news and terrorist propaganda, and their amplified dissemination through social bots. They show that technology plays an ambiguous role, on the one hand being an amplifier and enabler of effects such as astroturfing and smoke screening, but on the...

Índice

• Cover
• Half-Title
• Series
• Title
• Copyright
• Contents
• List of illustrations
• Note on Contributors
• Acknowledgments
• 1 Introduction: Cyber security between socio-technological uncertainty and political fragmentation
• PART I Socio-technical transformations and cyber conflict trends
• PART II Political responses in a complex environment
• Index