Routledge Handbook of International Cybersecurity

Eneken Tikk, Mika Kerttunen, Eneken Tikk, Mika Kerttunen

• Publisher: Routledge
• Year: 2020
• ISBN:
  9781351038881
• Edition: 1
• Topic: Politik & Internationale Beziehungen
• Subtopic: Nationale Sicherheit

The Routledge Handbook of International Cybersecurity examines the development and use of information and communication technologies (ICTs) from the perspective of international peace and security.

Acknowledging that the very notion of peace and security has become more complex, the volume seeks to determine which questions of cybersecurity are indeed of relevance for international peace and security and which, while requiring international attention, are simply issues of contemporary governance or development. The Handbook offers a variety of thematic, regional and disciplinary perspectives on the question of international cybersecurity, and the chapters contextualize cybersecurity in the broader contestation over the world order, international law, conflict, human rights, governance and development.

The volume is split into four thematic sections:

• Concepts and frameworks;

• Challenges to secure and peaceful cyberspace;

• National and regional perspectives on cybersecurity;

• Global approaches to cybersecurity.

This book will be of much interest to students of cybersecurity, computer science, sociology, international law, defence studies and International Relations in general.

Chapter 30 of this book is freely available as a downloadable Open Access PDF at http://www.taylorfrancis.com under a Creative Commons Attribution-Non Commercial-No Derivatives (CC-BY-NC-ND) 4.0 license.

PART I

Concepts and frameworks

1

CYBERSECURITY BETWEEN HYPERSECURITIZATION AND TECHNOLOGICAL ROUTINE

Myriam Dunn Cavelty

In 2006, detecting ‘great difficulties for theoretical adaptation and application in analyses of the complexities of the emerging new digital world’, Eriksson and Giacomello (2006, p. 236) observed that the political sciences were struggling to apply their varied theoretical toolbox to the topic of cybersecurity. More recently, however, changes in the empirical phenomenon and an increasing diversity in the theoretical landscape have made it more viable and more opportune to use theory to help explain different facets of the phenomenon. As a result, research that uses international relations (IR) theory for the study of cybersecurity is no longer quite like a unicorn; mystical, rare and extremely hard to find.

The focus of this chapter is a type of cybersecurity research in the IR sub-discipline security studies that applies variations of the Copenhagen School’s securitization theory to cybersecurity (prime examples: Eriksson, 2001; Dunn Cavelty, 2008; Hansen & Nissenbaum, 2009; Lawson, 2013). Securitization signifies the representation of a fact, a person, or a development as a danger for the military, political, economic, ecological, and/or social security of a political collective and the acceptance of this representation by the respective political addressee (Buzan et al., 1998). The successful securitization of a topic justifies the use of all available means to counter it – including those outside the normal political rules of the game. Therefore, a strongly mobilizing discursive justification for this extraordinary situation is made in the political process. This happens above all in the narrative representation of great danger threatening objects of value.

Given these theoretical underpinnings, the Copenhagen School focuses mainly on official statements by heads of state, high-ranking officials or heads of international institutions (Hansen, 2006, p. 64). What a focus on elite speech acts ignores, however, is how these discursive practices are facilitated or prepared by practices of actors that are not so easily visible. The social competition for the definition of reality is not only – and above all only in the final stages – held in the open political arena. Empirical analysis reveals that there are always state and non-state actors ‘under the radar’ – i.e. specialized bureaucratic units, consultants or other experts – who have the capacity to establish ‘the truth’ about certain threats, thus pre-structuring the discursive field in relevant ways (Huysmans, 2006, p. 72; Léonard & Kaunert, 2011).

Taking this as a starting point, a second type of literature moved away from speech acts to see cybersecurity as a product of the interaction of technologies, processes, and everyday practices. It pays particular attention to how a variety of actors uses different representations of danger to create or change different political, private, social, and commercial understandings of security in selected public spheres. In addition, this type of literature gives more weight to material aspects of the issue (examples: Stevens, 2016; Balzacq & Dunn Cavelty, 2016; Collier, 2018; Shires, 2018). It takes the possibilities and constraints of the technical environment seriously by recognizing that the political reading of cybersecurity cannot be divorced from the material realities of computer disruptions and knowledge practices in technical and intelligence communities, which shape the field constantly through their everyday offensive and defensive actions.

This chapter makes an argument that cybersecurity politics is best understood as running on a continuum between securitization tendencies and technological routine depending on the context and sub-issue under scrutiny. There are three sections. In the first, securitization theory as an important part of European ‘critical security studies’ is introduced, to give the reader an overview over the key concepts and theoretical assumptions of this approach. In the second, the challenges of applying securitization theory to cybersecurity are discussed by pointing out a few specificities of the issue. In the third, the chapter shows how securitization theory has evolved to become more applicable to cybersecurity. An argument for the combination of approaches is made by highlighting the seminal work of Hansen and Nissenbaum (2009) who describe a multifaceted ‘grammar of security’ for the cybersecurity sector.

Securitization Theory and beyond

Securitization Theory, also called Copenhagen School, was developed in the 1990s as part of a critical turn in security studies in Europe. While some scholars sought to keep security studies narrow as ‘the study of the threat, use and control of military force’ (Walt, 1991, p. 22), other scholars soon began to expand the scope of security to non-military issues and subsequently moved away from a sole focus on state actors (Baldwin, 1995). Whereas security studies in the United States continued to follow a path of mainly positivist, neo-realist inspired research answering ‘why’ questions, Europe chose to focus more on issues of a reflexive nature, engaging with so-called ‘how possible’ questions (Wæver & Buzan, 2015). Rather than believing that there is a social reality that can be measured with methods mirroring those used in the natural sciences as positivists do, these approaches seek to understand the construction of political issues and their social consequences, often using constructivist or post-structuralist thought as a starting point. While the label ‘critical’ means different things to different scholars (Mutimer et al., 2013), they share an interest in taking up various unquestioned and taken-for-granted aspects of security. By opening them up for analytical and normative inquiry, they initiated important conceptual debates on the deeper politics of security.

Securitization looks at the formation of security policy agendas, arguing that problems become a security issue not because an objectively measurable, existential threat exists, but because key actors successfully present and establish issues as such a threat (Buzan et al., 1998). Wæver and Buzan offer the following definition of securitization as ‘the discursive process through which an intersubjective understanding is constructed within a political community to treat something as an existential threat to a valued referent object, and to enable a call for urgent and exceptional measures to deal with the treat’ (Buzan & Wæver, 2003, p. 91). Overall, the study of securitization therefore aims to gain an understanding of who securitizes (the actor) which issues (the threat subject), for whom or what (the referent object), why (the intentions and purposes), with what results (the outcome), and under what conditions (the structure) (Buzan et al., 1998, p. 32). The overall take on security is based on speech act theory as developed by Austin (1962) and Searle (1969), which claims that the use of language is a performative act. Security speech acts are significant utterances in a security framework by actors that are in a position to ‘define’ security and shape responses to envisaged threats (Strizel, 2007, pp. 360f).

By choice, securitization theory deals with a type of security that is discursively tied to the highest possible political stakes, since it is about existential threats to the survival of the state and its society. Therefore, invoking security is a powerful mobilizer that can help legitimize extraordinary responses and undemocratic procedures (Wæver, 1995; Huysmans, 2008). However, many of the current security issues in the West are hardly about the outright survival of the state or society but characterized by the risk of (wilful) disruption of modern life in open, liberal societies. Such conceptualizations are empowering a range of specific government rationalities like the permanent surveillance of populations, precautionary arrests of suspects, or pre-emptive invasions of foreign countries (Aradau & van Munster, 2007). When focusing on security that is no longer primarily about threats and battles against an enemy, but is characterized by an inward-looking narrative about vulnerabilities, it becomes necessary to question the perception of security as ‘exceptional’ and linked to ‘extraordinary’ means.

In line with these observations, scholars from the Institut d’Etudes Politiques de Paris challenged the Copenhagen School’s conceptualization of security from the moment of its inception. This ‘Paris School’ criticized that by focusing exclusively on discursive practices, the Copenhagen School overlooked the important non-discursive practices of security formation by agencies in the security domain (Bigo, 1998). Following Bourdieu and his work on social fields (Bourdieu, 1993), the Paris school’s approach focuses mainly on the action of those actors who are endowed with both the symbolic capital and the capacity to inter-link heterogeneous discourses by establishing ‘the truth’ about certain security threats. The securitization process cannot be reduced to simple rhetoric, but implies extensive mobilization of resources to support the discourse. New practices and institutions need to be created to deal with the quasi-ubiquitous danger that the ‘new’ threats constitute (Huysmans, 1998; Bigo, 1994).

When engaging with the political handling of such issues, the research focus inevitably shifts to everyday security practices of less traditional security actors such as civil protection or police agencies (Huysmans, 2006; Hagmann & Dunn Cavelty, 2012). In this view, security is not only about the exceptional but also about routine processes in bureaucracies (c.a.s.e. collective, 2006, p. 469; Lobo-Guerrero, 2008). This type of scholarship accepts more amorphous and ambiguous characteristics of national security. Its referent objects populate a national security spectrum that connects global threats right down to personal safety. Its referent object is often not the population or life more broadly but technical and social systems that are designated vital to collective life. The sources of insecurity – classically, the ‘enemy’ – are moved to the background, as the stability of technical and societal systems becomes a main aim of security interventions.

Securitization Theory and cybersecurity

For many years, political aspects of cybersecurity were discussed almost exclusively in policy-oriented publications originating in the US (for example, Alberts & Papp, 1997; Arquilla & Ronfelt, 1997). The two main questions this literature tackles are ‘who (or what) is the biggest danger for an increasingly networked nation/society/military/business environment’ and ‘how to best counter the new and evolving threat’. Predominantly, this literature follows a technologically deterministic reasoning, which assumes technology is shaping society with society or politics having little power to shape technologies in turn. In line with this, the information age is touted either as a great, world-changing opportunity (Toffler, 1981; Drucker, 1989)...