The Politics of Cybersecurity: Balancing Different Roles of the States

Abstract

In liberal democratic countries, the role of the state in cybersecurity is a politically contested space. We investigate that role along three dimensions: the first is theoretical and we look at existing cybersecurity literature, showing that international affairs literature is almost exclusively highlighting the role of the state as a security actor. We argue that this view is too narrow and risks limiting the discussion to only a few aspects of what cybersecurity entails. The second is empirical and we analyse policy development, showing the diversity of the roles the state imagines for itself. The state occupies six different roles in cybersecurity: (1) security guarantor, (2) legislator and regulator, (3) supporter and representative of the whole of society, (4) security partner, (5) knowledge generator and distributor, and (6) threat actor. The third dimension is normative and we investigate what the role of the state should be. To do that, we outline three main areas of tension between the state, the economy, and society in which cybersecurity policies are situated. Diverse coalitions of interests, spanning across the three social fields, support or challenge the six roles. Thus, two types of questions occupy the centre stage of cybersecurity policy: a question regarding the boundaries of responsibility (i.e., where does the responsibility of the state, economic, and societal actors start and end?) and a question regarding the concrete assumption of responsibilities (i.e., which means is an actor allowed to use to assume the responsibilities of his/her roles?). In sum, our conceptualisation enhances the understanding of cybersecurity as a diverse and crosscutting policy field. The result is a more comprehensive understanding of different roles of the state, which will help researchers with finding innovative research questions in the future.

Keywords: cybersecurity, statecraft, democracy