Cyber Security Assemblages: A Framework for Understanding the Dynamic and Contested Nature of Security Provision

Abstract

In the context of globalisation and privatisation, an emerging body of literature has applied the concept of an 'assemblage' to international relations and security studies. This article will argue that an assemblage framework provides the best means for understanding the complex configuration of cyber security actors, given that contemporary cyber security practices do not conform to the traditional public-private and global-local distinctions used in security studies and International Relations literature. With the configuration of cyber security actors, and the relationships between them in constant flux, an assemblage framework provides a means for understanding the contested, dynamic and diachronic nature of contemporary cyber security provision. While the concept of security assemblages is favoured in this article, the process and context in which the term has traditionally been used cannot be blindly imposed on the issue of cyber security. This article will therefore propose a different model of how cyber security assemblages have developed and explain the implications this has on contemporary security dynamics.

Assembling cybersecurity: The politics and materiality of technical malware reports and the case of Stuxnet

“…To the extent that this complexity and breadth of actors in cybersecurity arrangements has been addressed in the literature, it has as mirrored this concern in official policy discourses, describing the role of commercial firms role within the idiom of "public-private partnerships" (Bossong & Wagner, 2016;Carr, 2016;Christensen & Petersen, 2017;Dunn-Cavelty & Suter, 2009). Yet there are distinctive features to the dynamics in cybersecurity which suggest that there are limitations to trying to understand the role of the commercial actors in cybersecurity through the framework of a PPP (Collier, 2018;McCarthy, 2018).…”

“…In the context of broader trends in security governance, the PPP model thus has limitations to such a way of conceptualizing the relationships between state-based and commercial security rationales. In fact, the complex social, political, technical, and economic processes that are informing cybersecurity practices have led some scholars to argue that these processes exceed traditional framings of "public" and "private" (Collier, 2018). A further critical point emerges.…”

“…Recent scholarship has underscored the potential utility of studying the emergent practices around cybersecurity and transnational technologies using insights gleaned from the Science and Technology Studies (STS) literature (Collier, 2018;De Goede, 2018;Dunn Cavelty, 2018;Stevens, 2018), while scholars such as Kearns (2016Kearns ( , 2017, Van Veeren (2014) and Walters (Best & Walters, 2013;Walters, 2014) vividly illustrate the kinds of material traces that can be left in the public sphere and the kinds of materialist-minded analyses that we can productively undertake as a result. However, while these scholars offer rich conceptualizations and methodological approaches for studying such opaque security contexts, these insights have yet to be developed in the context of (commercial) cybersecurity practices.…”

Global security assemblages: mapping the field

“…Within security governance research -while Abrahamsen and Williams established the global security concept as a tool to distance from agent-network theories -it is interesting to watch how Schouten (2014) departs from it to look at global security assemblages' broader impacts on security governance and suggests that the agentnetwork theory widens the scope of what security assemblages are. Within security studies, Collier (2018) departed from the philosophy behind the concept and adjusted it to address cybersecurity reality. Mary Kaldor (2018) took a more sociological turn and used it as a departure for establishing the global security culture concept.…”

War, Health and Ecosystem: Generative Metaphors in Cybersecurity Governance

“…In this case, a hacking groupattributed by the US and UK governments to North Korea-targeted a vulnerability in the Microsoft Windows operating system. The vulnerability had been discovered by the US National Security Agency (NSA) but not disclosed to the public (Collier 2018). A hacking group named the Shadow Brokers stole the vulnerability from the NSA and released it online, making the WannaCry attack possible.…”