Is the responsibilization of the cyber security risk reasonable and judicious?

Abstract

Cyber criminals appear to be plying their trade without much hindrance. Home computer users are particularly vulnerable to attack by an increasingly sophisticated and globally-dispersed hacker group. The smartphone era has exacerbated the situation, offering hackers even more attack surfaces to exploit. It might not be entirely coincidental that cyber crime has mushroomed in parallel with governments pursuing a neoliberalist agenda. This agenda has a strong drive towards individualizing risk i.e. advising citizens how to take care of themselves, and then leaving them to face the consequences if they choose not to follow the advice. In effect, citizens are "responsibilized." Whereas responsibilization is effective for some risks, the responsibilization of cyber security is, we believe, contributing to the global success of cyber attacks. There is, consequently, a case to be made for governments taking a more active role than the mere provision of advice, which is they case for many countries. We conclude with a concrete proposal for a risk regulation regime that would more effectively mitigate and ameliorate cyber risk.

“This is the way ‘I’ create my passwords” ... does the endowment effect deter people from changing the way they create their passwords?

“…Cyber security is a relatively new phenomenon on an evolutionary scale, certainly much newer than many other areas of human risk management, such as managing physical safety or disease prevention. Due to its newness, it is thus reasonable to assume that the populace at large lacks sufficient knowledge and skills to secure their own information, systems and devices adequately [62,138,141,143].…”

Cyber Security Responsibilization: An Evaluation of the Intervention Approaches Adopted by the Five Eyes Countries and China

“…Other scholarship has employed similar approaches, utilizing the homeland security policy regime (May, Jochim, and Sapotichne 2011) and risk regimes (Quigley and Roy 2012) consistently with the goal of progressing policy regimes that concentrate policy making on a collective goal across diverse subsystems. Nye (2014, 19) concludes that “internet governance is the application by governments, the private sector and civil society of principles, norms, rules, procedures and programs that shape the evolution and use of the Internet.” Other recent research has proposed that the citizenry has, in effect, become responsibilized—that cyber risk is individualized, thus contributing to the expansive spread and efficacy of cyber attacks (Hadjimatheou 2019; Renaud et al 2018).…”

“…Citing the paradox in the current policy‐making environment (de Bruijn and Janssen 2017), as well as other authors suggesting the murky pitfalls of attribution (Schulzke 2018), recent scholars have called for the framing of cyber security dialogue. Some have raised concerns about the apparent responsibilization of individuals for cyber security, comparing it with stances related to similar societal contagion‐type risks such as disease and fire (Renaud et al 2018).…”

“…Responsibilization has not seen unqualified success in other areas (Avigur‐Eshel 2018; Phoenix and Kelly 2013; Rossiter 2012; Soneryd and Uggla 2015; Stol, Schermer, and Asscher 2016), notably in those domains where building capability is rather more challenging than anticipated (e.g., health, finance, and drug abuse). Renaud et al (2018) suggest that responsibilizing cyber security is ill advised and that more should be done to support citizens and organizations in resisting cyber attacks. They argue that cyber threats are currently managed by governments as if they are a solo risk, whereas they ought to be managed similar to the way other contagious and calamitous risks are managed, due to the epidemiology of cyber attacks and the expertise required to mitigate them.…”

Cyber-security effect on organizational internal process: mediating role of technological infrastructure

“…For example, the cost of each of these cyber-security breaches was estimated at US$ 221 in the financial sector; US$ 208 in the service industry; US$ 355 in the healthcare industry; and US$ 246 in the education industry (Sommestad, Hallberg, Lundholm, & Bengtsson, 2014). Renaud et al (2018) believe that most of these cyber breaches and threats may affect the organizational internal process. Some scholars (e.g., Sun, 2018; Pak Nejad, Javadi, & Mohammadi, 2014) support this view by linking these cyber-security risks and threats to cyber-security forces.…”