The non-anthropocentric informational agents: Codes, software, and the logic of emergence in cybersecurity

Abstract

Many theoretical approaches to cybersecurity adopt an anthropocentric conceptualisation of agency; that is, tying the capacity to act to human subjectivity and disregarding the role of the non-human in co-constructing its own (in)security. This article argues that such approaches are insufficient in capturing the complexities of cyber incidents, particularly those that involve self-perpetuating malware and autonomous cyber attacks that can produce unintentional and unpredictable consequences. Using interdisciplinary insights from the philosophy of information and software studies, the article counters the anthropocentrism in the cybersecurity literature by investigating the agency of syntactic information (that is, codes/software) in co-producing the logics and politics of cybersecurity. It specifically studies the complexities of codes/software as informational agents, their self-organising capacities, and their autonomous properties to develop an understanding of cybersecurity as emergent security. Emergence is introduced in the article as a non-linear security logic that captures the peculiar agential capacities of codes/software and the ways in which they challenge human control and intentionality by co-constructing enmity and by co-producing the subjects and objects of cybersecurity.

Locating infrastructural agency: Computer protocols at the finance/security nexus

“…Their specificity along with the growing complexity of multiple-use technologies, like Bitcoin, all limit more general claims as to where ‘techno-agency’ might be found, assessed and potentially countered. Locating agential qualities in activities surrounding the development of computer protocols, we contend, widens possibilities for linking specific sociotechnical relations to their wider ‘emergent security’ implications while avoiding ‘the centrality of human intentionality as a basis for constructing enmity, and by acknowledging the role of codes/software unexpected paths’ (Fouad, 2022: 768).…”

Subversion, cyber operations, and reverse structural power in world politics

“…Just like spies can infiltrate social institutions and secretly turn them into agents of the subverter, computer viruses or malware can infiltrate targeted systems and secretly turn them into agents of the sponsor of the cyber operation, producing outcomes in direct conflict with the ICTs intended and designed purpose. Accordingly, recent literature suggests the term “non-anthropocentric agents” (Fouad, 2021).…”

When the future meets the past: Can safety and cyber security coexist in modern critical infrastructures?

“…Objects of cyber securitysensors, buildings, codeare not passive technologies waiting to be filled with discourses. They are not characterised by 'essential' features separating them from humans, either (Fouad, 2021). Instead, materiality is critical for noticing how objects become 'agents' of social change through practices which are both discursive and material (Aradau, 2010).…”

“…However, as cyber security 'spills out' beyond simply protecting computers, there is a call for broadening the scope of threat modelling. Critical social scientists argued for anticipating risks of emerging technologies by including non-experts (Slupska et al, 2021), understanding security in tandem with privacy and surveillance (Kazansky, 2021;Wuyts et al, 2020), and approaching non-human actors (code, hardware, algorithms) as active co-creators of geopolitics (Dwyer, 2021;Fouad, 2021). The strength of such a 'critical threat modelling' approach would then lie in the capacity to imagine and anticipate a wide range of outcomes and curate a space for explicitly normative discussions about living with digital technologies.…”

“…A key feature specific to the cyber security field is that it rests on novelty. New threat actors, vulnerabilities and theoretical attacks come to light regularly, often at a pace faster than the creation of regulations (Matthew and Cheshire, 2016). Cyber security risks in critical infrastructures often originate from high-profile malicious activities of organised criminals or state actors, lending itself to the use of political rhetoric, high levels of secrecy and large budget spending as means to protect critical infrastructures from any presumed existential threats (Dunn-Cavelty, 2013).…”