Towards a Theory of Cyber Power: Security Studies, Meta-governance, National Innovation System

Cyber power is ‘the ability to use cyberspace to create advantages and influence events in other operational environments and across the instruments of power’. Cyber security results from applications of cyber power. Cyber security science is different: it is a science in the presence of adversaries. Exact sciences help understand the technology. Social science scholarship may help to better understand the actors – but it is underutilized. 

Based on years-long experience, we identify three relevant “softer” Social Science sub-disciplines - security studies, meta-governance, national innovation system - to integrate with “core” cyber technology fields, towards a general theory of cyber ‎power.  The research will demonstrate their analytical utility and integrate these theoretical building blocks to develop an interdisciplinary unified theory of cyber power which is generalizable to multiple settings.

Security Studies: The Revolution in Military Affairs analytical framework.

Throughout history, superior means were never enough to secure strategic advantage. Cyber technology, together with doctrine and organization adaptation, made possible ‎a direct, physically destructive attack on strategic targets at ‎homeland. Critical ‎Infrastructure (CI) are exposed to a threat ‎scenario, which is no longer theoretical since 2010 discovery of Stuxnet.  Despite ‎awareness and technical prowess, national defense systems, first and foremost the ‎military, have lost the ability to defend the society from external politically-‎motivated cyber security threat. This phenomenon is not a new one; it often had enabled historical Revolutions in Military Affairs. But Security Studies scholars have largely neglected cyber power. Unless we develop the Security Studies RMA analytical framework – even the most technologically developed states are likely to end up on the wrong side of an imminent Cyber RMA.

Public Policy: Meta-Governance and non-traditional policy instruments.

Governance – the ‎formulation and implementation of policy in a specific policy domain by a network of ‎numerous non-government, corporate, media actors, of which some are public and ‎some are private – are central streams in contemporary governance theory. Cyber security solutions on a national level are essentially about governance: the challenge is to get the people and organization to alter their behavior. Traditional state-centric Governance (“old governance”, “hierarchical models”) public ‎policy and administrative processes were top-down. Recent research focuses on the empiric reality: the ‎traditional hierarchical model where collectively binding decisions are taken by ‎elected representatives and then successfully implemented by bureaucrats within ‎public administrations became rare. Governance theory use in cyber power was limited to Internet Governance. Public Policy research on Meta-Governance and non-traditional policy instruments will be especially applicable to complex cyber environment and must be better integrated into cyber power theory. ‎

Political Economy: National Innovation Systems (NIS)

NIS literature emerging since the 1980s created insights on how some states grow more rapidly, adopt technologies earlier and gain competitive advantage. Current literature on NIS identified “mechanisms” rather than “places” (macro-institutional features of countries) as the core elements of innovation. Rapid Innovation-based (RIB) industries are at the core of cyber power; these require constant capacity to innovate rather than imitation and value through scale.   NIS must be better integrated into cyber power theory, where technology and capacity building is the dominant concern

The research design combines literature analysis with theory building from case studies. This qualitative research method enables us to capture the complexity of the object of study. Theory building from case studies is an increasingly popular and relevant research strategy. Case studies will rapidly contribute to theory building. We propose three case studies: one completed and two at initial stages of exploration.

a)            Israeli Cybersecurity 1995-2015

b)            Italy and ‎Singapore. We plan to leverage our collaborations via TAU ICRC with respective colleagues in Italy and ‎Singapore, to develop case studies of these two states. ‎

The science of cybersecurity will benefit from an interdisciplinary unified theory of Cyber Power, a theory addressing the actors as well as the technology.