Self-help strategies in cyber security are used by companies to compensate for court delays.

Citizen co-production of cybersecurity may also be viewed through the lens of regulatory theory. The introduction to this article referred to the interplay of public and private social control, as noted by Donald Black (1976). To the extent that non-state or informal institutions of social control are functioning effectively, there will be less need for state intervention. When, on the other hand, state institutions of social control are perceived to be operating unsatisfactorily, one may expect non-state actors to seek to compensate. So it is that individual owners of intellectual property engage in self-help when state institutions cannot assure the security of their products (Tusikov 2014). Regulatory pluralism also provides a useful framework for the analysis of cybersecurity co-production. The concept of regulatory pluralism is derived from that of legal pluralism, which is based on the recognition that the law exists alongside a variety of lesser normative orderings. Galanter (1981, p. 20) observed that the legal system is often a secondary rather than a primary locus of regulation. Griffiths (1986, p. 4) referred to legal reality as not monolithic, but rather an “unsystematic collage of inconsistent and overlapping parts.” Julia Black (2001) referred to a “postregulatory world” in which governments no longer monopolize regulation, and later noted the complexity and fragmentation of regulatory systems (Black 2008). Chang (2012b) examined the importance of involving non-state actors (both commercial and non-commercial) as regulators in fostering computer security incident reporting. Other scholars have observed less choreography in regulatory systems. von Hayek (1991) observed that while some orderings are designed and coordinated, others are spontaneous. More recently, Scott (2004) observed that regulatory power can be widely dispersed, and that the state is no longer the main locus of control over social and economic life (if it ever was). Black (2008) speaks of “polycentric” regulatory regimes, which may be ungovernable. Some researchers have proposed a theoretical framework of nodal governance for the policing of cyberspace that conveys the notion that policing needs to be conducted through the collaborative efforts of plural actors (nodal clusters), including criminal investigators, private industry players, and individual internet users (Huey et al. 2013). And with the rise of internet vigilantism (netilantism) and public-private cooperation (co-production) in cybercrime investigation, there is a need for us to understand how private sectors and netizens can help in the co-production of cybersecurity and the risks that may accompany it (Brenner 2007; Chang 2012b; Huey et al. 2013; Nhan et al. 2015; Chang & Poon 2016). Consider the domain of online child exploitation, a type of cybercrime that is the subject of widespread concern (Cohen-Almagor 2013). A high priority for law enforcement agencies in most advanced industrial societies, online child protection activities are also undertaken by a variety of non-state actors and institutions, including parents, teachers, non-government organizations specializing in internet information and education, manufacturers of blocking and filtering software, and self-appointed internet sleuths, operating individually or in concert. As we will see, the efforts of these various players are not systematically choreographed. The activities of some may be coordinated, while others may function independently, for better or worse. While the comprehensive management of internet security may be achievable in more state-centric jurisdictions, this will be less likely in democratic, individualistic societies, where challenges of accountability will be greater.