Securitization of “cybersecurity,” “digital authoritarianism,” and “systemic risks” are overly inflated. They’re wrongly mapped to “non-Western” states, and broadly authorizes the surveillance and militarization of everyday life, both domestically and globally.

In ‘Digital Disaster, Cyber Security, and the Copenhagen School,’ published in 2009, Lene Hansen and Helen Nissenbaum suggest ways in which securitization theory can help us understand the politics of cybersecurity and cyberwar, a complex terrain that brings together a variety of technical and policy challenges that range from individual cybersecurity problems (cybercrime) through to issues of national and economic cybersecurity (anxieties about attacks on ‘critical infrastructure’) (Hansen and Nissenbaum, 2009). Some of the threats point to futuristic ‘black swan’ disasters that result from our high-speed networked society; some of the challenges are traditional problems – abuse and harassment, grooming and recruitment, identity theft and fraud – carried out with new technologies. The cyberterrain is one where there is an anxiety that an individual can become a national security problem in new and dangerous ways – and where cyber techniques and technologies of national security can play out at the level of the individual in new and unprecedented ways, with innovations in the surveillance and monitoring of everyday life: the security state becomes - to use the fashionable management term - increasingly granular. This essay returns to Hansen and Nissenbaum’s article, an article that introduced new complexities, questions and nuances to the study of cybersecurity in security studies and international relations, to think about the changing terrain of cybersecurity in the second decade of the Twenty First Century– and the importance (and problems) of thinking about the ‘non-West’ in research on (cyber)securitization.

Hansen and Nissenbaum are interested in how the collective ‘referent objects’ of ‘the state,’ ‘society,’ ‘the nation’ and ‘the economy’ are presented as being threatened through three types of securitization that ‘tie referent objects and securitizing actors together’(Ibid, p.1163): hypersecuritization, everyday security practices and technifications. On this view, hypersecuritzation refers to the expansion of a security problem into a realm where there is the danger that threats can be exaggerated, resulting in excessive countermeasures: these hypersecuritizations, according to Hansen and Nissenbaum, always ‘mobilize the spectre of the future’ while also using ‘the past as a legitmating reference’(Ibid, p.1164). In the public threat horizon of future threats and dangers, proponents of cyber fears often use historical analogies of ‘electronic pearl habors’ or ‘cyber 9/11s’ in speculations on new types of threats: for the securitization theorists, the ‘re-animation’ of past events works to give a ‘form’ or credibility to future threats that have yet to occur – or are yet to be imagined.

What was significant about Hansen and Nissenbaum’s essay was the way it attempted to add new approaches and questions to a topic that tended to occupy a space in an often highly technical discourse of security, technology and strategy, a discourse that extended in to all aspects of life in a digitizing society. Indeed, ‘everyday security practices’ in their work refers to the ways that individuals and organizations are integrated into the practices of securitization as ‘both a responsible partner in fighting insecurity’ and also as a potential threat, allowing for responses that can permeate all aspects of everyday life (Ibid, p.1165). This was a discourse of security that due to the technical complexity was presented as occupying the ‘cutting edges’ of security, a zone that few outside of computer science would be able to engage with. In this sense, ‘technification’ refers to the manner in which cybersecurity becomes a terrain that depends on the ‘expert authority’ of the computer scientist and policy expert for its legitimacy, a domain where ‘the experts’ are the securitizing actors in a manner that risks to detach the issues from critical scrutiny and dialogue. Using the case study of Estonia in April-May in 2007 the authors illustrate how securitization theory can bring conceptual clarity and complexity to a terrain that can either be reduced to simplifications using the past as a means of understanding – or taking the issues into a zone where it is beyond our means of critical understanding and comprehension, where we feel overpowered by our inability to engage critically with the issues, issues that can leave us with the feeling we are in the realm of geopolitical science fictions, a world that feels increasingly like the ‘cyberpunk’ novels of William Gibson or films such as Ghost in the Shell.

Hansen and Nissenbaum reach a conclusion that resonates with the broader objectives of securitization theory and ‘critical security studies’: to develop strategies to counter and interrogate the ‘exceptional’ status of security issues – where an issue might be presented as ‘exceptional’ due to the threat to the national interest and/or exceptional due to the technical knowledge needed to evaluate the threat:

Cyber securitizations are particularly powerful precisely because they involve a double move out of the political realm: from the politicized to the securitized, from the political to the technified, and it takes an inter-disciplinary effort to assess the implications of the move, and possibly to counter it…cyber security stands at the intersection of multiple disciplines and it is important that both analysis and academic communication is brought to bear on it. The technical underpinnings of cyber security require, for instance, that IR scholars acquire some familiarity with the main technical methods and dilemmas, and vice versa that computer scientists become more cognizant of the politicized field in which they design and how their decisions might impact the (discursively constituted) trade-offs between security, access, trust, and privacy (Ibid, p. 1172).

The implication of this argument is an important one: we should develop the tools that enable us to challenge the ethico-political dangers of hypersecuritization in this rapidly changing (cyber) space; to be able to see into this zone of expert knowledge and authority, the spaces where decisions are made on the policies and technologies that will shape all areas of war and security (see Balzacq, 2011). But this essay asks: what should IR scholars be doing in addition to the challenge and task – to become more inter-disciplinary in order to be able to engage with the potential technification and hypersecuritizations of cybersecurity policy and discourse – that was set out in Hansen and Nissenbaum’s article?

What we want to do in this essay is suggest that in the time since the essay was published there may be problems and trends that have emerged that require some additional approaches to this issue of hypersecuritization and technification. Simply put, we need to think again about the problems of cybersecurity in the ‘political realm’ and we need to develop research on cybersecurity and ‘political realms’ in different places around the planet; to go beyond the often hypersecuritizing images of digital danger and ‘otherness’ emerging from the ‘nonWest’ to explore the complexity of cybersecurity both from the perspective of new ‘everyday security strategies’ that individuals may confront but also in terms of the potential for ‘digital disasters’ that might emerge from specific technological, legal, political and security contexts.

Following on from Hansen and Nissenbaum, our position in the paper begins from the view that inter-disciplinary attempts to engage critically with hypersecuritization is the primary task of work in this space: to be able to counter hypersecuritizations where threats are ‘hyped up’ - or unspecified future cyber dangers are invoked - is the first move for scholars who want to think critically about the ‘threat horizons’ that we are presented with on the (not so) clear and present/future dangers. In the time since the essay has been published (2009) much of the debate has centred around the hyper securitization of the concern with all things digital and the implications for the future of security and war (most notably in Thomas Rid’s book Cyberwar Will Not Take Place). At the same time, there have also been events that have pointed to the possibility of the types of future problems that we could confront – from events that fit with the type of warnings on digital disaster that many have been making since the issue emerged (the hacking of Ukrainian power grids, the Central Bank of Bangladesh bank heist) to the emergence of events that were not considered in previous speculations on digital disaster (Zetter, 2016a; Zetter, 2016b) : attempts to shape the political direction of other states through a combination of disruptive ‘gray zone’ tactics that may involve hacking and new uses of social media (the debate over ‘fake news’ and social media, the U.S. Presidential election in 2016). The problem now is not simply hypersecuritization but the problem of what Ulrich Beck describes as ‘organized irresponsibility’ where the ‘state administration, politics, industrial management and research negotiate the criteria of what is ‘rational and safe.’’ Discussing environmental risks, Beck asks ‘do we live in the context of ‘organized irresponsibility’?’(Beck, 1999, p.6). We would suggest the same question needs to be asked in the context of the securitization of digital risks and insecurities.

What we suggest in the article is this: once we have established that the first move in this area is think critically about cyber securitizations and the potential problems of the move from the political to the technified, we can consider the concerns of those who we describe as the ‘cyber catastrophists’ – those who continue to be concerned about the digital disasters that could impact on all aspects of life. We suggest that in this realm of cybersecurity we see three positions that shape the ideas that are contributing to vibrant debate and discussion of the future of cyberwar and cybersecurity: the cyber catastrophist, the digital realist and the techno optimist. The essay rests on the position that each perspective presents us with questions about cybersecuritizations that we need to constantly remain open to – given the fast-moving and disruptive pace of geopolitical and technological change. We suggest that the point in Hansen and Nissenbaum’s essay about the need to counter hypersecuritizations needs to be supplemented by more exploratory questions about whether we confront the issue of organized irresponsibility in this space. The problem of technification is not simply on how it might add legitimacy to hypersecuritization, in what it enables us to visualize in the imagination of digital disaster – it is what it fails to see or ignores, the construction and legitimation of what is rational and safe. In other words, we need to examine the politics – and the different positions that may shape policy – in the spaces where important ‘expert’ decisions are made: to examine, for example, how risk and unintended consequence are being integrated into planning. But the questions opened up by the ‘deconstruction’ of cybersecurity and cyberwar by Hansen and Nissenbaum also point to inquiry on the changing nature of ‘everyday security practices’ and here we suggest that is clearer now is the need for IR scholars to examine the specific contexts, controversies and challenges in diverse spaces beyond the often simplistic geographies of cyber-threat that often serve to fuel the hypersecuritized visions of geopolitical imaginaries.

One of the geopolitical anxieities that circulates in many of the key positions we discuss is a concern with the cyber insecurities that we confront from the non-West or that may result from poor cyber governance in the non-West. While this use of the term ‘non-West’ can be problematic and limiting it does remind us to think beyond the simplistic geography of ‘cyber’ danger that is often central to the debates about cybersecurity, the geopolitical imaginary filled with devious Bond- villains from former Communist-countries, cunning- ‘Oriental’ cyber criminals from a cyberpunk movie, totalitarian states experimenting with new technologies of Minority Report-like control and ‘feral’ digital environments in states outside the ‘tame zones’ of global politics. Securitization perspectives – along with work influenced by poststructuralist writers – are often a call to see beyond the simplistic representations of global politics that continue to imagine the future through the same geographies of otherness and difference that shaped the past (Hansen, 2006). This article suggests that – in the spirit of Hansen and Nissenbaum’s essay – we need to keep searching for the questions that need to be asked about a terrain that more than ever needs to be examined in its fast moving complexity and messiness: to examine the difference, complexity and messiness of new trends, practices and behaviours in environments that are often ignored or reduced to the ‘same’ in a supposedly homogenizing and universalising global technological culture.