Securitizing “cybersecurity” is self-defeating, threats are inflated, AND spur self-authorization of operations considered “offensive” against the “non-Western” threats regarding global surveillance and control, that turns case

Cyber security is often characterised as fearful, with cyber threats being both permanent and evolving (Ehrlicher, 2021), and cyber attacks being seen as inevitable (Pearlson et al., 2021). The businesses in our study seemed to agree, with cyber threat appearing to be normalised. Participants, both CISO and non-CISO, considered these threats to be enduring and businesses needed to accept that they would be compromised. This implies a “perpetuall cyber warre” (Stevens, 2016, p. 120). These businesses existed in “continuall feare” (Hobbes, 1985, p. 186), threatened by “death, poverty, or other calamity” (Hobbes, 1985, p. 169) arising from something, i.e, cyber security, that was not well understood, even mystical,18 as “perpetuall feare, [is] always accompanying mankind in the ignorance of causes” (Hobbes, 1985, p. 169-70).19 The role of the CISO may be valued as one “that can make the Holy Water” (Hobbes, 1985, p. 692) that provides protection from fearful things, and, therefore, is motivated to maintain the fear and dread that underpins their value.20 Survival was clearly a concern for these businesses. Cyber security was positioned as a threat to viability by many of these organisations, with fear of regulatory action and associated fines and reputational damage in particular being a prime concern. Such concerns with viability and survival, arguably the primary motivation for businesses (Beer, 1979), are analogous with seeking to avoid punishment that could lead to “pain, and disability” and, ultimately, “death” (Gert, 2001, p. 243). The punishments they sought to avoid were enacted by the larger Leviathan of the state and, as mini-Leviathans, these businesses cascaded this concept, instituting their own mechanisms of punishment for their employees, as we discuss below. Internal experts were positioned by many of these organisations as “guards” that protected them against the various harms that they faced. Cyber security functions were seen as assuagement against threats to business viability and helped these businesses to manage the uncertainty they experienced as a result of these threats and ensure their continued survival. This allowed them to shape their future to a certain extent, aligning with Hobbes’ encouragements towards continued attentiveness to threats (Stevens, 2016), but also provided a resource that articulated and predicted those threats, based on both past, and imagined future, events. 5.1.1. Permanent cyber emergency Many of these organisations played a role in national cyber security, including participating in invitation-only national security working groups. Such fora, in which government intelligence services share details of cyber threats with specific industries, demonstrate the role that governments play in maintaining a state of permanent cyber emergency. They provide a mechanism through which governments can both maintain fear and amplify it. This could be achieved through exaggeration or even fabrication, particularly when considering the reliance of the state Leviathan on the persistence of this fear.21 A permanent emergency offers benefits as a “master narrative” (Smith and Sparkes, 2008, p. 18) that can be invoked to support actions taken by businesses and individuals within that business, whether to justify investment or to justify restrictive controls such as surveillance, as we discuss in Section 5.3. The positioning of cyber security as warfare, which is a narrative repeated by both media and governments (Stevens, 2016), establishes that concept in the minds of all parties to that war, whether attacker or attacked. Adversaries, or even just those who disagree, will respond to the narrative of cyber security-as-war and then treat it as such, focusing on attack and defence, rather than seeing it as anything else, for example, as a collective problem of identifying and addressing weaknesses that threaten all. This could lead to actions that have unintended consequences, such as state purchasing, and hoarding, of vulnerabilities, e.g. Hoeksma (2017). Cyber security-as-collective-problem could be considered a “flattened narrative” (Farley, 2001), with preference instead provided to the cyber security-as-war concept which supports the maintenance of existing power structures. This can also be considered as indexing a “meta-narrative” (Symon et al., 2014, p. 3) of existing or ‘traditional’ enemies (Stevens, 2016), and the “superiority of ...the West” (Neocleous, 2008, p. 172), as suggested by the references to (ex-)communist states22 observed in the data. There is an almost paradoxical relevance of both Foucault’s and von Clausewitz’s perspectives on war, with cyber war being a “mere continuation of policy by other means” (von Clausewitz, 1873, p. 12) and cyber politics being “the continuation of war by other means” (Foucault, 2004, p. 15).23 Each of these also provides economic benefits (Neocleous, 2008), as we discuss below. Positioning cyber security as an existential threat, as a war with “apocalyptic” (Stevens, 2016, p 121) consequences, may also allow for exceptionalism and deviance from existing laws, both national and supranational. Hobbes explicitly permitted defiance of law if motivated “by the terrour of present death” (Hobbes, 1985, p. 345). Such exceptionalism based on existential threat can be observed in modern societies, e.g. Government, Government; USA (2001), including in relation to cyber security threats (Walker, 2006). References to national security also connect with this warfare motif. As the nation is ‘under threat’ then there is a collective sense of conflict and, therefore, a suggestion that everyone has to play their part. The fear generated by these threats propels citizens into “the waiting arms of whoever might be ruling” (Chapman, 1975, p. 88). Such fear may be a “necessity-justification” (Chapman, 1975, p. 89) for enduring power, and, as Chapman suggests, it is straightforward to conceive of such “justification ...[occurring] at the state level, as a function of real or manufactured inter-state crises” (Chapman, 1975, p. 89), particularly with regard to threats that are hard to understand or somewhat ephemeral in nature, such as those related to cyber security. If cyber-security threats result in fearful and bewildered citizens, those citizens are easier to moderate. Educating citizens on, or even communicating the existence of, cyber threats may couple “paranoia with pacification” (Chapman, 1975, p. 90).