Institutions for Cyber Security: International Responses and Global Imperatives

Abstract

Almost everyone recognizes the salience of cyberspace as a fact of daily life. Given its ubiquity, scale, and scope, cyberspace has become a fundamental feature of the world we live in and has created a new reality for almost everyone in the developed world and increasingly for people in the developing world. This paper seeks to provide an initial baseline, for representing and tracking institutional responses to a rapidly changing international landscape, real as well as virtual. We shall argue that the current institutional landscape managing security issues in the cyber domain has developed in major ways, but that it is still “under construction.” We also expect institutions for cyber security to support and reinforce the contributions of information technology to the development process. We begin with (a) highlights of international institutional theory and an empirical “census” of the institutions-in-place for cyber security, and then turn to (b) key imperatives of information technology-development linkages and the various cyber processes that enhance developmental processes, (c) major institutional responses to cyber threats and cyber crime as well as select international and national policy postures so critical for industrial countries and increasingly for developing states as well, and (d) the salience of new mechanisms designed specifically in response to cyber threats.

Keywords:

• cyber security
• cyber governance
• cyber institutions
• sustainable development
• CERTs
• information technology

Acknowledgements

Any opinions, findings, and conclusions or recommendations expressed in this paper are those of the authors and do not necessarily reflect the views of the Office of Naval Research.

Funding

The work reported herein was supported, in part, by the Explorations in Cyber International Relations (ECIR), the Office of Naval Research (ONR) [contract number N00014-09-1-0597].

Notes on Contributors

Nazli Choucri is a Professor of Political Science at the Massachusetts Institute of Technology. Her research concentrates on sources and consequences of international transformations and change, with a focus on types of international conflict and modes of cooperation. She is the Principal Investigator of a multi-year, multi-disciplinary research project of MIT and Harvard University on Explorations in Cyber International Relations and Director of the Global System for Sustainable Development (GSSD), a multi-lingual web-based knowledge networking system focusing on the multi-dimensionality of sustainability. She is the founding Editor of the MIT Press Series on Global Environmental Accord and the former General Editor of the International Political Science Review. Her most recent book, Cyberpolitics in International Relations, was published by the MIT Press in 2012.

Dr. Stuart Madnick is the John Norris Maguire Professor of Information Technology at the Sloan School of Management and Professor of Engineering Systems in the School of Engineering at the Massachusetts Institute of Technology (MIT). He has degrees in Electrical Engineering (B.S. and M.S.), Management (M.S.), and Computer Science (Ph.D.) all from MIT. His current research interests include connectivity among disparate distributed information systems, database technology, software project management, cybersecurity, and the strategic use of information technology. He is the author or co-author of over 380 books, chapters, articles, or technical reports on these and related topics. He has also been active in industry as a consultant and co-founder of several companies.

Jeremy Ferwerda is a PhD Candidate in the Department of Political Science at the Massachusetts Institute of Technology. Prior to attending MIT, he graduated summa cum laude from Cornell University with degrees in History and Biological Sciences, and worked as a financial analyst for a hedge fund.

Notes

1. See, for example, Goodrich, (1947), Claude (1967), and Hoffmann (1987).

2. See, for example, Mitrany (1948).

3. Haas (1961) is a good example.

4. See Keohane (1983) as an example. The concept of regime emerged as an important anchor in the field.

5. These organizations are also referred to as Computer Security Incident Response Teams (CSIRTs).

6. Unfortunately, CERT/CC has announced that no statistics will be published after Q3 2008. As a result, analysis is limited to historical applications (1988–2008).

7. Note that the position has been established and is currently filled by Michael Daniel.

8. These are all examples of institutional developments in response to cyber security threats.

9. Note, however, that the USA does not currently provide any comprehensive statistics on arrests or prosecutions.