The contested meanings of cybersecurity: evidence from post-conflict Colombia

ABSTRACT

Cybersecurity is a contested concept. While some definitions focus on technical aspects, other insist on the strategic and geopolitical dimensions. Recently, the definition has included development-related aspects in an increasingly digitalised economy. Instead of cybersecurity, international organisations such as the OECD and private companies now focus on the management of digital risk. While this shift represents an opportunity to include new actors and issues on the political agenda, it does not lead to the de-securitisation of cyberspace, nor to the promotion of cyber peace. This article explores the debates around the definition of cybersecurity with a particular focus on how Colombia became one of the first states to follow the 2015 OECD guidelines on the management of digital risk as part of an effort to join the organisation. It describes how the resulting perspective on cybersecurity evidences a market-centred approach focusing on the development of a digital economy. However, it also discusses why the evolution of cybersecurity policies in Colombia represents a missed opportunity to design a cyber peacebuilding policy in a post-conflict context.

KEYWORDS:

• Cybersecurity
• digital risk
• development
• post-conflict
• Colombia
• cyber peacebuilding

Acknowledgements

The author would like to thank Stefan Schütze, Catalina García, Paula Henao, and Liseth Díaz for their research assistance.

Disclosure statement

No potential conflict of interest was reported by the author.

Notes

1. Schia, ‘The cyber frontier and digital pitfalls in the Global South’.

2. Kshetri, Cybercrime and Cybersecurity in the Global South.

3. Dunn Cavelty, ‘From Cyber-Bombs to Political Fallout’.

4. Comisión de Regulación de Comunicaciones, Agenda regulatoria 2018–2019 [Regulatory Agenda 2018–2019].

5. Buzan, Waever, and De Wilde, Security: A New Framework for Analysis.

6. For an illustration of CDA applied to globalisation discourses, see Fairclough, Language and Globalization.

7. See Fairclough, Critical discourse analysis; Wodak and Meyer Methods of critical discourse analysis.

8. Sum and Jessop, Towards a cultural political economy.

9. Stritzel, ‘Towards a Theory of Securitization’.

10. Ad’ha Aljunied, ‘The securitization of cyberspace governance in Singapore’

11. Balzacq, Securitisation Theory.

12. See Dunn Cavelty, Cyber-Security and Threat Politics; Dunn Cavelty, ‘From Cyber-Bombs to Political Fallout’; Hansen and Nissenbaum, ‘Digital disaster, cyber security, and the Copenhagen School’; and Lawson, ‘Beyond cyber-doom’.

13. Chenou, ‘From cyber-libertarianism to neoliberalism’.

14. Barlow, A Declaration of Independence of Cyberspace.

15. Chenou, ‘From cyber-libertarianism to neoliberalism’.

16. Deibert, ‘The Growing Dark Side of Cyberspace’.

17. Schleifer, ‘A Startling Upsurge In U.S. Bombings’. For a contextualisation and a discussion, see Sankin, 2015, ‘The Anarchist Cookbook and the rise of DIY terrorism’.

18. Bendrath et al., ‘From “cyberterrorism” to “cyberwar”, back and forth’.

19. US Congress, Concurrent Resolution, Expressing the Sense of Congress Regarding Internet Security, and Cyberterrorism, quoted in Bendrath et al., ‘From “cyberterrorism” to “cyberwar”, back and forth’, 65)

20. Dunn-Cavelty, Cyber-Security and Threat Politics.

21. Bendrath et al.,‘From “cyberterrorism” to “cyberwar”, back and forth’, 67.

22. Deibert, ‘Black Code’.

23. See Bendrath et al., ‘From “cyberterrorism” to “cyberwar”, back and forth’; and Dunn-Cavelty, Cyber-Security and Threat Politics.

24. For an analysis of the Brazilian case, see Lobato and Kenkel, ‘Discourses of cyberspace securitisation in Brazil and in the United States’.

25. Schmitt, Tallinn Manual; Schmitt, Tallinn Manual 2.0.

26. Huysman, ‘The Question of the Limit’, 571.

27. Adler, ‘Market, hierarchy, and trust’.

28. Rid and Buchanan, ‘Attributing cyber attacks’; and Egloff, ‘Contested public attributions’.

29. Hurel and Lobato, ‘Unpacking cyber norms’.

30. Leander, ‘Marketing security matters’, 101.

31. Waever, ‘Politics, security, theory’, 251.

32. Booth, ‘Security and Emancipation’, 319.

33. Aradau, ‘Security and the democratic scene’, 73.

34. Aradau, Rethinking Trafficking in Women.

35. Hansen, ‘Reconstructing desecuritisation’, 533.

36. Ibid.

37. OECD, Digital Security Risk Management for Economic and Social Prosperity.

38. OAS, The Inter-American Integral Strategy to Combat Threats to Cyber Security.

39. OECD, Digital Security Risk Management for Economic and Social Prosperity.

40. CONPES, Lineamientos de política para la Ciberseguridad y Ciberdefensa [Policy Guidelines for cybersecurity and cyberdefence].

41. CONPES, Política Nacional de Seguridad digital [National Policy of Digital Security].

42. The NGO Fundación Karisma is the leading Colombian civil society organisation working on the promotion of human rights in the digital world.

43. CONPES, Lineamientos de política para la Ciberseguridad y Ciberdefensa [Policy Guidelines for cybersecurity and cyberdefence], p. 2, translation by the author.

44. OAS, The Inter-American Integral Strategy to Combat Threats to Cyber Security.

45. Interview with an OECD expert, 11 September 2018.

46. OAS, The Inter-American Integral Strategy to Combat Threats to Cyber Security, pp.1–2.

47. Ibid., 2.

48. Baracaldo Orjuela and Chenou, ‘Regionalism and presidential ideology in the current wave of Latin American integration’.

49. OECD, Digital Security Risk Management for Economic and Social Prosperity.

50. Interview with an OECD expert, 11 September 2018.

51. Ibid., 4.

52. Ibid., 8.

53. Interview with an official from the Colombian Ministry of ICTs, 30 September 2016.

54. Interview with an official from the Colombian Ministry of Defence, November, 16, 2016.

55. CAF, Indicador Índice de Desarrollo del Ecosistema Digital por Países [Index Indicator of the digital ecosystem development by country].

56. CONPES, Política Nacional de Seguridad digital [National Policy of Digital Security], p. 4, translation by the author)

57. Ibid., pp. 9–10, translation by the author.

58. Ibid., pp. 17–18, translation by the author.

59. Mijares, ‘Performance of the South American Defense Council’.

60. For a critique, see Goldsmith and Wu, 2006.

61. Kuntsman and Stein, Digital militarism.

62. Ibid., 6.

63. CONPES, Política Nacional de Seguridad digital [National Policy of Digital Security], 54, translation by the autor.

64. Interview with experts from Fundación Karisma, 14 September 2016.

65. OECD, Digital Security Risk Management for Economic and Social Prosperity, p. 9.

66. Galtung, ‘Three Approaches to peace’.

67. Chenou and Bonilla-Aranzales, ‘Cyber Peace and Intrastate Armed Conflicts’.

68. Kuntsman and Stein, Digital militarism.

69. Maschmeyer et al., ‘A tale of two cybers’.

70. Dunn Cavelty and Wenger, ‘Cyber security meets security politics’.

Additional information

Notes on contributors

Jean-Marie Chenou

Jean-Marie Chenou is an Associate Professor at the Department of Political Science at the Universidad de los Andes in Bogotá, Colombia. He obtained his PhD in Political Science from the Université de Lausanne (Switzerland). His research interests include Internet governance, the regulation of digital markets and the study of digital transformation in the Global South.