2,517
Views
10
CrossRef citations to date
0
Altmetric
Article

Deferring substance: EU policy and the information threat

ABSTRACT

The article describes EU cross-sectoral policy work on online information threats, focusing on the intersection between values and 'referent objects'. Examining discussions on strategic communication, censorship, media literacy and media pluralism, two value-perspectives were identified: while abstract procedural values of efficiency and coherence guide content management in the security/defence/internet communities, media/education communities highlight the end-goals of content pluralism and enhanced citizen judgement. In implementation, the former’s lack of substantive goals, coupled with an outsourcing of content management, may give rise to hybrid values. The findings highlight the danger of neglecting substance in favor of efficient management of an online ‘battlespace’.

Information and communications technologies (ICTs) allow citizens to access and share vast amounts of information as part of their everyday life. Simultaneously, the security-issues arising from this environment have made the communicative aspects of cyberspace an arena for European Union security policy. A 2016 report by the EU Parliament states that the Union, its Member States and citizens are under a ‘growing, systematic pressure to tackle information, disinformation and misinformation campaigns and propaganda from countries and non-state actors’.Footnote1 Perpetrators listed include a wide range of different groups who, nevertheless, all appear to have in common the goal of ‘distorting truth, provoking doubt and dividing Member States’ through communication and (mis)information-sharing.Footnote2 When suggesting methods for countering information risks, policy intellectuals tend to identify and conceptualize a variety of existing and possible threats. Labels used are ‘information warfare’, ‘hybrid war’, ‘propaganda’, ‘hostile strategic communications’ or (hostile) ‘narratives’.Footnote3 The idea of what constitutes security in relation to such threats, however, remains largely unarticulated and underexplored. Threats related to the everyday communicative side of information technology appear difficult to conceptualize in relation to security, which traditionally refers to distinct objects of protection and exceptional circumstances. What does security mean, and what does security-making entail, in a setting where communicative technologies form an intrinsic part of citizens’ life?

To throw some light upon this question, this article describes recent policy developments in the EU that attempt to create ‘security’ in relation to problems and threats related to the communicative side of ICTs. The overarching aim is to map security-related values, as well as to explore the intersection between values and objects of protection, as discernible through observations of EU policy and policy discussions addressing the information threat. The reason for this focus is twofold. First, no equally comprehensive account of developments in this policy field is currently available. While Intelligence Studies addresses the information threat more broadly, discussions in this line of research almost exclusively involve military or operational perspectives on deception, Psychological and Information Operations, rather than everyday communication threats directed at citizens requiring the intervention of political actors.Footnote4 To keep track of what an influential actor, like the EU, does in relation to new threats is thus important for anyone concerned with the normative and political questions of what should be done to combat those threats. Second, the detailed account of EU policy efforts offered here will provide a much-needed basis to further theoretical discussion, or academic debates, on the meaning of security, and potentially changing meaning of security, as political actors face threats posed through new communication technologies. The need to think carefully about what security means in relation to online information threats can be discerned in the failure of existing research to come up with a broadly acceptable conceptual frame to account for such policy efforts.Footnote5 This article thus aims to broaden the scope from the ‘hard’ or technological side of security commonly addressed within the field of Cybersecurity, to describe the particular challenges that spring from countering a threat related to the communicative side of ICTs.Footnote6

In studies addressing the information and communication environment more generally, ‘hard’ and/or technical aspects have often been favoured by scholars investigating topics such as critical infrastructure protection, cyberwar or cybercrime while the ‘soft’ informational dimension is primarily explored in communication studies or with the help of communication theory.Footnote7 Where the former often links security to referent objects in the physical world and draws on state security discourses, the latter treats security as a backdrop for theoretical explorations into communication rather than a concept to be theorized in its own right. The threat of information has been more thoroughly explored by scholars within strategic and intelligence studies under headings like ‘information warfare’, ‘hybrid warfare’ and ‘deception’.Footnote8 Nevertheless, the assumed military setting in this type of research tends to leave crucial aspects of the current phenomenon under-theorized. Firstly, the information threat today is a ‘complex threat’Footnote9; a threat which calls into question ‘the meaningfulness of differentiating between internal and external security’ – a distinction fundamentally underpinning strategic studies.Footnote10 Without the traditional framework of state security, the object of protection in this setting remains unclear. Secondly, the widespread use of ICTs and enhanced digital infrastructures moves contemporary acts of deception, misinformation and disinformation from an outspoken conflict setting into the everyday life of citizens. A central challenge for policymakers here is how, in practice, such a boundless informational threat should be pursued. The envisaged remedies to the information threat in the contemporary political environment are multifaceted, to say the least: whereas privately funded projects provide technological solutions for deleting terrorist content and media companies offer professional ‘fact checking’ services, state actors work to limit illegal material through law enforcement and education professionals press for enhanced critical thinking. To understand the security-challenges in this context, it is of fundamental importance to address this morass of policy initiatives in empirical detail.

Investigating EU policy on the information threat, the article finds four proposed remedies: strategic communication, censorship, media literacy and media pluralism. The remedies are articulated within four separate EU policy communities: the security/defence, Internet, media and education sectors. These communities, in turn, describe security-related values in two distinct ways. The security/defence and Internet communities outline security-making in abstract procedural terms, emphasising efficiency and coherence. The referent object is the informational space, described as a digital ‘battlefield’ protected through continuous management: deletion and production of online content. Any articulations of end-values, specific descriptions of content to be deleted or produced, however, are outsourced to independent actors. The media and education communities relate security to the production of pluralistic online content and initiatives teaching citizens to consider different viewpoints. Security-related values implied are perspectivism and, ultimately, independence of judgement, while the object of protection can be described as citizens’ independent democratic judgement. Turning to the process of policy implementation, the analysis displays how hybrid value-constellations may arise with the involvement of three independent actors: civil society, professional communicators and the Internet industry. The respective value systems of these actors may work counter to the end-goal of citizens' independent democratic judgement. Overall, the findings point to a danger in disregarding the question of content and pursuing the information threat through defensive strategies alone; a suitable remedy must consider the substantial values we want to protect and constitute, in all steps of the process.

The rest of the article is disposed in five sections. First, the article outlines the advantages of investigating EU policy on the information threat by exploring values and the intersection between values and referent objects though a value-critical policy analysis; second, it introduces the policy communities and the material which provides the basis for the analysis; third, it pinpoints the EU policies on the information threat in relation to the communities countering the threat; fourth, the analysis zooms in on four key policy communities describing two distinct perspectives on security-related values; fifth, using contemporary examples, it considers the potential consequences of involving three kinds of independent actors from a value-critical perspective: civil society, professional communicators and US Internet companies; finally, it sums up the findings and discusses possible implications for pursuing security in relation to the information threat.

I. Security, objects and values

Critically oriented approaches have shown that security is not a stable concept. Security is always the security of something – it comes with certain assumptions of a ‘referent object’ worth protecting.Footnote11 The referent object might be regarded as the ‘object’ (broadly speaking) to be protected against existential threats in a particular security context.Footnote12 Essentially, however, it is linked to how we understand, talk about and propose to counter a specific threat. Within the Copenhagen School the referent object of security is conceived of as constituted through particular ‘securitizing’ moves by key actors through which an existential threat is established by references to protection.Footnote13 Discourses on national security are most typical in this respect. However, in other settings, such as cybersecurity, the referent object can be more multifaceted.Footnote14 This narrow focus on objects to be protected, and the linkages between them, however, fails to capture less overt aspects of security-making. In relation to the information threat, securitizing moves outlining specific objects of protection are mostly absent. Instead, we face a paradoxical situation where threat-discussions are common, but references to protection are not. In order to capture what security is in relation to the information threat, it is necessary to widen the scope of investigation. This article proposes that, to explore security in relation to the information threat, we need to include a focus on security-related values. As pointed out by Burgess, security always links up to a particular set of human values.Footnote15 That which has no value ‘cannot be threatened in the same sense’ as that which we hold dear.Footnote16 The focus on values, however, comes with certain methodological demands. Due to their ‘fluid and amorphous’Footnote17 nature, the protection of values inevitably involves a process of constitution and re-constitution. In order to map security here, it is thus necessary to take into account the security-related values envisaged and ‘implemented’ in the process of security-making, but also the intersection between values and objects. In short, values can help constituting certain referent objects as well as to counteract their constitution.

More precisely, the empirical study draws on a value-critical policy analysis.Footnote18 As shown by Bigo, the different ‘threat perceptions’ of bureaucrats and security professionals can be regarded as one of the main drivers in security governance.Footnote19 To consider the values forwarded in policy and within relevant policy communities is thus key to mapping this emerging security field. Seeing policymaking as a situated meaning-creating practice, the value-critical policy analysis allows the researcher to consider both the role of value guiding policymaking – values related to ‘security’ – and the ‘context nourishing these assumptions’.Footnote20 The result is a mapping of ‘local knowledge’Footnote21 in relation to proposed policies – the shared knowledge among a community of policymakers.Footnote22 In selecting material, the aim has been to not only consider the policies themselves, but also focus on how policy actors discuss the issues or, when possible, reading ‘what they read’.Footnote23 By paying attention both policy and local knowledge it becomes possible to better understandFootnote24 ‘the ultimate ends of public policy – the goals and obligations that policy wants to promote as desirable in their own right’.Footnote25 Finally, by mapping policy on a specific topic in a detailed and systematic manner, the article differs from previous, more theoretical, studies on security and cyberspaceFootnote26 in being carefully empirically grounded.

The EU is a central case for investigating the information threat. Recently making cyberspace into a key security priority,Footnote27 the Union is widely regarded as an active and powerful player in the world of Internet governance. Considering the EU as a case, however, inevitably requires some attention to its organizational structure. The world of EU security policy is multifaceted. In relation to complex threats, EU initiatives make up a transnational and transboundary ‘protection-oriented policy space’, described in recent research as ‘civil security’.Footnote28 Contemporary policies on the information threat stretch over a highly diverse set of areas – from security/defence and Internet to education, culture and media policy. From the perspective of policy values, such a ‘cross-sectoral’ approach may give rise to conflicts.Footnote29 If every sector forms a community relying on its own local knowledge in the policy process, different end-goals may be emphasized within different policy communities.Footnote30 The value-critical approach here helps in pinpointing potential value-conflicts, either between stated end-goals or between policy goals and processes of implementation. Burgess argues that cross-sectoral policy work can give rise to a ‘hybridization’ of values.Footnote31 Hybrid constellations emerge when different value-systems overlapFootnote32 and become particularly salient with the use of ‘non-military instruments’ for countering threats and the involvement of professionals not traditionally participating in security work.Footnote33 This complexity highlights the need to take into consideration policy implementation when mapping security in relation to complex threats. The multitude of actors involved in addressing the information threat might understand security in different and, even, conflicting ways which, in turn, can lead to new, unforeseen, interpretations of security-related values.

II. The policy communities

The analysis of security-related values focuses on material related to the main policy communities involved in countering the information threat: the security/defence, Internet, education and media sectors. Four centrally placed forums serve as entry-points for investigating security-related values: the EUISS, the EU Internet Forum, the ET2020 and the Media Literacy Expert Group. The forums were selected to represent the local knowledge within each community in the overall cross-sectoral approach employed by the EU. The below section introduces the actors and their role in EU policymaking as well as the material considered.

The EUISS is an autonomous agency under the Common Foreign and Security Policy set-up to analyse EU security and defence issues, engage in strategic debate, contribute to the common security culture within the EU. This group is the main producer of policy-relevant knowledge for the security and defence community within the EU, and serves as an entry-point into the local knowledge among policy active in this context. The analysis consults their comprehensive report on strategic communication produced for the European Parliament Committee on Foreign Affairs titled ‘EU Strategic Communication with a view to countering propaganda’ – the only comprehensive report to date on the information threat.Footnote34 Due to the independent working conditions of the group, internal discussions or meeting summaries are not available. To compensate for this, the analysis takes into account also externally produced material recommended – upon direct request – by the main author of the report. This material consists of an interview with communications scholar Philip M. Taylor (2002) and the report ‘Strategic Communications and National Strategy’ (2011) by Chatham House; the only source on strategic communication cited in the EUISS report.Footnote35 In addition, the analysis has also considered the ‘Fotyga report’ adopted by the EU Parliament Committee on Foreign Affairs after the reception of the EUISS report.Footnote36

The EU Internet Forum represents the Internet sector. Launched by the Commissioner for Migration, Home Affairs in 2015, the forum consist of representatives from US Internet companies, law enforcement agencies and government officials. Their main task is to ‘stop the misuse of the Internet by international terrorist’ through increased coordination between Internet actors and the EU law enforcement agencies. All meetings of the group take place behind closed doors and unofficial material is overall very limited. As a result, documents from the EU Internet Forum consist of official press releases and the ‘Code of Conduct on Countering Illegal Hate Speech Online’ signed by the IT companies. While this creates certain limitations for the analysis, the lack of material also constitutes a starting-point for further reflection.

The ET2020 serves as a forum for exchange of knowledge between EU member states in the education sector chaired by the Commission. The aim of each Working Group is to deliver output on policies agreed on by EU education ministers through ‘peer learning’ and ‘good practices’. Members consist of government representatives, stakeholders and international organizations. The analysis here focuses on the ET2020 Working Group on promoting citizenship and the common values of freedom, tolerance and non-discrimination through education’Footnote37 set up in 2016 which addresses common challenges identified in the 2015 Paris DeclarationFootnote38 – the radicalization and online indoctrination of young EU citizens. The analysis takes into consideration a rich collection of documents such as the official declaration by EU education ministers, a comprehensive summary of the first meeting and follow-up documents mapping the policy progress.

The Media Literacy Expert Group,Footnote39 primarily connected to the media sector, is chaired by the EU Commission. The forum consists of a fluid network of different stakeholders from member states, representatives of associations working with media literacy and members of expert organizations in the field. The material here consists of selected transcriptions of one video recorded meeting, two comprehensive meeting summaries and meeting presentations.

In the process of selecting material, other forums and types of material have been considered and dismissed. In the security community, the Radicalisation Awareness Network (RAN) plays a central part in addressing the information threat through online counter-narratives. However, since the EUISS is a key forum for knowledge-production in relation to EU security policy, an analysis of the security-related values promoted by this group here will likely give an illustration of values prominent within the security/defence community at large. With regard to the kind of material used, interviews could possibly enrich the analysis – in particular in relation to the sparse material in relation to the Internet sector. Still, since the overall aim has been to consider values anchored in knowledge ‘held by policy-related actors together as a group’Footnote40 – not the opinions of individuals – the focus has been on, either official statements agreed upon by the groups, material recommended by officials or referred to in the reports produced.

III. The policies

This part provides an overview of the EU policy in relation to the information threat to date. The remedies suggested can be summarized into four distinct categories: strategic communication, education in critical thinking/media literacy, media plurality and censorship. The below section briefly outlines the approaches in relation to the main policy sectors in which they are promotedFootnote41; a more in-depth discussion follows as part of the analysis.

The suggestion of using strategic communication as a remedy for the information threat is most prominent within the security and defence policy sectors. In relation to the contemporary internal threat of violent extremism and radicalization, the EU Security AgendaFootnote42 argues for a strengthening of ‘EU strategic communications’ and increased attention to the production of ‘common narratives and factual representation of conflicts’.Footnote43 In line with this goal for internal security, the RAN, a network of practitioners organized under the Directorate-General of Migration and Home Affairs , has been set up to promote good practices in relation to ‘counter narratives’ in the online environment. The defence sector suggests strategic communication as an approach towards external information threats. Most notably, the launch of the East StratCom Task ForceFootnote44 in October 2015, consisting of 10 full-time communication experts within the European External Action Service (EEAS), introduced strategic communication as a remedy to disinformation specifically coming from eastern actors. According to their 2015 Action Plan, the communicative approach should further ‘the EU’s overall policy objectives’ in the Eastern Neighbourhood Region through ‘positive and effective messages regarding EU policies’.Footnote45 Similarly, the ‘Joint Framework to Counter Hybrid Threats’, adopted by the EU Commission and High Representative in April 2016, highlights the crucial role of strategic communication in relation to information threats from malicious actors. This policy framework calls for the development of coordinated communication mechanisms to counter externally produced disinformation.

Policies aimed to strengthen critical thinking and media literacyFootnote46 are promoted within the education and media sectors under the common Directorate-General of Education, Youth, Sport and Culture. Traditionally, education policy is the sole responsibility of nation states. However, current policy initiatives on the EU level urges for increased coordination between Member States in relation to matters of disinformation and propaganda. The Paris Declaration, adopted by EU Education Ministers in 2015, is a key agreement in this respect. The Declaration calls for a strengthening of

children’s and young people’s ability to think critically and exercise judgement particularly in the context of the Internet and social media, they are able to grasp realities, to distinguish fact from opinion, to recognise propaganda and to resist all forms of indoctrination and hate speech’.Footnote47

As part of its implementation, the strategic framework for European Cooperation in Education and Training (ET2020), provides a forum for the exchange of ‘best practices’ and mutual learning between Member States in the area of education policy. The ET2020 Joint ReportFootnote48 from 2015 explicitly connects media literacy with online information threats by listing the enhancement of ‘critical thinking’ and ‘cyber and media literacy’ as central priorities. In addition to this, the 2016 meeting of the group focused explicitly on the enhancement of critical thinking as a way of countering online radicalization and other information threats.Footnote49 In addition to this, the Directorate-General of Communications Networks, Content and Technology (DG CNECT) has launched the Media Literacy Expert Group – a network of EU stakeholders from member states and experts in the fieldFootnote50 – in order to identify ‘good practices’ in relation to media literacy.

Media pluralism is a strategy promoted within the media sector and part of the security work pursued within the framework of the Digital Single Market.Footnote51 Apart from the Media Literacy Expert Group, which emphasizes media pluralism in lieu with media literacy, DG CNECT in 2017 launched the High-Level Expert Group on Fake News, which suggests ‘diversity of information’ as a key main principle for action in relation to online disinformation.Footnote52 In addition, the Commission funds projects together with the European Centre for Press and Media freedom focusing on media freedom in the Neighbourhood Areas.Footnote53 An older but still ongoing initiative focusing on media pluralism within the EU is the Media Pluralism Monitor – an online tool developed by the European University Institute and funded by the EU Commission in 2009.

Finally, online censorship – the removal of extremist content and hate speech online – connects the information threat with both the security and Internet sectors. Two different initiatives exist in relation to online content-removal.Footnote54 First, the EU Internet ForumFootnote55 – a forum for dialogue between EU Interior Ministers, Europol, the EU Parliament, the EU Counterterrorism co-ordinator as well as representatives from US Internet companies launched by the Commission in 2015. The aim of this forum is to encourage the Internet industry to delete undesirable online content through self-regulation. Second, the EU Internet Referral Unit – an entity operating under Europol with the task of ‘helping Member States to identify and remove violent extremist content online in cooperation with industry partners’, launched the same year.Footnote56 This unit focuses on the detection, review and deletion of terrorist propaganda, recruitment attempts and content in the online space while gathering intelligence on terrorist activities – in particular related to Al Qaeda and Daesh.

This section has provided an overview of the various EU initiatives and sectors involved in countering the information threat. To throw some light upon the security-related values implied in the policy work, however, it is necessary to take into consideration local knowledge. In the below, the values connected to the remedies of strategic communication, media literacy, media pluralism, and censorship are analysed by taking into account policy material and discussions related to four central actors.

IV. The values and referent objects

Taking into consideration local knowledge, the empirical analysis finds two different sets of security-related values. A sharp dividing line exists between the policy communities active in the security/defence and Internet sectors and the communities linked to media and education: the most notable difference between the two perspectives is the contrastive relationship with end-values. Whereas the EUISS and the EU Internet Forum consistently refrain from discussions or solutions conveying any substantial policy goals and, instead, describe security in relation to abstract procedural values – efficiency and coherence – those active in the Media Literacy Expert Group and ET2020 present a security hinging on perspectivism – an instrumental value ultimately aiming to secure independence in relation to citizen-judgement. The former two communities, then, emphasize values guiding security-making processes aimed to protect the informational space whereas the latter, instead, outlines citizens’ independent democratic judgement a desired outcome of this process: an end-goal for security.

The first set of security-related values and objects is presented in the below under the overall heading of ‘Security, Coherence and Efficiency’ and, the second, under ‘Security, Perspectivism and Independence’.

Security, coherence and efficiency

Policymakers within the security/defence and Internet communities primarily rely on strategic communication and censorship to counter the information threat. Taking as a starting-point discussions and policies suggested by the EUISS and the EU Internet Forum, the below section describes how coherence and efficiency become two complimentary techniques for managing the informational space.

On the topic of strategic communication and online censorship, the EU actors emphasize the importance of a unified message. Strategic communication, in the EUISS report, is described as the production of coherent communication disseminated online in relation to widespread threat coming from ‘East, south and inside’.Footnote57 Focusing primarily on official EU communication, a central criteria for a successful campaign is, first and foremost, tight ‘coordination and consistency’.Footnote58 Strategic communication is communication infused with ‘an agenda or a plan’ as opposed to open-ended online discussions or scattered initiatives by individual EU agencies.Footnote59 By swiftly producing a ‘single coherent set of agreed common narratives’, the policy should be used as a form of ‘rapid intervention’ in response to the information threat.Footnote60 The EU Internet Forum outlines a similar form of informational management when suggesting a combination of strategic communication and censorship to counter hostile content online – here, primarily on social media. The explicit objectives of the Forum are to ‘reduce accessibility to terrorist content’, but also to ‘increase the volume’ of alternative narratives online.Footnote61 Speaking at the EU Internet Forum, the Commissioner for the Security Union, for instance, emphasizes the importance of ‘reducing accessibility to terrorist material’ while simultaneously offering ‘persuasive but positive alternative narratives’.Footnote62 The purpose of strategic communications is, according to a piece recommended by the EUISS, to produce so-called ‘credible truths’.Footnote63 The core argument here hinges on the basic understanding that there is ‘rarely such a thing as telling the whole truth’.Footnote64 However, by presenting a coherent set of narratives, an argument can be made ‘on your truth’s behalf’.Footnote65 Hence, both strategic communication and censorship aim to achieve informational coherence and, ultimately, a sense of control over the digital information space though coherent, efficient and timely interventions. Efficiency in terms of time is particularly crucial for the EU Internet Forum. In one of their press releases, they describe the process for removing terrorist content in relation to a ‘golden hour’ objective.Footnote66 To achieve a timely intervention, the Forum suggests a turn to technology. For instance, automatic detection of undesired content and algorithms pinpointing illegal or offensive messages – sometimes even before such messages appear online – are characterized as desirable remedies.Footnote67 Overall, it is possible to describe the policy documents and published material produced by the EUISS and the EU Internet Forum as founded in two abstract procedural values: coherence and efficiency.

To flesh out how these values translate into a vision of security, it is necessary to consider the understanding of the threat strategic communication and censorship are to counter. A plausible threat-description embraced by the EUISS is the idea of the ‘information vacuum’.Footnote68 In a piece recommended by the EUISS, the information vacuum is described as a black hole in the government communication flow that can be ‘vacated by the morass of lies, rumours and disinformation generated by its adversaries’.Footnote69 Hence, unless adequately managed, much like a force of nature, the information vacuum will perpetually fill up by itself. While this threat-description is usually employed to describe the necessity of strategic communication in a context of war, it is here taken to describe everyday information threats online. Commissioner Avramopoulos at the EU Internet Forum, for instance, depicts the entire online space as a new ‘battlefield’ where terrorist messages become ‘infectious, spreading from bogus social media accounts, from one platform to another’.Footnote70 In the informational space, then, the war is potentially ever-present and information requires continuous management. A similar connection between a logic of war and the new information environment is outlined in the report ‘Strategic Communications and National Strategy’ embraced by the EUISS.Footnote71 This piece makes clear that the lack of a coherent and efficient communications strategy on the part of the authorities not only provides one’s enemies with a chance to supply the public with disinformation or propaganda – but it will leave the floor open to a vast miscellany of information. The report underlines: ‘we’re being “out-communicated” – not only by our enemies but by a wide range of perspectives that are sometimes hostile, sometimes indifferent’.Footnote72 This position is echoed by the Fotyga report, adopted by the Parliamentary Committee on Foreign Affairs, which describes the information threat widely in terms of ‘information, disinformation and misinformation campaigns and propaganda’.Footnote73 Even seemingly unproblematic, ‘indifferent’, information thus appears to pose a problem online. The information threat does not only involve false information, but a lack of control of online information per se. What is called for here, in short, is an understanding of security as intimately connected with an increased and continuous presence in the online environment on the part of the EU.

The combination of strategic communication and censorship offers a two-pronged approach to manage the information vacuum. Despite this emphasis on content production and deletion, however, the actors rarely elaborate on the substance of the strategic communication disseminated by the EU, or the censored online content. What is more, rather than engaging in such a discussion, the EU Internet Forum argues that the production of positive content should be outsourced to paid independent actorsFootnote74: the ‘hundreds of NGOs’ and ‘CVE partnerships’ employed by the Internet companies linked to the EU Internet Forum.Footnote75 The same lack of substance-related discussions are visible in the strategic communication strategies proposed by the EUISS. While consistently underlining the importance of ‘positive messages’, ‘respect’ and encouraging ‘story-telling’, the use of ‘real people’, ‘irony’ and ‘satire’, the comprehensive EUISS report mentions little in the way of substantial content.Footnote76 Clearly, it is impossible to specify narrative content in detail on the strategic level. Nevertheless, the active avoidance of generating substance becomes clear when the EUISS formulates a strategy where content is not a policy-matter at all.Footnote77 Instead, decisions on content production are delegated to ‘media operators’ and communicators recruited by EU agencies. What is more, and perhaps most notably, the same strategy is partly employed towards deletion of content. While the ‘database of hashes’Footnote78 – a shared database of known terrorist content – includes the active involvement of EU law enforcement agencies; the companies related to the EU Internet Forum – Facebook, Twitter, Youtube and Microsoft – have also signed a voluntary agreement to remove ‘hate speech’ from their platforms without any form of external legal review.Footnote79

To sum up, then, security in the security/defence and Internet sectors involves managing the information space through positive and negative interventions, rather than filling it with any specific (political) content. The referent object these values aim to protect is the informational space, understood broadly. Still, coherence and efficiency are here, first and foremost, abstract procedural values guiding the process of security-making, rather than end-goals characterizing the substance to be delivered. While the EUISS calls for a coherent narrative, this argument is made – not because they can point to or outline such a narrative – but for reasons of coordination. The ultimate purpose which crystallises here is thus to win the battle over the communicative space, regardless of content.

Security, perspectivism and independence

The education and media policy sectors suggest two methods for countering the information threat: media literacy and media pluralism. In short, media pluralism is defined as a heterogeneity of political, cultural, geographical, structural and content dimensions in the mediaFootnote80 while media literacy refers to ‘all the technical, cognitive, social, civic and creative capacities that allow us to access and have a critical understanding of and interact with both traditional and new forms of media’.Footnote81 Applied to the online sphere, the first policy, according to the Media Literacy Expert Group, provides citizens within the EU and the Neighbourhood Regions with a healthy miscellany of viewpoints. The second, in the view of ET2020, enhances the critical skills needed to both seek out and process such pluralistic information.

Taking into consideration the policy discussions, it is clear that the information threat pinpoints a need for a new form of citizen-knowledge. More specifically, citizens need skills that take as their blueprint the profession of the traditional journalist. At the 2015 meeting of the Media Literacy Expert Group, Aralynn McManeFootnote82 argues: citizens have to learn to ‘use reporter-like skills to assess all info to separate fact from fiction’, ‘make informed judgements as users of information […] and to become skilful creators and producers of information and media messages in their own right’.Footnote83 Journalistic material is, furthermore, a central backdrop for this form of knowledge. In line with this, media needs to ‘promote the freedom of expression and the freedom of the press’ also in the digital world by providing the public with ‘professional, reliable journalistic content’.Footnote84 Consequently, if strategic communication and censorship goes back to the idea of producing coherency in online space, the proposals for media literacy and media pluralism, instead, emphasize the importance of exercising informed judgement and taking a manifold of viewpoints into account. The key value that the policies of media pluralism and media literacy aim to promote may thus be understood in terms of ‘perspectivism’.

To throw some light upon how this perspectivism is linked to security, we might consider the understanding of the perceived threat among the policy intellectuals here. In her welcome address at the 2016 meeting of the Media Literacy Expert Group, Lorena Boix AlonsoFootnote85 describes a fragile geopolitical situation and a ‘radicalized’ society.Footnote86 Arguing that, ‘in times where people are so upset, it is very important that when they go to vote they know what they are doing, and they are well informed’ Boix Alonso furthermore makes a link between perspectivism and democracy.Footnote87 What is specifically required, she argues, is an ability among citizens to ‘exercise these democratic choices and tools [put] in their hands by democracy in a wise way, in an informed way’.Footnote88 Similarly, Commissioner Harry Panagopulos underlines that ‘significant challenges confront citizens in accessing a plurality of sources of [political] information, particularly across borders, and in terms of their confidence in the information they have access to and the modern media environment’.Footnote89 The main threat appears to be that EU citizens struggle with a vast array of unreliable information. Security, then, entails that citizens acquire the skills to evaluate (the reliability of) such information. Hence, while being exposed to the threat, citizens also form an active part in producing the information threat. Comparing the current situation with the time before the Internet, Boix Alonso states that: ‘in the past when people were going to exercise their democratic rights, they were receiving information. With social media, they do not only receive, but they also participate’.Footnote90 Similarly, the ET2020 collection of ‘good practices’, argues that ‘young people are confident but not necessarily competent users of the (new) media’.Footnote91 Whereas the policy sectors of security/defence and the Internet understand the security problem as grounded in an abstract ‘information vacuum’, policy intellectuals conceive of the threat as rooted in the vast array of unreliable information coupled with the general incompetence of citizens in managing the online environment. As Adian White from the Ethical Journalist Network states: the Internet has been ‘taken over by governments, corporations and people who don’t understand it’.Footnote92

The perspectivism forwarded within these communities is clearly linked to a higher value: that of securing the active independent democratic citizen. The ET2020 describe the ultimate outcome of their policies on the information threat in terms of young people learning to ‘recognise propaganda and to resist all forms of indoctrination’, to decode and analyse ‘representations and stereotypes’ and recognize messenger bias in relation to a specific goal: to master the tools of democracy.Footnote93 Media literacy, furthermore, is specifically referred to as a new ‘civic competency’ – a skill ‘closely related to active engagement in democratic life’.Footnote94 For instance, in relation to the ‘competent’ sharing of content, the ET2020 suggests that teachers should encourage their pupils to build and disseminate ‘their own narratives’ to counter ‘hate speech and indoctrination’ online.Footnote95 The end-goal of these policies implies an understanding of security as related to a particular form of democracy contingent upon the active and, crucially: independently thinking citizen. If perspectivism is the means, the goal is independence. What ultimately is to be protected, the referent object that these policies want to safeguard, can thus be described as a form of independent democratic judgement. Unlike the object forwarded by policymakers within the security/defence and Internet communities, however, this referent object is protected though its very constitution: the policies suggested, in this sense, are meant to provide the fertile ground for citizens’ independent judgement to appear.

In sum, forwarding the values of perspectivism and independence as remedies for the information threat, the policy communities understand security as hinging upon a new form of Internet-savy democratic citizen. Safeguarding citizens’ independent democratic judgement is thus the overarching end-goal of both media literacy and media pluralism. Finally, whereas the security/defence and Internet sectors turn to independent actors in the production and deletion of content, the media and education communities primarily rely on public authorities and already-active national stakeholders in policy implementation.Footnote96

V. Implementation

This section focuses on security-related values in the policy work conducted by independent actors, and aims to throw some light upon the potential output side of EU policies on the information threat. Three kinds of actors suggested by the security/defence and Internet communities are taken into consideration: civil society, professional communicators and the Internet industry. Considering contemporary examples of policy initiatives related to these actors (or presumed actors), the analysis shows that overlapping and potentially conflicting security-related values may arise with the outsourcing of online substance-production. The underlying argument is that, if each actor approaches the process of informational management in according to a value system ‘proper to one environment’Footnote97 – civil society, media or the technically-oriented Internet industry – these value-systems may have unfortunate and unforeseen effects on the output side of EU policy. The involvement of these actors, coupled with the lack of specificity in relation to substance on the part of EU policymakers may then, in the end, result in hybrid value-constellations in the implementation phase. In particular, the examples illustrate how the abstract procedural value of efficiency can come to encroach upon the construction of reliable and pluralistic content and, thus, how protecting the informational space though timely interventions might, in fact, counteract the constitution of citizens’ independent judgement.

Strategic communication is meant to produce a ‘credible truth’ online; however, the outsourcing of content to civil society actors may actually work to counter this aim. An example is the Civil Society Empowerment Programme, an initiative under the EU Internet Forum with the aim to recruit and train civil society actors in order to ‘provide a credible voice for counter or alternative narrative campaigns’.Footnote98 Credibility is the foremost criteria for recruitment in their call for applications, which states that: ‘Both NGOs and statutory practitioners are welcome, as long as the criteria on being a credible are fulfilled’.Footnote99 While this kind of outsourcing can be in line with the values of independence and perspectivism embraced by the media and education sectors, credibility can also be an instrumental value related to a particular kind of efficiency. The Chatham House report, for instance, underlines that borrowed credibility is, in fact, crucial when ‘strategic communications require subtlety of message and where the intended influence and outcome should not be seen as connected in any way to government interests or aims’.Footnote100 By consciously involving external actors and, by ‘operating outside government messaging’, it is possible to ‘depoliticize and demilitarize strategic communications’ and thus reach a wider audience.Footnote101 While this may be entirely unproblematic – after all, representatives volunteer to participate with their own projects – the practice of strategically using civil society in order to operate outside of government messaging could also work to hollow out the reliability and independence that they promote. In such a situation, the credibility of the independent actor could be undermined by the desire for communicative efficiency; a credibility which, rather ironically, is the very currency used by the EU in the first place.

The EUISS report calls for an outsourcing of content production to professional communicators – a way of using individuals who ‘understand’ the Internet to provide reliable information to European citizens.Footnote102 This form of substance-deference is particularly present in the official communication produced by the EU. The East StratCom Task Force, created in 2015 with the aim of promoting EU policies towards the Eastern Neighbourhood, can serve as an illustrative example. In this case, the professional communicators recruited to the Task Force, upon their installation, came to play a very active role in creating messages for the EEAS.Footnote103 Interviewing the initiators and practitioners part of the group initial group, Hedling describes how their work quickly came to be guided by the ‘reach and exposure’ of content.Footnote104 By adopting this form of media logic, however, the professionals made efficiency into a feature of the content itself, rather than an abstract procedural value guiding the organizational setup. As a result, the Task Force ended up producing mainly ‘simplified, polarized, spectacularized’ messages towards the Eastern Neighbourhood.Footnote105 This kind of professionalized content production, when coupled with the media logic driving communication professionals, thus veer starkly from the values of perspectivism and independence in the media and education policy sector. Rather than producing reliable content or offering a multitude of different perspectives, the communication professionals involved in the Task Force make the abstract procedural value of efficiency into an end-goal in itself. Going back to the image described by Boix Alonso, the Task Force might thus have contributed to the ‘radicalized society’ online which they were, in fact, recruited to counter.Footnote106

Finally, there is the question of outsourcing content deletion to US Internet companies; companies which then provide efficient automatic removal, sometimes before the content even goes online. In principle, for a conflict of values not to arise on the policy level, the deference of substance can only be employed towards content production – not content-removal. While content production, in theory, could be pursued in line with the values of credibility and reliability, censorship on behalf of the EU is a legal matter. This gives rise to some questions in relation to the policies forwarded by the EU Internet Forum. In the ‘Code of Conduct on Countering Illegal Hate Speech Online’,Footnote107 signed by US Internet companies involved in the Forum, the parties accept responsibility for deleting illegal and offensive material on their respective platforms. However, the lack of clarity surrounding whether or not the Commission has requested the US Internet companies to remove content, or whether the agreement is voluntary, is a question yet pending an answer.Footnote108 Clear is, however, that the ‘Code of Conduct’ does not currently correspond with any specific law on the EU level.Footnote109 What is more, the companies are neither required to consider legal matters before content deletion nor to report deleted content to the legal authorities.Footnote110 Given this, it is possible to regard this setup as a way of outsourcing content deletion to private actors, giving rise to a ‘hybrid situation’Footnote111 in which the EU is the initiator of censorship while failing to take any legal responsibility. This move goes against the crucial freedom of expression and independent content production emphasized by the media and education sector and reflects a situation where private companies take over the task of EU law enforcement.

In sum, the outsourcing of content-management to independent actors may – if pursued along these lines – create a situation where efficiency comes into conflict with at least three values connected with the end-goal of security as citizens’ independent democratic judgement: credibility, reliability, and freedom of expression.

Concluding discussion

This article has identified four remedies against the information threat: strategic communication, censorship, media literacy and media pluralism. Situating these remedies in relation to local knowledge, the analysis outlines two distinct value-perspectives: while the security/defence and Internet communities emphasize the procedural values of coherence and efficiency, the education and media sector instead forward perspectivism as a way of achieving independence. In line with this, the latter points to an understanding of the referent object as citizens’ independent democratic judgement whereas the former focuses on protecting the digital ‘battlefield’ of the informational space itself.

Reading the two perspectives as complementary, one may regard continuous management of online space as serving both perspectivism and independence. Indeed, security can involve both a ‘secured’ online environment and Internet-savy democratic citizens. An active management of hate speech and terrorist propaganda, coupled with accurate official information, provides a crucial foundation for pluralist discussion and independent judgement in digital public space. However, value-conflicts arise when EU policymakers regard the informational space as yet another ‘battlefield’ for security-making and fail to engage with questions of substance. The outsourcing of content deletion and production leaves the articulation of a ‘credible truth’ and – crucially – the very articulation of the secured online space itself, to independent actors. The examples of policy implementation highlight that the means applied to protect the online space may counteract the end-goal of securing citizens’ independent democratic judgement. While EU policy describes efficiency in rather abstract terms, professional communicators and the Internet industry – driven by media logic and technological solutions, respectively – tend to regard efficiency as a value guiding both content production and deletion. Meanwhile, civil society actors could lose the very credibility that they are to represent if recruited to be efficient messengers on EU’s behalf. Involvement of independent actors in content-management, then, could give rise to unforeseen hybrid value-constellations on the output side of EU policy. When constructing efficient remedies for the digital battlefield, substantial values cannot be ignored. For future policymakers, this underlines a clear danger in pursuing the information threat through purely defensive strategies, taking as a single point-of-departure a boundless informational space requiring efficient interventions. If the information threat is a threat to our values, this must be taken into account throughout the entire policy process.

These findings add to previous literature on security and the communicative aspect of ICTs in several ways. In relation to studies on information operations focusing on top-down military-led activities in response to information threats,Footnote112 the cross-sectoral focus of this article illuminates some of the complex issues involved in the more far-reaching task of civil security-management. Overall, the findings should make it clear that relying on traditional preconceptions of security-making which emphasize an efficient response to threats in a pre-defined space may be problematic when applied to the communicative aspects of cyberspace. While technological solutions, or the involvement of independent actors, may provide a more efficient management of the ‘battlefield’, we must not forget that content, in the end, is what constitutes cyberspace. By focusing on action rather than the substance of action – in particular with regard to online censorship – authorities, in fact, lose control over the communicative aspects of the informational space. Furthermore, unlike in the case of cybersecurity, the information threat does not appear to display a multitude of referent objects. The policy area is, instead, characterized by two rather abstract objects of protection which, in the process of security-making, appear to counteract each other. Whereas the informational space is described as pre-given and thus requires protective measures, citizens’ independent judgement can be discerned as an end-goal to be constituted through policy. A more traditional approach to mapping the object of protection would inevitably have failed to see the conflicts between referent objects and proposed approaches for security-making outlined in this article.Footnote113 This finding points to a need for expanding the view of referent objects when investigating the communicative side of information technology and the approach could be applicable to other similar areas of civil security policy.

Disclosure statement

No potential conflict of interest was reported by the author.

Additional information

Notes on contributors

Hedvig Ördén

Hedvig Ördén is a PhD candidate in Political Science at Stockholm University. Her main research interests are concerned with political theory, intelligence analysis and EU security policy on the information threat.

Notes

1. Fotyga, “Plenary Sitting,” 3.

2. Ibid.

3. EUISS, “EU Strategic Communications”; Fortyga, “Plenary Sitting”; and Cornish, Lindley-French and Yorke, “Chatham House.”

4. Bennett and Waltz, Counterdeception Principles; Clark and Williams, Counterdeception; Bell, “Theory of Deception”; Whaley, “General Theory of Deception.” Focusing on everyday threats, there is a growing contemporary literature on ‘hybrid warfare’. The view of security, however, remains closely linked to the military-operational perspective (Lancu et al, Countering Hybrid Threats) and often focus on the ‘hard’ aspects of hybrid threats (Critical Infrastructure Protection, Niglia).

5. An interesting exception of a scholar addressing the information threat in relation to security, but with a different empirical scope to this article, is Mälksoo’s “Countering Hybrid Warfare” which mobilises the concept of ‘ontological security’ for reading NATO and EU security-making in relation to hybrid warfare.

6. The technological side often focuses on state security related to hacking and system-vulnerabilities. For a focus EU cybersecurity policy, see: Carrapico and Barrinha, “EU Cyber.” For critical readings on cybersecurity, see: Hansen and Nissenbaum, “Digital Disaster” or Dunn Cavelty, Cybersecurity and Threat Politics.

7. Deibert, Hyper-Realities; and Dunn Cavelty, Cyber-Security, 6–7.

8. Bennett and Waltz, Counterdeception Principles; Bowyer Bell, “Theory of Deception”; and Whaley, “General Theory of Deception.”

9. Boin and Rhinard, “Managing Crises.”

10. Burgess, “No EU Security,” 318.

11. Buzan, Wæver and Jaap, Security a New Framework, 21.

12. Buzan, Wæver and Jaap, Security a New Framework.

13. Ibid.

14. Buzan talks of, for instance, “societal security” and “environmental security” (Buzan, Wæver and Jaap, Security a New Framework).

15. Burgess, “No EU Security,” 309.

16. Ibid., 310.

17. Burgess, “No EU Security,” 323.

18. Rein, “Value-Critical Policy Analysis.”

19. Bigo, “Internal and External Aspects of Security,” 387.

20. Wagenaar, Meaning in Action, 82–84.

21. While Rein’s value-critical policy analysis speaks of ‘frames’ when describing taken for granted assumptions in policy and the context in which they are produced (Wagenaar, Meaning in Action, 84), Yanow’s concept of ‘local knowledge’ more clearly points to context while ‘frames’ might also denote a cognitive category (Yanow, Conducting Interpretive Policy Analysis, 233).

22. Ibid.

23. Yanow, Conducting Interpretive Policy Analysis, 239.

24. Ibid.

25. Rein and Thacher, “Managing Value-Conflict,” 460.

26. Hansen and Nissenbaum, ”Digital Disaster.”

27. Carrapico and Barrinha, “EU Cyber,” 1255.

28. Bossong and Hegemann, European Civil Security Governance.

29. Yanow, Conducting Interpretive Policy Analysis; and Rein, “Value-Critical Policy Analysis.”

30. Rein, “Value-Critical Policy Analysis.”

31. Burgess, “No EU Security,” 322.

32. Burgess point to the intermingling between different value systems when a multitude of professionals, from previously distinct sectors, are required to address the same security issue (Burgess, “No EU Security”).

33. Ibid., 321–23.

34. EUISS was commissioned by the European Parliament to produce the report ‘EU Strategic Communication with a view to countering propaganda’ (2016) after a request by the AFET Committee.

35. The report has been described as ‘probably the best thing out there’ by EUISS officials (John-Joseph Wilkins, E-mail to author, 3 March 2017).

36. The Fotyga report, written after the reception of the EUISS report, was later adopted by the Committee for Foreign Affairs. As such, it can be taken to reflect the more widely shared views of the EU security/defence community in relation to the information threat.

37. The Working Group consists of government representatives from 36 countries. Apart from member states, Iceland, Norway, Switzerland, Albania, Serbia, Macedonia, Montenegro and Turkey are represented.

38. The declaration was adopted after a meeting between EU education ministers after the terrorist attacks in Paris.

39. The objectives of the group are to: (1) discover, bring to the light, document and extend good practices in the field of media literacy; (2) facilitate networking between stakeholders; (3) explore synergies between different EU policies and media literacy initiatives. Members are: member states, experts nominated by candidate countries and EEA countries, representatives of European associations and foundations active in the field of media literacy, and representatives from international organisations.

40. Yanow, Conducting Interpretive Policy Analysis, 233.

41. It should, again, be stressed that this outline provides a sketch of the main policy community involved in articulating a specific policy. In the wider action plans, and on a higher level of decision-making, the policies are often described together.

42. European Commission, European Agenda on Security, 15 and 4.

43. European Commission, European Agenda on Security, 15.

44. There are two teams: The East StratCom Task Force consisting of 10 full-time communication experts focused on the Eastern Neighbourhood Region and the StratCom South Task Force, dedicated to the Southern Neighbourhood Region. In addition, in 2015, the Commission funded the Syria Strategic Communication Advisory Team (SSCAT) in order to produce counter-narratives in Arabic.

45. EEAS, “Action Plan Strategic Communication,” 1.

46. European Commission, European Agenda on Security, 15.

47. European Commission, “The Paris Declaration.”

48. The Joint Report of the Council and the Commission on the implementation of the strategic framework for ET2020’ (2015).

49. As a result of this meeting, a group dedicated to the enhancement of critical thinking was set up: The Working Group on ‘promoting citizenship and the common values of freedom, tolerance and non-discrimination through education’.

50. Participants come from different public authorities related to culture, education and communication. The UNESCO and the Council of Europe are fixed members. In addition, experts are nominated by member states and the meetings of the Media Literacy Expert Group include stakeholders as well as representatives from the media industry.

51. European Commission, European Agenda on Security, 4.

52. The group is chaired by Professor Madeleine de Cock Buning and has representatives from civil society, social media platforms, news media organisations, journalists and academia.

53. Examples of projects funded include the ‘Index of Censorship’, a non-profit organisation publishing work by censored writers and artists, and ‘Wiki4MediaFreedom’ aimed at ‘boosting the availability of accurate knowledge on media freedom and pluralism on Wikipedia’.

54. European Commission, European Agenda on Security, 13.

55. The Forum connects DG HOME and DG JUST.

56. See note 54 above.

57. EUISS, “EU Strategic Communications,” 4.

58. Ibid.

59. Ibid.

60. Ibid., 30–31.

61. European Commission, “Press Release Fighting Terrorism.”

62. European Commission, “Press Release Curbing Content.”

63. Taylor, “Strategic Communications,” 439–440.

64. Ibid., 440.

65. Ibid.

66. Ibid.

67. European Commission, “Speech Fighting Terrorism Online”; and European Commission, “Press Release Fighting Terrorism.”

68. Taylor, “Strategic Communications.”

69. Ibid.

70. European Commission, “Speech Fighting Terrorism Online.”

71. Cornish, Lindley-French and Yorke, “Chatham House.”

72. Ibid., vii.

73. Fotyga, “Plenary Sitting,” 3. my italics.

74. See note 70 above.

75. EUISS, “EU Strategic Communications,” 30; and European Commission, “Speech Fighting Terrorism Online.”

76. EUISS, “EU Strategic Communications,” 30–31.

77. Ibid., 30.

78. The database is maintained in connection with the EU Internet Referral Unit (EU IRU) – a unit set up by the Commission’s Justice and Home Affairs Council in 2015.

79. European Commission, “Stepping Up Efforts.”

80. European Commission DG-CNTC 2015, “2015 Meeting,” 10 and 7.

81. European Commission DG-EAC, “Key Messages PLA,” 3–4.

82. The speaker comes from the World Association of Newspapers and News Publishers.

83. European Commission DG-CNTC, “2015 Meeting,” 15.

84. Ibid.

85. Boix Alonso is Head of Unit of the ‘Audiovisual and Media Services Policy’ at the European Commission.

86. Boix Alonso, Streamed Meeting Expert Group.

87. Ibid.

88. Ibid.

89. European Commission DG-CNTC, “Summaries of Presentations,” 2.

90. See note 86 above.

91. European Commission DG-EAC, “Key Messages PLA,” 6.

92. European Commission DG-CNTC, “2015 Meeting,” 9.

93. European Commission DG-EAC, “Key Messages PLA,” 3.

94. European Council, “Council Conclusions,” 6.

95. European Commission DG-EAC, “Key Messages PLA,” 9.

96. The bulk of initiatives are linked to national public authorities or civil society organisations on the national level.

97. Burgess, “No EU Security,” 321.

98. European Commission, “Call for Proposals.”

99. Ibid.

100. Cornish, Lindley-French and Yorke, “Chatham House,” 23.

101. Ibid.

102. See note 92 above.

103. Hedling, “Politics and New Media.”

104. Ibid., 156.

105. Ibid., 158–159.

106. See note 86 above.

107. European Commission, “Code of Conduct.”

108. EDRi, EU Internet Forum.

109. European Commission, “Code of Conduct,” 2.

110. Ibid.

111. The Commission has the status of an initiator of ‘of the interference with a fundamental right by private individuals’ while simultaneously not taking any responsibility for the implementation and the result is a ‘state interference by proxy’ (Kuczerawy, “The Code of Conduct”).

112. Bennett and Waltz, Counterdeception Principles; and Clark and Williams, Counterdeception.

113. For instance, while engaging in a critical reading of cybersecurity, the article by Hansen and Nissenbaum focuses primarily on the hard aspects of this form of security (Hansen and Nissenbaum, “Digital Disaster”).

Bibliography