Assembling cybersecurity: The politics and materiality of technical malware reports and the case of Stuxnet

Abstract

This is an article about how cybersecurity gets "made," with a focus on the role of commercial computer security firms in generating knowledge in matters of international cybersecurity. The argument is two-fold. Firstly, malware may be an intangible artefact in some ways, but its success and its interpretation as malware is deeply interwoven in social, technical, and material alliances. Secondly, a materialist-minded examination of Symantec's Stuxnet reports will demonstrate the politically situated nature of how cybersecurity expertise emerges. The article finds that Symantec's work was not a-political or neutrally-technical: Their experts made profoundly political choices in their analyses. By showing the processes that go into making cybersecurity, the article contributes to a widening and deepening of debates about what is at stake in cybersecurity knowledge and practices.

Post-Quantum Cryptographic Assemblages and the Governance of the Quantum Threat

“…We rely on Deleuze and Guattari [10], and DeLanda's [9] foundational concepts and follow Collier [8], Stevens [30], Egloff and Cavelty [16], and Liebetrau and Christensen's [24] approaches to cybersecurity assemblages as a conceptual framework to understand this problem. We apply Li [27] and Puar's [33] understanding of assemblages to see how the quantum threat as a concept is understood and specifically how post-quantum algorithms are used to mandate solutions to security problems, and how these solutions are enforced in policy.…”

“…The definition of associated challenges within cybersecurity assemblages helps to define how cybersecurity is 'made' and understood. For Stevens [30], cybersecurity includes the technologies, processes, practises, and relationships dealing with any aspect of security in cyberspace. It is an ecosystem of these components that is continuously co-produced by various actors, policies, and frameworks.…”

“…Collier [8], Stevens [30], Egloff and Cavelty [16], and Liebetrau and Christensen [24] use assemblages to address the complexities and linkages within the environments, realities, and political contestations of cybersecurity. Our use of assemblages aims to explore the arrangements of technologies, the perceptions, discourses, and actors, including experts and knowledge creators.…”

Contested public attributions of cyber incidents and the role of academia

“…First, the security companies, which are one of the main sources of how we learn about cyber conflict, have limited visibility, mostly defined by the technologies employed and the markets they serve. Furthermore, they have a specific prism of what kinds of threats they investigate further (on the political choices made by security companies, see Stevens, 2020). That prism results in highly detailed knowledge about a subset of actors engaging in offensive measures.…”

Redefining deterrence in cyberspace: Private sector contribution to national strategies of cyber deterrence

“…Nevertheless, the role of non-state actors remains very peripheral in these authors' analyses of cyber-deterrence; their primary focus is firmly centered on the role of state actors (Burton, 2018;Nye, 2017;Rosenzweig, 2010;Wilner, 2020). Similarly, others have conducted research exploring the role of private sector non-state actors in attributing cyber incidents (Romanosky & Boudreaux, 2019;Stevens, 2020). Others still have explored the private sector's active cyber defense through the lenses of the just war theory (Thumfart, 2020).…”