Strategies of Cyber Crisis Management: Lessons from the Approaches of Estonia and the United Kingdom

Abstract

This paper compares the cyber crisis management strategies of Estonia and the United Kingdom-two leading nations in the field of cyber security. The two countries' strategies differ significantly. The most important variables influencing these differences are history, size (both demographic and material resources), political philosophy, digital dependence, and the nature of the threats and adversaries each country faces in the cyber domain. Given the importance of these factors in determining Estonia's and the United Kingdom's cyber crisis strategies, it is difficult to draw from these two cases any generalisable recommendations that apply to other states; rather, the main significance of this study is another: it draws attention to the important role that political, historical, and cultural variables play in the definition of a nation's cyber crisis strategy-and, consequently, the need to fit specific policy approaches within the bounds set by these factors. The paper seeks to demonstrate that while cyberattacks may be highly technical in nature, organisational responses to them have crucial political and social determinants that may supersede the significance of technical factors.

Cyber Security Assemblages: A Framework for Understanding the Dynamic and Contested Nature of Security Provision

“…As a collective, these corporations cannot neatly be categorised as 'private' given the variety of entities including the presence of both partially and fully state-owned entities. Corporations provide cyber security alongside a range of government departments, including GCHQ and its subsidiary, the National Cyber Security Centre (NCSC); the Cabinet Office, the various government departments that are largely responsible for infrastructure related to their department and related institutions such as the Centre for the Protection of National Infrastructure (Collier, 2016). All of these government entities have their own identities, agendas and motivations-a reality that means that 'the government' is not necessarily a coherent entity at all.…”

A Survey on National Cyber Emergency Plans

“…Different approaches are also found regarding the willingness of the examined states to cooperate or even request support from other states and international organizations when dealing with significant cyber incidents. For example, the UK is cautious about the possibility of cooperating with another country against a known cyberthreat, even if it is ascertained that the source of the cyber-attack is in this country (Collier, 2017). Although the UK is actively involved in international efforts to tackle cybercrime, it appears to distrust other countries to the extent of allowing them to participate in addressing a national crisis on its soil, especially after Brexit.…”

Conceptualizing cyber crises

“…During more recent years, an increasing body of literature has been focusing on the phenomenon from crisis management and governance perspectives. For example, authors have shed light on how different models of public-private partnerships shape national cyber crisis management structures (Boeke, 2018), the evolution of the European Union's governance approaches towards the transboundary threats and risks connected to cyber space tems without leaving out privacy during crisis management (Hiller & Russell, 2017) and the role historical, cultural and political variables play in the definition of national cyber crisis strategies (Collier, 2017). This article, however, aims to shed light on a so-far overlooked perspective on cyber crises.…”