The emergence of cyber security as a national security policy concern in NATO member states

Abstract

As everyday technologies progress at a fast pace, new risks and threats evolve for the users and operators of technology. Today, cybersecurity is a common concern for basically all states –however, this has not always been the case. The concern with cybersecurity has emerged gradually over time, with ever more states becoming concerned. Against this background, this study sets out to study the proliferation of cybersecurity as a policy concern among a more narrowly confined group of states, namely NATO member states. Drawing on the literature on cybersecurity, the study identifies at least four factors that might explain the emergence of cybersecurity as a national policy concern. Whereas some explanations, such as norm diffusion and economic considerations have been already studied, explanations such as policy diffusion and innovations in the field of science and technology have not been widely studied. Therefore, the empirical part of the study analyses which of these factors explains the proliferation of cybersecurity as a policy concern. This research traces different factors for policy concern emergence, by applying document analysis on national cybersecurity strategies and conducting interviews with 14 experts and policymakers involved in cybersecurity policy formulation and implementation, including policymakers involved in developing the first national cybersecurity strategies. By assessing the theories of policy change, norm and policy diffusion, this study lists a set of possible causes for policy concern emergence in the field of cybersecurity. The results of this study indicate that the emergence of cybersecurity across three selected states was mostly driven by policy diffusion among states and innovations in the field of science and technology, firstly – if a state has adopted a policy as a result of emerging policy concern in a region or an international organization, then a policy concern emerges in other states; secondly, if a state sees an increase in developments in the field of science and technology, then cybersecurity as a policy concern emerges. This research demonstrates how different aspects and factors for policy formulation are considered and why some considerations are deemed more critical for national security than others.