Abstract

     Dedicated cyber-security functions are common in commercial businesses, who are confronted by evolving and pervasive threats of data breaches and other perilous security events. Such businesses are enmeshed with the wider societies in which they operate. Using data gathered from in-depth, semi-structured interviews with 15 Chief Information Security Officers, as well as six senior organisational leaders, we show that the work of political philosopher Thomas Hobbes, particularly Leviathan, offers a useful lens through which to understand the context of these functions and of cyber security in Western society. Our findings indicate that cyber security within these businesses demonstrates a number of Hobbesian features that are further implicated in, and provide significant benefits to, the wider Leviathan-esque state. These include the normalisation of intrusive controls, such as surveillance, and the stimulation of consumption. We conclude by suggesting implications for cyber-security practitioners, in particular, the reflexivity that these perspectives offer, as well as for businesses and other researchers.

Introduction

     Cyber-security practice is increasingly recognised as more than a technological exercise. The application of sociological and political viewpoints to such practice, particularly in organisations, is becoming more and more common, e.g., Burdon and Coles-Kemp (2019); Stevens (2016). In this paper, we build on these foundations by applying a number of lenses based on the work of Thomas Hobbes to a study of 15 Chief Information Security Officers (CISOs) and six senior organisational stakeholders representing 18 UK-based, but predominantly multinational, businesses. This work contributes to and extends cyber security scholarship by considering cyber security within business as a component of wider societal power structures. First, this research indicates that cyber security functions within businesses serve the interests of the state Leviathan. This positions those functions as indirect and possibly unwitting agents of the state, and cyber security itself as beneficial to the state and associated hegemonies. Second, it shows that cyber security functions within businesses operate as a Hobbesian form of control within the micro-societies of businesses, who are themselves mini-Leviathans. Third, it provides a novel sociological lens with which to explore cyber security within businesses and wider societies. We consider the key contribution of this research as being to provide a novel viewpoint on cyber-security practice that enables greater reflexivity and reflection for practitioners, as well as offering a pathway for future research.

Conclusion

     This paper has shown that Hobbes’ work provides a useful lens through which to view the role that cyber security plays in society within and without businesses, particularly given the importance of Hobbesian thinking to Western political thought and the enmeshed nature of states and corporations. Cyber security offers a useful mechanism from which the Leviathan derives benefit. It supports the establishment of fear and discipline, therefore, cementing power through obedience and conformance. Additionally, although less obviously, it also drives accumulation of capital through consumption of products and services, and job creation.

     Businesses play a crucial role for the Leviathan. They employ and educate citizens, inuring them to surveillance and punishing them when they transgress. They maintain narratives of morality. They generate and expand capital. In some cases, they operate critical infrastructure and perform other state functions on the Leviathan’s behalf. Businesses are themselves mini-Leviathans, and are in fear of threats to their existence. Cyber security functions within those businesses provide a means by which they seek to avoid a state of nature. They also, indirectly, provide that function to the state, supporting its attempts to dominate competing state Leviathans. Actions taken by businesses in relation to cyber security involve spending that provides fuel for the continued growth of the Leviathan’s power, and that of the hegemony that the Leviathan supports.