Scaling Trust: An Anthropology of Cyber Security

With growing dependency on digital infrastructure, vulnerability to cyber disaster becomes a defining context for social life. Within the last two years Wannacry led to the cancellation of thousands of NHS appointments, NotPetya brought Maersk's global shipping operations to a halt, the Equifax hack compromised the details of 140 million people, and TSB's outage left thousands of customers defrauded. Behind these failures-to patch systems, to secure networks, to implement good governance-is a problem of scales: the smallest "weak link" can end up compromising the security of the whole system. Yet because complete security is unattainable in practice, living well with infrastructures has become a question of trust.

It is the premise of this fellowship that trust is not a "user's problem". Behind the services and utilities that we rely on in daily life, we can find an array of professional cyber security practices aiming to win and maintain trust, to question it and manage it across scales. How they go about doing that, their successes and failures, is the subject of this study.

The ambitious anthropological study of cyber security at the heart of this fellowship will be undertaken in collaboration with the UK's National Cyber Security Centre (NCSC). A broad programme of ethnographic research will focus on long term participant observation of governance processes and knowledge practices within Critical National Infrastructure (CNI) organisations. Three trajectories of investigation comprise the core of the fellowship:

In years 1-2, with an ethnographic study of the implementation of the Network and Information Systems directive in 2 CNI locations, it asks: how does cyber security policy "scale" best practice into diverse real-world contexts?
In years 3-4, with an ethnographic analysis of how trust is built through the "rituals" of corporate governance in 3 CNI locations, it asks: how do IT practitioners "scale up" local forms of trust to create "high level" holistic representations with which approval can be given, and responsibility taken?
In years 5-7, together with a postdoc, the fellow will conduct an examination of the impact of new technologies of automation and AI on cyber security practice, it asks: how do new technologies reconfigure trust?

Traditionally led by engineers, cyber security has a legacy of treating people or users simplistically: as problems, or attack vectors. Interdisciplinary approaches have had steady success over recent years in developing more nuances approaches. This fellowship advances the state of the art in interdisciplinary cyber security research with an anthropological style of empirically grounded critical conceptual analysis of professional practices involved in making and managing trust across scales. In doing so it will also make important contributions to several fields of research in the social sciences: the anthropology of governance and accountability, the sociology of trust, and interdisciplinary studies of the digital infrastructures that underlie contemporary social societies.

A comprehensive impact programme will ensure that the study stays aligned with policymakers' priorities, and contributes to cyber security policy and practice across industry and government. Academic audiences will be reached through presentation at leading conferences and an ambitious publication strategy targeting high impact journals, and an academic monograph, aiming to be a definitive anthropological account of cyber security.

The fellow's professional background managing digital and IT projects are indispensable to this research, as is his research experience in the ethnography of computational science. An extensive training and discipline hopping programme will make the fellow a research leader, standing between academic fields, industry, and policy, poised to produce the engaged interdisciplinary research needed to tackle the Grand Challenges of the UK's Industrial Strateg

1. PUBLIC SECTOR BENEFICIARIES
Several public agencies (for example Cabinet Office, the FCO, BEIS, security services and DCMS) have responsibilities for cyber security, and stand to benefit from this research.
- Enhanced understanding of the relations between trust and security generated by this project may lead to improvement in both content and style of cyber security policy and legislation, leading in the long term to enhanced security for the UK, with the social and economic benefits it brings.
- An empirically rich ethnographic account of governance processes is likely to produce new insights about how policymakers can make effective interventions, and how they formulate the problems of cyber security.
- An account of new developments in technology and delivery models for IT systems, and the differences these make to practices of managing and scaling trust, may help policymakers respond effectively to emerging challenges in cyber security as well as reconfigurations of old challenges.
- Policymakers in the UK are the most direct beneficiaries, but international policy stakeholders may also benefit through academic communication and participation in government and industry events and workshops.

2. INDUSTRY BENEFICIARIES
Organisations hosting ethnographic fieldwork stand to benefit through the frequent opportunities for knowledge exchange that this research method creates. This includes:
- For senior management, recommendations emerging from the research regarding effective cyber security practices, may drive improvements in governance processes
- For board members, insights into the management of trust may help facilitate more effective high-level oversight of risks
- For cyber security practitioners, collaboration with an ethnographer is an opportunity to catalyse new modes of reflection leading to improvements in processes and practices. Participative methods developed in this fellowship will further promote these opportunities, running 10 workshops, using a set of ethnographic vignettes selected for their ability to provoke discussion and critical thinking about the nature of trust in cyber security.
- Such improvements in cyber security practices lead to lower exposure to risks and better economic performance and corporate responsibility. While these benefits are directly anticipated for host organisations, through contributions to professional forums and through policy impacts, the indirect benefits extend to the wider sector of public and private organisations.

3. ACADEMIC BENEFICIARIES
- Content-based benefits: This fellowship will make strong contributions to the interdisciplinary understanding of trust, security, scale, governance and infrastructure. Please see the Case for Support section 4.2 for detail.
- Methodological benefits: This fellowship aims to go beyond the established tradition of ethnographic observation by developing a new mode of participation in the study of technology. This is done in this project by two moves: 1) through the development of the fellow as an interdisciplinary cyber security researcher rather than as an "outsider" social scientist; 2) through the development of participative methods that engage the community of practitioners, otherwise the subjects of research, in reflection on their professional activities and their relation to trust.
- Interdisciplinary benefits: This fellowship contributes to the vibrant interdisciplinary research culture at Warwick and beyond.
- Through dissemination of findings, collaboration, and workshop events, the fellowship will provide a significant boost to the growing international community of researchers at the interface between STS and cyber security.
In all these respects, the research activities under this fellowship will comprise a strong demonstration of the value of interdisciplinary methodologies to the "hard" problems of today, thus advancing the engagement of the social sciences to contemporary society.