Problematising the prevailing frameworks of digitalisation and cybersecurity

Digitalisation refers to the ongoing development in which ICTs are increasingly used in virtually all aspects of human life. Their use is gradually turning processes, practices and structures into information-based ones (Brennen & Kreiss, Reference Brennen and Kreiss2014; Kluver, Reference Kluver2000). This development is commonly perceived as a neutral process treating equally everyone who adapts to its conditions. Adaptation requires access and basic skills to use ICTs. Yet digitalisation is neither neutral nor determined by technology, but its appearance and outlook result from human decision making (Crosby, Reference Crosby, Janczewski and Caelli2016; Mordini, Reference Mordini2014; Webster, Reference Webster2014).

In policy papers, digitalisation is approached somewhat deterministically (regarding the human ways of relating to technology, see Carr, Reference Carr, Costigan and Perry2012). ICTs are treated as a force of nature that turns things around for both good and bad. In the development, the old providers of safety and minimum requisites for human life, whose operation was based on physical presence and bureaucratic treatment, are turning into digital facilitators of individual choice operating under strict cost-efficiency pressures (see the Nordic strategies). Economic and political decision making is centralised to globally connected hubs that are able to tap into the flows of information, materials, finance and skilled people (Aaltola, Käpylä, & Vuorisalo, Reference Aaltola, Käpylä and Vuorisalo2014; Castells, Reference Castells2009, Reference Castells2010). National information society programmes and digital agendas facilitate transformation, which ought to increase the chances for global connectedness. Opting out is not an option (Kilpeläinen, Reference Kilpeläinen2016; Statens Offentliga Utredningar, 2015, p. 23). The prevailing understanding of digitalisation thus leaves in isolation areas without the required information infrastructure and/or resources, as well as people without the necessary skills to benefit from the development (Kilpeläinen, Reference Kilpeläinen2016).

When economies and societies become information-based, they are increasingly dependent on functioning critical information infrastructure. This labelling well describes the contemporary role of ICTs: they constitute a structure underlying society and the economy, keeping them running. However, technology is inherently vulnerable (Axelrod, Reference Axelrod2004). ICTs are prone to systemic malfunctions, mistakes or neglect in their use, intentional and unintentional abuses, and outside intrusions. Therefore, in order to keep the flows running along favourable routes, critical information infrastructure needs to be safeguarded (Giacomello, Reference Giacomello and Giacomello2014; Mayer-Schönberger & Hurley, Reference Mayer-Schönberger, Hurley, Nye and Donahue2000; Norden, 2013). The recognised criticality of information infrastructure has led to the adoption of the cybersecurity concept. As there is no unanimous definition for the term, national approaches effectual in the EHN are utilised in this article. In principle, cybersecurity refers to the security of the digital environment, which constantly interacts with operations in the physical environment (Limnéll, Majewski, & Salminen, Reference Limnéll, Majewski, Salminen and Samani2015).

In the Nordic context, cybersecurity has been understood as “the desired end state in which the cyber domain is reliable and in which its functioning is ensured”, as in Finland (FCSS, 2013, p. 1), or as the “[p]rotection of data and systems connected to the Internet”, as in Norway (CSSN, 2012, p. 28). The Swedish information and cybersecurity strategy highlights information, systems used to store and handle information, vital functions to society, and critical infrastructures, as well as the profound values held by the society, as objects to be secured (NCSS, 2016, p. 6). The Nordic countries have two tracks for managing the opportunities and challenges related to digitalisation. On the one hand, digital opportunities and the addressing of digital divides and privacy concerns are situated within the digitalisation framework. On the other hand, the cybersecurity framework concentrates on protecting information and its exchange, critical information infrastructure and national security against cyber threats. One of the goals in redefining cybersecurity is to bring the two tracks together so that (1) the narrow, national security-focused conceptualisation of cybersecurity is broadened to truly address human security dimensions, and (2) the dependence of successful digitalisation on effective, redefined cybersecurity is fully acknowledged.

Human security: placing threats arising from the use of ICTs

The concept of human security has reshaped security discourse significantly since its occurrence in the 1994 United Nations Development Programme's Human Development Report (UNDP, 1994). As a result, the state-centric and sovereignty-oriented approach is no longer the sole viable international security framework. Human security professes security as having both preventive and pro-active tools and introduces a multilevel security structure, which incorporates actors inside and outside the state. This broadened and deepened conceptualisation presents a reformed agenda, which includes various other-than-military forms of instability resulting from, for example, environmental degradation or societal volatility (Davi, Reference Davi2009). It offers an insightful understanding of what constitutes a threat to whom, even beyond the interstate level (Booth, Reference Booth and Booth2005; Sheehan, Reference Sheehan2005).

Human security aims at ensuring freedom from fear and from want, with a view to assuring freedom from indignity for individuals and communities. Fulfilling the basic human needs for survival stands at its heart (UNDP, 1994). This prerequisite goes hand in hand with the established normativity of human rights framework: the fulfilment of basic human needs is guaranteed by the means of enjoyment of universal human rights (Kaldor, Martin, & Selchow, Reference Kaldor, Martin and Selchow2007). As a policy tool, human security, while reflecting human rights norms, offers an emancipatory and empowering framework to address urgent issues in specific situations (McCormack, Reference McCormack2008). It is a paradigm that centres on the human being and recognises that threats may arise from a number of sources (Buzan & Hansen, Reference Buzan and Hansen2009; Davi, Reference Davi2009.) Its underlying point suggests that protected people can exercise choice and, once empowered, they are capable of both avoiding risks and improving the system of protection (Commission on Human Security, 2003). In addition, it acknowledges that certain threats affect people and communities regardless of whether debates over them can be labelled as existential.

While the broad conceptualisation of human security makes the identification of elements falling within and remaining outside of its scope problematic (Paris, Reference Paris2001, p. 90), the actual goals of the concept are clearly recognised: addressing human vulnerability following from the events that take place around us and developing appropriate response mechanisms based on urgency. Applying human security to digitalisation in the EHN requires a further discussion integrating human rights and securitisation.

Cybersecurity is a means to protect human rights offline. In the information society, the realisation of human rights depends on functioning critical infrastructures controlled through and/or running on information infrastructure (e.g. Figuères & Eugelink, Reference Figuères, Eugelink, Kaur and Tao2014). Mis- or dysfunctioning infrastructures constitute a threat primarily because of the second- or third-order consequences felt by individuals and communities in everyday life, which are caused by disruption or halting of functions such as electric supply, money transfer or logistics (e.g. Finnemore & Hollis, Reference Finnemore and Hollis2016). Lacking cybersecurity, and similarly lacking access to the digital environment, can be perceived as a threat to the realisation of human rights (Skepys, Reference Skepys2012).

However, cybersecurity understood merely as the protection of information and infrastructure risks neglecting the protection of human rights online; especially when preparations for an emergency are carried out or when such a situation (actual or imagined) arises. The Nordic cybersecurity strategies acknowledge and commit to the protection of digital rights such as freedom of opinion, expression and assembly, and the right to privacy, while also emphasising the overarching values of democracy, good governance and equality. Yet the intensifying pressure for improving intelligence collection and analysis in the face of increasingly complex security threats cannot be ignored. In addition, commercial information collection, for example, about people's interests, browsing habits, and social media behaviour is global. This information is not only valuable to website administrators and digital service providers but can also be sold, for example, to marketing companies or to anyone willing to pay for it (e.g. Marichal, Reference Marichal2012.) The related digital rights concern is that people are not always aware of and/or cannot control what information is collected and to whom it is distributed.

The relationship between human rights and digitalisation is not straightforward. On the one hand, human rights can be used as a political, legal and rhetorical tool against actors who advocate censorship or blocking of online content, criminalise legitimate content, use cyber-attacks on political opponents or economic rivalries, or neglect the protection of privacy and data in general (e.g. UNHRC, 2011). On the other hand, the United Nations (2011) and some countries, including Finland (2008), have declared free (from technical, political, linguistic or economic constraints, and surveillance) internet access to be a human right.

Unlike the human security framework, which does not explain how an issue becomes a security concern, securitisation theory suggests a process-oriented approach to understanding security. Security is claimed as a social construct by virtue of a speech act. In the process, an issue that gains enough attention from its audience becomes a security threat going beyond the normal political process. Thus, the potential use of extraordinary measures becomes reality. Consequently, emergency measures are taken to return the issue to the political process so that the threat is stabilised (Buzan, Wæver, & de Wilde, Reference Buzan, Wæver and de Wilde1998; Buzan & Waever, Reference Buzan and Wæver2003). The prevailing cybersecurity framework, on the one hand, establishes actors from individuals, corporations and other organisations to states and multinational groupings as security threats (e.g. Limnéll et al., Reference Limnéll, Majewski, Salminen and Samani2015; Singer & Friedman, Reference Singer and Friedman2014). On the other hand, technical operations such as malware, phishing, ransomware, cracking or code injection can be defined as threats (e.g. ENISA Threat landscape reports). The choice of discourse utilised depends on the audience.

Threats identified within the human security framework do not follow the afore-described securitisation logic. The point at which a threat matures is unknown and undefined, resulting in confusion and perplexities in the relationship between human security and human rights (Davi, Reference Davi2009). While such confusion may undermine human rights norms because of the employment of the under-conceptualised notion of human security framework (Davi, Reference Davi2009), we consider that the analytical approach of human security is significant in identifying the particularities embodied in the normative structure of human rights framework. Hence, the human security concept plays an important role in analysing patterns of political violence, major human rights violations, and the structural sources of insecurity and vulnerability. While the human security approach is argued to be relatively less persuasive than securitisation theory, which comprehends a “whole spectrum of security relations across the interplay of actors, sectors and levels” (Davi, Reference Davi2009), we are convinced that threats also arise from everyday situations and nebulous sources (Burgess & Sissel, Reference Burgess and Sissel2008). Therefore, by combining these approaches in the examination of digitalisation in the EHN, it is possible to strive towards a redefinition of cybersecurity that takes regional particularities into consideration, and takes the aim of empowering people and communities seriously.

When the existing digitalisation and cybersecurity frameworks concentrate on economic opportunities and efficiencies, as well as threats to national security, they miss the by-product processes of digitalisation, which generate fear and concerns amongst people and communities in the EHN. For instance, digitalisation is promised to guarantee the realisation of everyone's right to equal access to public services but it cannot reach that goal as long as there are gaps in information infrastructure and people's digital know-how. Without the realisation of everyone's right to a set standard of living, employment or social security, participation in the information society becomes difficult. An ability to pay for the required equipment and digital connection or an ability to travel to places where public internet access is provided is currently a condition of digital participation. Moreover, digitalisation does not treat all cultural groups similarly, for which reason its impacts on inclusion and exclusion should be examined. In the EHN, this concern relates most visibly to the different Sámi groups and linguistic minorities living throughout the region.

A widened and deepened cybersecurity framework focusing on the human being can better address the underlying challenges faced by digitalising societies. Instead of only pointing out the human being as the weakest link of cybersecurity, it concentrates on facilitating human development, advancing the interests and mitigating the fears that people encounter in everyday life. It treats individuals and communities as active security producers instead of perceiving them merely as passive receivers of security. It also highlights the importance of providing ways for people to have a say in digitalisation and protect themselves in the digital environment. Eventually, the development will feed into the state-centric and sovereignty-oriented security approach in the form of improved national and economic cybersecurity.

Characteristics of digitalisation and cybersecurity in the European High North

The EHN has a complex system of socio-cultural, political, economic and environmental dynamics linking actors from inside and outside the region, with both local and global implications. For instance, as a sparsely populated region with pristine environmental characteristics, which is simultaneously rich in natural resources, it attracts human activities such as oil and gas development in marine areas or inland mining and mineral activities. These activities are detrimental to the environment and also invite negative digital attention in the form of attempted network and system intrusions or information thefts and possibly subsequent blackmailing for both economic and ideological reasons. Digital solutions may serve as a partial solution to environmental problems, but they may also feed into such problems, for example, due to the production processes of ICTs, increased local energy consumption or pollution caused by misfunctioning of automated industrial processes. A sustainable solution achieving a proper balance between detrimental human activities and digital potentials can mitigate problems related to climate change and other environmental threats.

In addition, the EHN inhibits unique groups, such as the Sámi indigenous communities, with particular needs for sustaining a distinct identity. It is important to examine how digitalisation adapts or does not adapt to the prevailing conditions in these communities. Subsequently, it is necessary to search for the means to address local fears, needs and interests in the most suitable and considerate way: how can digital development improve human security when adapted to local conditions? Globalisation and the emergence of new economic opportunities have resulted in significant potentials for the region. These potentials will be addressed in more detail in the following paragraphs. Yet the EHN has a limited and fragmented information infrastructure, and people's skills and confidence to act in the digital environment vary, which makes economic development challenging and always costly (Norrbotten, 2013); personal communication with representatives of the Regional Council of Lapland, Lapland Hospital District, and the Centre of Excellence on Social Welfare in Northern Finland at the Arctic Centre, University of Lapland, 15 August 2016). Digitalisation thus affects human interests, needs and fears from a number of perspectives, making human security an applicable analytical tool to explore the digital development.

Commonly acknowledged opportunities and challenges residing in digitalisation become intensified in the EHN due to the region's characteristics. Positive digital development comes in the form of, for instance, increased efficiencies in production, administration and service provision; novel and transformed operating models, livelihoods, and potentials for lessening human error; platforms for self-expression and cultural identity formation; increased transparency, as well as information collection, storage and exchange; and improved access to knowledge (see the Nordic strategies; also Sartor, Reference Sartor, de Azevedo Cunha, de Andrade, Lixinski and Feteira2013). A cold, yet warming, climate; vast distances; a sparse population, which is gradually concentrating in urban centres; a diminishing and ageing population; an economy divided between traditional livelihoods, small-scale production, the tourism and experience industry, resource extraction, high- and cold-tech industries, as well as a relatively large public sector; and the coexistence of different cultural identities generate twists and context-bound particularities in the presumably neutral processes of digitalisation (Larsen & Fondahl, Reference Larsen and Fondahl2014). Therefore, the region often serves as a test bed for innovations and solutions that are later adopted in wider use (Lapin liitto, 2013; Norrbotten, 2013). An example of such testing activity is the AURORA project in the Kolari-Muonio area of Finland. The aim of the smart road experiment is to increase traffic safety in the difficult conditions of the Arctic winter through increased utilisation of sensors, automation and information sharing (Finnish Transport Agency, 2016).

Threats to critical infrastructures and functions vital to society, which are well covered in national strategies (cyber activism, espionage, terrorism, crime and warfare), endanger human security in the information society. Yet they are not the only threats.

These reservations apply to the digitalising of the European High North as well.

Ubiquitous digitalisation has the potential to address existing human inequalities. For example, in the EHN education and training can be provided digitally to a greater number of pupils and students regardless of their physical location. Digital public services remove the restriction of having to visit an authority within office hours. Dealings with health professionals, social services or tax authorities, for example, can be carried out online. This reduces the need to travel and, thus, the environmental burden and travel costs. The option of distance work amidst natural beauty is expected to lure more people into the region (see regional strategies). However, the mere existence of interconnected networks and online services does not automatically diminish inequalities (Figuères & Eugelink, Reference Figuères, Eugelink, Kaur and Tao2014). On the contrary, it can also enhance them. Decision making supporting positive development and active policies to bridge digital divides are thus required. Those best able to describe the divides, and how to address them, are the ones experiencing them. Well-meaning attempts may turn into a waste of time and money if people do not feel comfortable with the options provided (Kilpeläinen, Reference Kilpeläinen2016). In order to improve the existing situation, a widened digital ownership is required.

Little systematic research on digital divides between or within the Nordic countries is available (for existing research see Kilpeläinen, Reference Kilpeläinen2016; Räsänen, Reference Räsänen2008; Taipale, Reference Taipale2012). In general, they are considered to be highly developed information societies. For example, on the European Union Digital Scoreboard their standings are above the EU average. Fixed broadband connection is available to almost everyone (99% of homes in Sweden, 97% in Finland and 95% in Norway) and 4G access is making its way through (available to 76% of homes in Sweden, 75% in Finland and 80% in Norway). In Sweden, 89% of the population uses the internet frequently and 72% has basic digital skills. In Finland the figures are 91% and 75%, respectively, and in Norway 96% and 80%. E-government services are utilised by 49% of the population in Sweden, by 63% in Finland and by 59% in Norway. Whereas the connection price in Finland is the second lowest in the entire EU, the connection price in Norway is above the EU average (EU Digital Scoreboard, Progress by Country reports as in 2016).

However, aggregated figures tell little about the regional, socio-cultural, economic or other digital divides within these countries. The existence of digital divides is acknowledged in the Nordic countries. Usually, they become addressed through special policies and by setting legal obligations, for example, to service providers (see, for example, the national and regional broadband programmes in the Nordic countries and the accessibility programme and reports of the Finnish Ministry of Transport and Communications 2005–2015). Providing connections to and reaching disconnected people has proven financially and attitudinally difficult (Norrbotten, 2013). This constitutes a considerable threat to human security in information societies where digital services are the main form of communication between public authorities, businesses and organisations, and the residents (Kommunenes Sentralforbund, Reference Dunn Cavelty2013; Ministry of Transport and Communication, 2011).

The aforementioned issues have not usually been addressed in the language of security but of development, equality, quality of life, and self-cultivation/expression. They have been perceived as being less urgent than digital espionage, potentialities of cyberwar or cyber terrorism. However, they pose threats to human security, as people may be afraid of engaging in the digital environment because of a lack of skills, may not have access to it, or may not have the know-how to critically evaluate available information and are thus vulnerable to being misled. As being able and feeling confident to act in the digital environment is an everyday security consideration in the information society, these issues should be located on the agenda to which they belong.

Of the threats recognised in the cybersecurity framework, cybercrime – and digital abuse, which often borders cybercrime depending on national legislation – is what individuals are most commonly aware of. The term refers to illegal activities that are either dependent on or enabled by the use of ICTs. The former include technical operations, such as malware for financial gain and theft of personal or organisational information, which would not be possible without computers and networks. The latter comprises activities that can be carried out both online and offline, but the scale or nature of which has changed due to the use of ICTs, for instance, fraud and illegal drug trade (Limnéll et al., Reference Limnéll, Majewski, Salminen and Samani2015; National Crime Agency, 2016).

The effects of cybercrime can be felt directly in everyday life and can restrict people's willingness to act online. Over the years, cybercrime has become more common, sophisticated, professional and organised. Nonetheless, people still fall victim to simple online scams or hand over their personal details surprisingly easily. Those lacking awareness are particularly easy targets, whose deception does not require advanced technical skills. For example, only 35% of consumers in the Nordic countries believe that they have a full awareness and understanding of the consequences of data breaches; 52% believe they have a partial understanding and 12% declare they have little or no understanding (FireEye, 2016).

In principle, what constitutes a crime in the offline environment is also a crime in the online environment. Thus, novel legislation has been developed only for borderline cases, and existing legislation and law enforcement have been applied as a rule. However, cybercrime retains its attractiveness because of the perceived low risks of detection and prosecution (Clough, Reference Clough2010). There are no studies focusing on cybercrime in the EHN, but some reports on the Nordic countries exist. According to FireEye (2015), regional traits such as natural resources, innovations in healthcare and renewable energy, a high level of connectedness and high-tech industry, a strong shipping industry, as well as transparent governance make them targets of hostile cyber activities. Similarly to national strategies and policies, these reports address threats merely at the national and organisational levels, ignoring fears experienced by people and communities. Less attention is given to digital piracy, fraud, scams, illegal, harmful and offensive online content, and, in general, the victimisation of individuals and ethnic or cultural groups (cf. Yar, Reference Yar2006). Yet these phenomena are important for inclusive digital development.

Digital abuse involves the use of ICTs to bully, intimidate, harass or stalk another person. It often takes the form of verbal abuse, social manipulation or disclosing of sensitive content publicly online. People engaging in digital abuse do not generally acknowledge breaking any laws or moral codes but utilise the means they are familiar with, such as social media and instant messaging. Yet it should be recognised that, for example, hate speech or stalking are always criminal offences (Clough, Reference Clough2010; Yar, Reference Yar2006). In the EHN, hate speech (delivering a message of racial inferiority, directed against a historically oppressed group and of hateful or degrading nature (Yar, Reference Yar2006)) against an ethnic and/or cultural group may be considered to be a high-likelihood phenomenon, even if systematic studies have not yet been carried out.

Refocusing cybersecurity and bringing people and communities to the forefront so that cyber threats to critical information infrastructure and cybercrime are realigned with the questions of digital divides and digital abuse facilitates the establishment of a truly comprehensive cybersecurity agenda. On such an agenda, for instance, security and privacy no longer need to be perceived as opposing one another such that a balancing act is required (cf. Taddeo, Reference Taddeo2013; Yar, Reference Yar2006), but as mutually reinforcing and complementary aspects of cybersecurity (e.g. NCSS, 2016). This shift enables and enhances the attainment of human security and the protection of human rights in digitalising societies. How to define cybersecurity; what to include in the cybersecurity agenda; as well as what kind of processes, practices and structures to build for security production are human decisions taken today. However, they also define the outlook of digitalised EHN for a long period of time.