[
Submitted in writing at this meeting. An informal 5 min. version was presented during the public comment period. This statement is my own and does not represent the views or interests of my employer.]
Summary
Cyber security desperately needs institutional innovation, especially involving incentives and metrics. Nearly every report since 2003 has included recommendations to do more R&D on incentives and metrics, but progress has been slow and inadequate.
Why?
Because we have the wrong model for research and development (R&D) on institutions.
My primary recommendation is that the Commission’s report should promote new R&D models for institutional innovation. We can learn from examples in other fields, including sustainability, public health, financial services, and energy.
What are Institutions and Institutional Innovation?
Institutions are norms, rules, and social structures that enable society to function. Examples include marriage, consumer credit reporting and scoring, and emissions credit markets.
Cyber security[1] has institutions today, but many are inadequate, dysfunctional, or missing. Examples:
- overlapping “checklists + audits”;
- professional certifications;
- post-breach protection for consumers (e.g. credit monitoring);
- lists of “best practices” that have never been tested or validated as “best” and therefore are no better than folklore.
There is plenty of talk about “standards”, “information sharing”, “public-private partnerships”, and “trusted third parties”, but these remain mostly talking points and not realities.
Institutional innovation is a set of processes that either change existing institutions in fundamental ways or create new institutions. Sometimes this happens with concerted effort by “institutional entrepreneurs”, and other times it happens through indirect and emergent mechanisms, including chance and “happy accidents”.
Institutional innovation takes a long time – typically ten to fifty years.
Institutional innovation works different from technological innovation, which we do well. In contrast, we have poor understanding of institutional innovation, especially on how to accelerate it or achieve specific goals.
Finally, institutions and institutional innovation should not be confused with “policy”. Changes to government policy may be an element of institutional innovation, but they do not encompass the main elements – people, processes, technology, organizations, and culture.
The Need: New Models of Innovation
Through my studies, I have come to believe that institutional innovation is much more complicated [2] than technological innovation. It is almost
never a linear process from theory to practice with clearly defined stages.
There is no single best model for institutional innovation. There needs to be creativity in “who leads”, “who follows”, and “when”. The normal roles of government, academics, industry, and civil society organizations may be reversed or otherwise radically redrawn.
Techniques are different, too. It can be orchestrated as a “messy” design process [3]. Fruitful institutional innovation in cyber security might involve some of these:
- “Skunk Works”
- Rapid prototyping and pilot tests
- Proof of Concept demonstrations
- Bricolage[4] and exaptation[5]
- Simulations or table-top exercises
- Multi-stakeholder engagement processes
- Competitions and contests
- Crowd-sourced innovation (e.g. “hackathons” and open source software development)
What all of these have in common is that they produce something that can be tested and can support learning. They are more than talking and consensus meetings.
There are several academic fields that can contribute defining and analyzing new innovation models, including Institutional Sociology, Institutional Economics, Sociology of Innovation, Design Thinking, and the Science of Science Policy.
Role Models
To identify and test alternative innovation models, we can learn from institutional innovation successes and failures in other fields, including:
- Common resource management (sustainability)
- Epidemiology data collection and analysis (public health)
- Crash and disaster investigation and reporting (safety)
- Micro-lending and peer-to-peer lending (financial services)
- Emissions credit markets and carbon offsets (energy)
- Open software development (technology)
- Disaster recovery and response[6] (homeland security)
In fact, there would be great benefit if there were a joint R&D initiative for institutional innovation that could apply to these other fields as well as cyber security. Furthermore, there would be benefit making this an international effort, not just limited to the United States.
Endnotes
[1] "Cyber security" includes information security, digital privacy, digital identity, digital information property, digital civil rights, and digital homeland & national defense.
[2] For case studies and theory, see: Padgett, J. F., & Powell, W. W. (2012). The Emergence of Organizations and Markets. Princeton, NJ: Princeton University Press.
[3] Ostrom, E. (2009). Understanding Institutional Diversity. Princeton, NJ: Princeton University Press.
[4] “something constructed or created from a diverse range of available things.”
[5] “a trait that has been co-opted for a use other than the one for which natural selection has built it.”
[6] See: Auerswald, P. E., Branscomb, L. M., Porte, T. M. L., & Michel-Kerjan, E. O. (2006). Seeds of Disaster, Roots of Response: How Private Action Can Reduce Public Vulnerability. Cambridge University Press.
