Coordinating uncertainty in the political economy of cyber threat intelligence

Abstract

Cyber threat intelligence firms play a powerful role in producing knowledge, uncertainty, and ignorance about threats to organizations and governments globally. Drawing on historical and ethnographic methods, we show how cyber threat intelligence analysts navigate distinctive types of uncertainty as they transform digital traces into marketable products and services. We make two related contributions and arguments. First, building on STS research on uncertainty and ignorance, we articulate two kinds of uncertainty and their potential to interact. Coordinative uncertainty emerges from socially and technologically distributed processes of producing, interpreting, and reporting data that emerges when analysts create standards to make data travel. However, standards can be exploited by intelligent adversaries behaving in deliberately unpredictable ways. We argue that efforts to reduce coordinative uncertainty through standardization can thus ironically increase opportunities for adversarial uncertainty, creating a potential tradeoff. Second, we aim to show how STS can deepen and integrate studies of international security and political economy, by providing an example of how the geopolitical structuring of private industry shapes the science and technology that industry produces. In particular, we argue that the political economy of the cyber threat intelligence industry tends to produce relatively little knowledge about cyber operations that are conducted by governments in the U.S. and its allies, and more about cyber operations conducted by adversaries of U.S. and allied governments. We conclude with a reflection on the broader significance of these findings for the ways that coordinative and adversarial uncertainties refract through the political economies of technoscience.