Outside the social making of interoperability: Problematizing the absence of civil society in border security R&D programmes

Abstract

Big data-based governance requires both compatible modes of computing data and interoperable databases. While interoperability is often portrayed as a logical imperative, we understand it as socially co-produced within a political choice for algorithmic governance. We use the case of the European Union's border management regime to show how its reconfiguration towards increasing reliance on data governance carries political and societal consequences, specifically the side-lining of civil society. In concrete, we focus on EU-funded Research and Development (R&D) for security, which has seen an increase in projects addressing the realization of interoperability. Based on an original dataset of Civil Society Organization's (CSO) participation in EU security research and a mixed-methods approach combining digital methods, ethnographic methods, and semi-structured interviews, we find that civil society has largely remained side-lined in making interoperability – not as mere unintended consequence, but by design. Additionally, and in line with our socio-technical approach to the topic, our findings show how interoperability is a polysemic concept that different actors understand in very different ways, opening up for negotiation and political contestation. Although CSOs at times participate in interoperability R&D projects, the political objectives of R&D in terms of achieving interoperability are defined in other spatial and temporal settings outside of the ‘laboratory’ of the project. At a more general level, our findings contribute to uncover the modes in which the public relates with big data governance in the field of security.

This article is a part of special theme on Algorithmic Reparation. To see a full list of all articles in this special theme, please click here: https://journals.sagepub.com/page/bds/techno-politicsofinteroperability

Introduction

Interoperability has emerged as a central concept in the wider area of security in the European Union (EU). The concept broadly signifies the possibility of making different technological devices work together and communicate. Within EU's internal security, where it is most prominent (European Union, 2019a, 2019b), the concept mainly describes a massive data-political project to connect different databases, such as the Schengen or the Visa Information Systems, in order to ‘break the silos’, as it is often formulated in EU jargon. This, it is argued, improves control of mobilities and the identification of people on the move (Bellanova and Glouftsios, 2022; Leese, 2022; Trauttmansdorff, 2023). As a techno-political project, interoperability is more than a mere technological development or upgrade. Rather, it contributes to significantly advancing European integration by technopolitical means (Bellanova and Glouftsios, 2022). In line with Amicelle et al. (2015: 293), in this article we look at the ‘configuration and reconfiguration of security practices by attending to the equipment or instrumentation that make these practices possible and temporally stabilize them’. To this end, we aim to show how the processes enabling, promoting and implementing interoperability are structured in ways that exclude input and contestation by civil society (Trauttmansdorff, 2025; Bellanova et al., 2025).

In concrete, through a focus on Research and Development (R&D) processes, we show how such exclusion unfolds. This allows us to cast a light on a form of political marginalization of data subjects that runs in parallel to (and in some case in advance of) the marginalization that security IT systems produce vis-à-vis migrants, asylum seekers, and other vulnerable populations. In our analysis, R&D processes funded by the EU to develop new technology emerge as one arena in which interoperability materializes. We argue that R&D, in the field of internal security and border management, through its formative role for border making, plays a central part in realizing interoperability. Its scarce engagement with CSOs contributes to the exclusion and silencing of public scrutiny.

We situate our analysis in ongoing debates about how security and data politics often occur without engaging with publics (Aradau and McCluskey, 2022; Broomfield and Reutter, 2022; Friedewald et al., 2017, Hallinan et al., 2012; Mountz, 2015; Walters and D’Aoust, 2015). By focusing on interoperability, this article zooms in on an important lacuna: today, we neither know enough about the specific details of the (non)participation of CSOs, nor its implications. To address this knowledge gap, the article first introduces a dataset of CSOs participating in R&D projects in the security domain funded by the EU's framework programmes for research, namely the current one (Horizon Europe, 2021–2027) and its predecessor (Horizon, 2020, 2014–2020). We organize those CSOs across the four domains of security research in Horizon Europe (HE): fighting crime and terrorism (FCT), cyber security (CS), disaster resilient societies (DRS) and border management (BM). As an important data-political project in border management, we then focus specifically on projects engaged with the design and/or implementation of interoperability. Through this, we understand how CSOs are implicated in political visions of materializing interoperability through R&D, and how civil society is engaged or disengaged in policy-making bodies.

As security research within the Horizon programmes is closely tied to policy objectives, the political significance of R&D in terms of achieving interoperability is negotiated in other spatial and temporal settings outside of the ‘laboratory’ (Latour and Woolgar, 1986; Bourne et al., 2015) of the project. This means that while CSOs can potentially shape the design and functionality of the specific IT systems, they have little room to transform the technopolitical conditions of interoperability – and this is problematic, given that interoperability has a crucial role in expanding mobility control (Amelung, 2021; Singler, 2024). R&D emerges not only as process of scientific and technological advance, but also as a practice of legitimizing data-political initiatives of control. We draw on conceptualizations of non-knowledge and ignorance (Gross and McGoey, 2022; Perret, 2024) and explore how sidelining knowledges of CSOs leads to a knowledge dominance of security actors (such as EU executive agencies as eu-LISA) in implementing interoperability. We demonstrate how citizens and civil society are made invisible in, and absent from, the imaginary building that pulls resources and political capital towards the idea of interoperability.

We will proceed as follows. First, we explain our conceptual choices, by approaching the issue of CSO participation in security and interoperability research through the lens of the literature on publics. Secondly, we explain our methodological choices and how each method is fit for our purposes. Thirdly, we show our results and analyse them through the conceptual tools provided before. We conclude with a discussion that problematizes the non-involvement of CSOs for the social making of interoperability.

Why study R&D to unpack interoperability

In the wider techno-politics of security (Müller and Richmond, 2023), R&D of security technologies has been conceptualized as an important vehicle to provide technological devices for realizing political programmes in the domain of European security. For instance, within the HE programme ‘Civil Security for Society’, the EU has planned to spend around €1,5bn on civil security research in the timespan between 2021 and 2027. These programmes are strongly aligned with policy goals and conceptualized to provide state-of-the-art technologies to ‘solve’ specific political ‘problems’ that are formulated by policymakers and practitioners (Martins and Jumbert, 2022). Thus, through interrogating R&D, we obtain insights into the nexus between politics and technology development and we can better understand how political logics of security are inscribed into technological design processes (Bourne et al., 2015).

R&D programmes reflect the growing salience of interoperability in EU policy debates. In the 2023–2024 working programme of HE's ‘Civil Security for Society’, two calls in the realm of border management aim specifically at achieving interoperability. The word interoperability is mentioned 30 times, as compared to only 12 times in the preceding 2021–2022 programme (European Commission, 2021, 2022). R&D emerges then as an arena in which interoperability is shaped through the intersections of policy and technology development. Databases and interoperability are employed in order to render populations on the move legible and traceable, and to identify their possible ‘riskiness’ (Leese, 2022). In this context, then, R&D inscribes the interface of criminal data and mobility control into material devices, contributing to a further convergence of policing practices and mobility control (Amelung, 2021).

The ‘Civil Security for Society’ programme is the current iteration of what is often called the EU's security research programme (SRP). It works through the funding of specific projects carried out by consortia that comprise actors from security agencies, research institutions, industry and – in some cases – CSOs and other societal actors (such as museums, schools, interest groups, etc.). These consortia are thus, in a broader understanding, ‘laboratories’ (Knorr-Cetina, 1999) in which different actors interact and exchange knowledge to advance the technological governance of security. However, the strong link to policy renders the work within these projects particular, as the scientific process is often designed to the ends of policy requirements (Binder, 2024; Martin-Mazé and Perret, 2021; Martins, 2023; Martins and Ahmad, 2020).

This underscores how R&D is, in this context, a highly political process. The links between political agendas and R&D processes, coupled with an applied dimension, separate security R&D from a more independent scientific process of knowledge production. Rather, the entanglements of policy, operational requirements and ‘solutionism’ engender a specific set of practices that ‘perform’ security politics and translate ideas about data and security into material devices (Amicelle et al., 2015; Bourne et al., 2015).

Conceptualizing publics in interoperability R&D

Interoperability in the EU is based on two regulations (Regulation (EU) 2019/817 and Regulation (EU) 2019/818) that establish a framework based on four new components: a European Search Portal (ESP); a shared Biometric Matching Service (sBMS); a Common Identity Repository (CIR); and a Multiple-Identity Detector (MID) (see introduction to this special theme for more details (Bellanova et al., 2025). We approach interoperability as being at the intersection of evolution in data infrastructures for security, on the one hand (Leese and Ugolini, 2024; Trauttmansdorff, 2023; Vavoula, 2020), and the public engagement with processes of technological development, on the other (Hess, 2015; Kennedy and Moss, 2015; Goodin and Dryzek, 2006). We look at interoperability ‘in search of the citizen’, to borrow the expression from Heather Broomfield and Lisa Reutter (2022), meaning that we are particularly interested in the relationships of publics and infrastructuring security (Christensen and Liebetrau, 2019; Monsees, 2019; Walters and D’Aoust, 2015).

Like many security policy initiatives, the large-scale re-structuring of the EU's internal security governance through database interoperability is rarely exposed to wider public engagement. Interoperability works as a powerful narrative device (Trauttmansdorff, 2023) enabling political programmes to create ‘state-legible identities’ (Leese, 2022) and handing increasing powers to state security forces (Martins and Jumbert 2022). Decisions on interoperability are – akin to the wider political field of internal security – largely based on expert knowledge and executive analysis of this knowledge within the European Commission and EU agencies. Interoperability essentially re-creates personal profiles according to available data ‘by mining and clustering the data that constitute particular kinds of publics’ (Mörtenbeck and Mooshammer, 2020: 7), with these publics encompassing people on the move, such as travellers and migrants. This renders public contestations of interoperability difficult, and locks-in expert perspectives as guiding organizing principles of larger publics.

Interoperability hence relates to different forms of agency (or the lack thereof) in controlling publics on the move. Practices of control are transformed by facilitating a combination of different data, shifting agency from controlled publics to forces of control (Kennedy and Moss, 2015; Kennedy et al., 2015). In doing this, interoperability ‘works the question of the limit of democracy’ (Huysmans, 2014: 24) through forms of involving and excluding publics and civil society. Hence, with interoperability constituting a major step in the further datafication of European security practices, we follow Broomfield and Reutter (2022: 1) in asking ‘[h]ow are citizen perspectives problematized and included in policy and practitioner discourse in the datafication of public administration?’.

In particular, we are interested in how different forms of knowledge shape the procedures in security research projects and what role CSOs knowledge has therein. Here, R&D can be better understood as a form of ontological politics (Mol, 1999), where interoperability is ‘made real’ through the production of material devices. However, what is understood by interoperability differs depending on the perspectives of actors. In this sense, R&D is a part of what Marieke de Goede's defines as the ‘chain of security’ where ‘security judgements are made across public/private domains’ (2018: 27). Judgements that are made within projects and materialize in one specific device are hence a result of negotiation processes within the project. This means that interoperability, as a characteristically non-public political intervention, could in theory be challenged and shaped through CSOs in these projects.

CSOs introduce the perspectives of the specific publics they emerge from. For example, a data protection CSO represents publics that are affected by the processing of their personal data; it does not represent, nor speaks for, say, people with mobility disabilities, or cyclists demanding better bicycle lanes in urban areas. In this line of thinking, CSOs act as ‘spokespersons’ of publics following an understanding that ‘someone or something can act as a spokesperson because they literally speak for someone else’ (Pelizza, 2021: 495). But that does not mean that they speak for the whole civil society. Indeed, we understand CSOs as ‘speaking’ for parts of civil society they seek to represent. As organizations pursuing one agenda, CSOs have different objectives and goals for intervention, which can be conflicting.

To enable a more fine-grained analysis, we follow a definition of CSOs put forward by the 2007–2008 Advisory Group on CSOs and Aid Effectiveness, now adopted by the OECD Development Assistance Committee ¹ , and referred to in United Nations Development Programme publications:

[CSOs] can be defined to include all non-market and nonstate organizations outside of the family in which people organize themselves to pursue shared interests in the public domain. Examples include community-based organizations and village associations, environmental groups, women's rights groups, farmers’ associations, faith-based organizations, labour unions, co-operatives, professional associations, chambers of commerce, independent research institutes and the not-for-profit media. (OECD, 2010, cit. in United Nations Development Programme, 2013: 123)

Furthermore, ‘CSOs are voluntary organizations with governance and direction coming from citizens or constituency members, without significant government-controlled participation or representation’ (OECD, 2010).

CSOs shift publics from being a pure audience into becoming ‘active’ participants in security processes, thereby assuming agency (Walters and D’Aoust, 2015). Through this shift, CSOs, if involved, should enable contestation in the development of interoperability. However, as this paper will show, this process is not as clear-cut as idealistically envisioned, and indeed, understanding CSOs merely as spokespersons for the public is challenging. In border management, for example, a big percentage of the people affected by border policies are not EU citizens, and therefore cannot participate in the processes through which border management policies are formulated and border management technologies are developed. The civil society that does get involved is often not truly representative of the ones that are greatly affected by border management. This constitutes an important blind spot that a mere claim for further civil society participation cannot alone resolve, as CSO involvement still occurs within the dominant power relations of security.

In order to better understand the role of CSOs as representations of publics in R&D, we first need to interrogate how publics are represented in processes at the nexus of science and politics, and second, how they are involved in political decisions of security and datafication (Broomfield and Reutter, 2022; Steen and Nauta, 2020; Walters and D’Aoust, 2015). As R&D becomes a (data-)political practice contributing to interoperability through translating specific knowledges into material devices, understanding CSO involvement allows for an insight into how public knowledge is negotiated along the ‘chain’ of interoperability (De Goede, 2018).

The relationship between science and democracy has been problematized from various angles, particularly in terms of public participation and involvement in large-scale research projects. This is particularly relevant in heavily politicized areas of applied science, such as security research, where scientific expertise is deeply intertwined with perceptions of democracy, fundamental rights and state power (Brown, 2009). In the context of the Horizon programmes, R&D creates multiple interfaces for public intervention and engagement, not only during the technical work of the project but also in the politics of designing the programmes (Binder, 2024). In this sense, publics are an important element of the technological society (Barry, 2001) through their engagement with scientific projects. Civil society represents an additional layer of the knowledge society in terms of contributing to innovation processes and seeking to augment relevance for research (Hessels et al., 2009; Schoonmaker and Carayannis, 2013). Through forms of public engagement mediated by CSOs, state actors claim to enable a ‘contentious politics’ of data infrastructures (Tilly and Tarrow, 2015) that challenges knowledges and perspectives of security actors. Public engagement thus ‘can also contest the official imaginaries of the public as threat and can pose counter-imaginaries of the state, industry and socio-technical futures’ (Hess, 2015: 71), leading to a perceived conflict between the desirability of public engagement and achieving technological progress.

As we will unpack more thoroughly later in the article, this tension lies at the heart of the ‘practice’ of CSO involvement. However, there is a valid question whether CSOs can represent a wider public, since they often are specialized organizations in a particular domain. While the concept of ‘mini-publics’ – i.e. ‘groups small enough to be genuinely deliberative, and representative enough to be genuinely democratic’ (Goodin and Dryzek, 2006: 220) – could alleviate this issue, always conceptualizing all CSOs through (mini-)publics is much more complex. CSOs are deliberative and representative in a sense that they usually materialize wider aspects of civil societies into tangible organizational structures that (may) participate in political processes. Yet, CSOs are often specialized organizations, that pursue one specific interest, and thus, the question remains whether CSOs work as ‘public’ or rather as a form of legitimization of a particular interest. In this sense, CSOs provide access to these domains, but not to the civil society as a whole. This form of engagement could be critiqued as ‘strategic non-knowledge’ (McGoey, 2012, 2019) where, in the context of interoperability, the role of public engagement remains reduced with the purpose of obstructing possible contestations of the political logic of interoperability. CSO involvement is not necessarily intended in terms of contestation, but rather, to provide a semblance of wider public access. In that sense, ‘mini-publics’ are helpful to understand how CSO involvement is envisioned by the EU in security R&D, but not necessarily in how this involvement plays out. Rather, what CSOs often do is materializing what Timothy Mitchell (2009) has fittingly described as the ‘rule of experts’, where specialized knowledges determine wider political decisions.

Security R&D is shaped by specific circulations of knowledge and power structures, often characterized through matters of secrecy and opacity (Balmer, 2012; Bosma et al., 2020; Martins, 2023). While the EU's Framework Programmes are usually quite public in terms of providing information, the way they are shaped by specific security knowledges and imaginaries remains nevertheless outside of the public realm. Christensen and Liebetrau (2019) conceptualize the role of the public in security matters as dual-faced – they are simultaneously seeking to be protected through security measures and guarantee democratic accountability. In the case of CSOs in interoperability and R&D, this applies to multiple dimensions of their work, in terms of representing how interoperability should work to the advantage of publics and in terms of guaranteeing that interoperability remains in the confines of democratic politics and does not emerge as an excessive instrument of governing migration through data (Leese et al., 2022).

Similar to the ‘promise’ of security through R&D, the making of data infrastructures should be a highly public question. Data, as Bigo, Isin and Ruppert (2019: 3) describe, became a highly political issue ‘because it reconfigures relationships between states, subjects and citizens’. In this context, the dichotomy between ‘known publics’ and ‘knowing publics’ that Kennedy and Moss (2015: 2) describe is highly relevant for the social making of interoperability as it focuses on the forms of agency through knowledge on data. Since interoperability is achieving state capabilities to ‘make known’ citizens, people on the move and possible criminal suspects (Leese, 2022), how are publics involved in this production of knowledge and thus transform from ‘known’ to ‘knowing’? How would public engagement with interoperability alter the data politics at the border in terms of the interlinkages of crime and mobility (Amelung, 2021)? While interoperability is envisioned to improve the public administration of security issues, it is also important what it means to the relations between the EU and its publics (Esko and Koulu, 2023).

Through a lens of publics, engaging with CSOs thus allows us to problematize possible democratic deficits (Huysmans, 2014) in making security and data governance through R&D. With this perspective, we are able to interrogate the modes of dispute and controversy (Aradau and McCluskey, 2022; Barry, 2012) within interoperability R&D projects through the involvement of CSOs – or the lack thereof. With R&D being productive of wider security ‘solutions’ and interoperability being framed as a pertinent solution to a myriad of issues, problematizing modes of lacking public involvement is crucial to understand why political projects assume certain designs and rationalities that engender problematic structures.

Methodology

We use a combination of classic and digital methods to generate and analyse our data. This allows us to bring together complementary material that provide elements for our analysis of whether, with which dynamics, and with which consequences, CSOs are involved in EU-funded interoperability R&D. In specific, we use digital methods (web-scrapping), ethnographic methods (participant observation), semi-structured interviews and document analysis. In this, we follow Valdivia et al.'s (2022) argument that ‘a combination of digital and qualitative methods can help shed light on data-driven transformations at the European Union (EU) borders’ (2). Indeed, these digital methods, combining qualitative and quantitative elements, ‘help us improve large-scale data access as well as reorganise and restructure the archive to understand the presence and development of datafication’ (Valdivia et al., 2022: 2).

Methodology for the mapping

To map the participation of CSOs in the EU's latest SRPs in H2020 and HE, we first accumulated a comprehensive list of projects that are part of the security programmes: 438 projects in H2020 and 107 projects in HE. Since the Horizon Europe programme runs until 2027, the later data covers the projects approved until a moment in time, which in our case is February 2022. We categorized them by four security domains, namely FCT, BM, CS and DRS. Projects that did not fit within any of these four domains were categorized as ‘other’.

The European Commission has a searchable webpage with an overview of all its projects, called Cordis. We downloaded H2020 Secure Societies (the official name in H2020 of the programme commonly known as SRP) project data to an excel file containing the project acronym, project title, Grant ID, teaser and programme. The sub-programmes’ numbers were automatically included in this excel file, enabling us to categorize all 438 projects by our four domains. However, categorization had to be conducted differently for projects under HE's Civil Security for Society programme (the official name in HE of the programme commonly known as SRP) since HE's security projects are more neatly separated through topics, whose codes contain the same abbreviations that we use, DRS, FCT, BM, or CS. Therefore, we used ‘web scraping’ to organize the projects by topic. Web scraping is a tool that can automatically gather data from a subset of webpages that are similar-looking into one excel file process that automates extraction of data from webpages, and it is well suited for our intended purpose since the data we wanted, i.e. the topic, had the same placement on each project's webpage. On the Cordis search website, we opened the tab ‘Web Scraper’ and created a sitemap of the cordis webpage (the root URL). The scraper's selector was set to gather information from multiple links, as in the links for the 107 project webpages. We then created additional selectors within each link, namely the project acronym, grant id and topic. Once the scraping process was complete, we exported data as comma stated variables (CSV).

The result was an overview of each project and their associated topic. Based on these two lists of projects (H2020 and HE), it was possible to move on to mapping potential CSO involvement in EU security research. Each project webpage provides a list of the coordinator, participants and partners. These actors are differentiated based on their ‘activity type’. There are five activity types, namely public bodies, higher or secondary education establishments, research organizations, private-for-profit entities and ‘other’. The lack of a specific category for NGOs/CSOs means that these fall under the broad definition of ‘other’. When trying to collect data on all the ‘other’ actors who have participated in security research projects, the web scraping could not be used since the information we wanted was not in the similar place on each project webpage. Thus, we collected the information manually, going into each project webpage and copying information on ‘other’ actors into a new excel file. We chose to gather the name of the actor, country, project, grant ID, website (if they had one) and add the category domain for that project. Actors listed as ‘other’ can be CSOs but also museums, public institutions and the like. Getting an understanding of which are CSOs and which are not required checking the results one by one.

The method above enabled us to create a picture of CSOs that participate in security research, and we found more than 170 different CSOs participating in security research projects in H2020 and HE. We then complemented our data collection through three additional methods. Firstly, through the participant observation at the 2023 Security Research Event (SRE), organized by the European Commission in October 2023. This is the ‘annual meeting where industry, governments and knowledge institutions come together to discuss the state of play and current challenges for security research in Europe. The SRE also features a large exhibition area dedicated to the EU funded security-related projects’ (European Commission, 2023). Participating in, and attending this event enabled us to conduct ethnographic observations about the projects selected to be highlighted, the role of CSOs in those selected projects, the themes discussed in the plenary sessions, and other performative dynamics such as the location of the project booths, the language and discourse used, the decoration of the site and other dynamics permeating social interactions.

We also conducted semi-structured interviews (n = 7) with interoperability project researchers, CSOs participating in security research, an official at eu-LISA working on interoperability, and a national research institution official with vast experience in processes surrounding drafting of calls for security research. Through the interviews, we investigated how public actors envision interoperability and particularly the role of R&D to realize the programme. We draw on interview material with CSOs involved in these projects with the objective of understanding whether and how their views on interoperability managed to influence the outcomes of the projects. Additionally, we conducted interviews with public officials involved in the planning, conceptualization and implementation of the interoperability regulations, with the objective of understanding the role and place of civil society and citizens in the making and implementing of interoperability. We used five of the interviews for specific insights into the article's enquiry; the remaining two are used as useful background information that contributed to shaping our interpretation of the data generated otherwise. We used the same interview protocols for all, but five of them generated ideas and citations that we use directly in the manuscript of article, while the other two did not. Through the above-mentioned mapping, we identified eleven projects that addressed ‘interoperability’ in some way. We then conducted an analysis of the ways how interoperability is understood in these projects to deem whether they are relevant for the scope of this study. We did this through reviewing the projects description/summary when available, by researching on their websites, and by consulting their published outputs.

Problematizing the (non-)involvement of CSOs in interoperability R&D

CSO participation in EU-funded security research

Since the European Commission's 7th Framework Programme (2007–2013), civil security research became an important part of EU-funded R&D efforts in Europe. Research conducted at the service of pursuing (mostly internal) security objectives continued through the following framework programmes, H2020 and HE, the latter currently in place. This EU-funded security research follows a model that fosters public-private cooperation, materializing the triple helix model of innovation (Leydesdorff and Etzkowitz 1998), referring to the interactions between academia, industry and government, designed to advance economic and social development.

Yet, as the SRP unfolded throughout the years, it became clear that citizen participation in security research was very scarce, despite citizens being often at the receiving end of the application of the technologies, procedures and methodologies developed in the projects. In other words, while industry, research institutions and governmental agencies were often participants in European projects, citizens were widely excluded from them. This not only affects the democratic legitimacy of the whole R&D environment in Europe, but it creates an ecosystem marked by lack of transparency and contrary to the principles of open science, that the Commissions adheres to. In the context of a data-political project of mobility control as interoperability, this is problematic, as many of the counter-measures to security ‘problems’ are marked by a difficult balance between different societal values. Moreover, and from a more utilitarian perspective, it also impacts on the societal acceptance of the security project outcomes, affecting the possibility of those same results being applied by end-users. At this point, the literature had started to highlight the need to move from the above-mentioned triple helix of innovation to a quadruple helix (Carayannis and Campbell, 2009), adding the public as an important part of innovation processes.

In this context, several measures were adopted in recent years to address some of these issues. This includes the systematization of the principles of Responsible Research and Innovation and the opening of research calls for proposals dealing with societal concerns, requiring civil society participation. As a result, there are now plenty of CSOs that have participated in the SRP, but the broad category ‘other’ on cordis webpages perpetuates the uncertainty, and a specific category for CSOs would help identify engagement.

Over the years, different attempts have been made to facilitate conversations between different actors through the Public–Private Dialogue (PPD) in security research. PPD was endorsed by the European Commission already in 2003 and, from this, sprung high-level venues and the security advisory group. The European Security Research and Innovation Forum (2008–2009) is an early example of a high-level venue. However, the participants in such venues mainly consist of public security bodies and the industry, with few CSOs present: only nine out of the 660 ‘stakeholders’ came from CSOs according to Statewatch and the Transnational Institute (Hayes 2009: 24). This corresponds with our empirical observations, 15 years later, of the lack of CSOs represented at the Security Research Event 2023. This has relevant implications, and a report for the European Parliament analysing security research in FP7 concluded that the unequal representation of civil society and security agencies explains why security research in the EU tends to ignore interests of civil society (Bigo et al., 2014: 33; see also Jones et al., 2022; Lemberg-Pedersen, 2013).

Within the SRP some projects analyse the barriers for CSO engagement, for example ENGAGE 2020 and SecurePART. These projects highlighted issues of resources, skills and structures of CSOs as possible obstacles for interactions, since the projects are often highly specialized, and interactions are described as time-consuming. For example, one of our interviewees claimed that not all societal actors have the skill and training to engage in security research because the process often requires high levels of technological expertise, which most CSOs do not possess (Interview 4). This hints to a low compatibility between many CSOs and SRPs, since specific technical and security knowledges dominate in SRP-funded projects. For instance, our findings suggest that different branches of the Red Cross, one of the few CSOs actually involved in interoperability projects, have been involved with BM or DRS projects due to their expertise in emergency responses, and not necessarily as an interest group representative of civil society as a whole.

Against this backdrop, we now set out to discuss the challenges of CSO (non-)involvement in the specific field of interoperability. At the interface of interoperability and R&D we can interrogate how the structures through which CSO involvement is negotiated are (re)produced and intensified.

Interoperability within security R&D

Security R&D, as discussed before, emerges at the intersections of larger programmes that are shaped by political objectives (Martin-Mazé and Perret, 2021). The increased interest in interoperability has also translated into the programmes: for instance, the Strategic Plan of HE sets forth that ‘R&I will enhance the interoperability and performance of relevant EU information systems, leading to better and faster exchange as well as analysis’ (European Commission, 2021). This vision materializes in different work programmes. For instance, in the H2020 work programme 2018–2020 Secure societies there were two calls under the border security domain that mentioned interoperability, which funded a total of fifteen projects. While in the first biennial HE work programme interoperability was not included in the specific calls, it experienced a substantial increase in the 2023–2024 programme, where interoperability – in different meanings – was included in six different specific calls (European Commission, 2022).

The analysis of our data for H2020 and HE provided us only with 11 projects altogether dealing with interoperability, from which only one project operated in the scope of interoperability for internal security–the iMARS project that develops systems to tackle identity fraud. This prompted us to include other projects in the analysis ² to understand how CSO involvement shapes the term ‘interoperability’ as such.

This circumstance underpins one of the major challenges of interoperability in R&D–it represents a term emerging in different security fields. Borders and migration remain the most prominent examples, but fields like disaster management and counterterrorism saw an increased attention to interoperability. In result, through reviewing the projects and through the interviews, we found the notion to be polysemous and depending on its situatedness, rather than conveying a broad, objective meaning (Haraway, 1988). While in border security the regulations on database interoperability shape the meaning of interoperability, the notion is interpreted differently in R&D and its meaning for security is controversial. Attending to the (non)engagement of publics thus gives insight into how meanings of interoperability are construed.

Before we attend to the modes of (non-)involvement of CSOs, we interrogate how R&D is mobilized in the implementation of interoperability. Through the calls for proposals, R&D objectives become enmeshed with broader policy objectives, in ‘a particular knowledge-making process [that] leads to particular security outcomes in policy and practice.’ (Martins, 2023) This process is shaped through consultations of security actors, industry and at times academia, which results in a draft of the programme by the Commission that is then approved by member states in the programme committee (Interview 2). In all these steps, CSOs are largely side-lined. While NGOs sometimes contest the SRP, they are usually not part of the committees drafting the programmes and the calls for proposals (Interviews 1, 2).

One interviewee told us that, in the context of database interoperability ‘speaking about (…) direct interconnections or relationships between the research framework program and interoperability (…) is a bit too far-fetched.’ (Interview 1) Focusing on databases, it was also mentioned that ‘interoperability likely increases the need for doing (R&D), it increases the importance of the results, the scope of application.’ (Interview 1) Our research has revealed, however, that interoperability, in a wider sense, is discussed both within research projects and the making of programmes, in terms of standards for security tools (i.e. communication).

On a wider level, official representatives expressed doubts about both the possibility and the efficiency of the involvement of CSOs. In terms of shaping wider interoperability programmes, one official noticed that CSOs can only be involved in projects, but not in the wider shaping of the programmes:

I don’t really see personally how these organizations can be involved and how they can affect anything that is happening, really. Of course, this doesn’t preclude the involvement of civil society organizations in research innovation projects themselves. (Interview 1)

The sentiment that CSOs do not have the possibility to shape the implementation and politics of interoperability was echoed by another interviewee, given that interoperability at a larger scale is per se an organizational, administrative practice, rather than a technical one. ‘I don’t see the added value of involving civil society there. This is more an internal, organizational issue, a management issue.’ (Interview 2) The understanding of interoperability through organizational terms underscores that public involvement is considered nearly impossible for even more specialized technical representations of civil society. This results in a creation of ‘non-knowledge’, where publics are deemed as unable to being involved. The wider analysis of how interoperability is framed in research programmes without substantial public involvement now invites to interrogate more closely the role of ‘mini-publics’ in the context of projects.

(Non-)involvement of CSOs in R&D

We propose that the processes described above illustrate two levels of non-involvement. First, on the wider programmatic level, CSOs are regarded as lacking agency to shape decisions of how interoperability can be achieved and implemented. Second, they are also not involved in the development of technological devices that are framed as ‘solutions’ for interoperability. The above-mentioned iMARS project was the only interoperability-related project with CSO involvement. This transforms spaces of ‘making’ interoperability into secluded settings in which specific security knowledges dominate. By attending to this double-layered non-involvement, R&D represents an arena in which the presence of publics, even as ‘mini-publics’, is obstructed, leading to a sense of secrecy and obfuscation. As one interviewee told us, in a security-relevant field like interoperability, there is a belief that publics are not necessarily interested in shaping its functionality and exact knowledge about the systems, but are rather interested in the results, which was claimed to be the absence of insecurities (Interview 5). This view is shared by a project participant, who argues the complexity of CSO involvement is rooted in the specific settings of security:

Security is a very centralised and a very secluded field. Civil society cannot relate to it as much because security is always (…) at the national level, a regional level or city level, and sometimes there is a disconnection between central mechanism and grassroots organisations. (Interview 4)

This shows how interoperability R&D framed the interactions between data infrastructures and the public as functional ‘solutions’ that exist beyond, or irrespective of, public acceptance. Social acceptability is thus argued to be created through less public engagement, as CSOs are framed to voice concerns that might obstruct the development of necessary technological devices (Interview 2). This hints to the wider question of the degree of public involvement in data and security politics – in other words, CSO involvement is not only contested, but sometimes even described as a factor that hinders collaboration between state actors and civil society. One project leader mentioned tensions between CSOs and security actors as an obstacle, where collaboration in the projects is rendered impossible.

I had an actual conflict between integrating them in the consortium, the border guards and governments and NGOs, the interests are sometimes opposing. And there was this situation in which NGOs wouldn’t be feeling comfortable having policymakers at national level. (Interview 5)

While in that specific case, the knowledge of NGOs/CSOs was deemed necessary for the project, we found this to represent more an exception stemming from the specific project's interest. Because the involvement of security professionals is usually formulated as a condition for projects, these disputes often leave CSOs looking in from the outside. This allows security actors to shape devices of interoperability according to their knowledge and needs.

Negotiating CSO involvement

Lastly, it is important to show different explanations of why CSO involvement is often obstructed. While it was articulated that CSO involvement in interoperability is reduced through it being a primarily organizational issue, it is disputed in more complex ways, where it is not regarded solely as beneficial, but rather an issue of negotiation (Aradau and McCluskey, 2022). That stems from a concern articulated by security and policymaking actors that CSO involvement is at times obstructive to the objectives of security projects, as they are described as creating opposition to the needs of security actors and thereby slow down and complicate the process. One interviewee described how security actors regard CSOs as opposing specific security objectives and thereby slowing down processes within projects. As a consequence, it was claimed by one of our respondents that CSOs should be realistic about their role and be more supportive of the security actors in a sense of providing different, but specialized perspectives (Interview 2). Moreover, as another interviewee outlined, capacities to engage with issues pertaining to interoperability, such as data protection, are often not available, rendering the omission of CSOs not necessarily a political decision, but also dependent on capacities to engage with their inputs (Interview 1).

Security actors thus regard CSO involvement as advantageous when two conditions are met – first, they should provide specialized knowledge that works towards the objectives of the project rather than challenging persistent perceptions on data and security (Interview 2), leaving CSOs to perform the role of legitimizing through knowledge. Second, CSOs should cover particular parts of civil society and not attempt to provide a view on civil society as a whole. This hints to a definition of ‘mini-publics’, where CSOs assume their legitimacy in the process as representatives of a particular segment and providing specialized knowledge. As one interviewee told us, this can for instance comprise first responders, since they are often perceived as closest to wider society and therefore ideal project partners to create an involvement of civil society. During our observations at the Security Research Event, participants from several projects explained their uncertainty about the benefits of including CSOs but noted that they could be helpful in creating social acceptance for security technologies as civil society is often critical to highly technological solutions.

This hints however to a crucial point through which the involvement of CSOs is problematized – the unclear perception of how to understand CSOs within R&D and what comprises a CSO.

Some organisations also consult the central or local governments on matters that also have to deal with security. Some others are just (…) informal groups of citizens that don't have a relationship with central governments and can have quite an adversarial relationship to central or to local government. (Interview 4)

In this perception, we see a rationale of how the understanding of ‘mini-publics’ is regarded as source of possible contestation. This engenders a tension between the involvement of CSOs for their specialized knowledge and the skepticism about CSOs challenging security imaginaries and visions held by state institutions. The involvement of CSOs emerges then as a controversy about power and knowledge to shape the data-political project of interoperability at multiple levels. In terms of formulating large-scale research programmes, that define interoperability as an objective of R&D, state representatives interact with EU officials, leaving CSOs excluded in formulating the guiding principles of security research. In this, we see how CSOs, by virtue of being limited to work in projects, might end up in contexts where they are mostly translating political visions of state actors that are shaped by logics of security (Valkenburg and van der Ploeg, 2015). However, we have also observed that even at project level, CSO involvement is sometimes used as a box-ticking exercise to render projects outputs more accepted, even more marketable.

The role of CSOs in the knowledge production and technology development surrounding interoperability is hence consciously limited by public actors situated at the interface of interoperability and R&D. That leaves the publics subject to political preferences and imaginaries set forth by security actors, thereby privileging their knowledge and rendering their ‘expert’ knowledge unchallenged. Through this, we find the role of CSOs in reshaping the relations between data infrastructures and the public limited, which does not only result from the modes of exclusion, but also specifically from modes of their inclusion and the limited role that is attributed to them. This underlines that it is not primarily relevant whether CSOs are involved, but we rather have to attend to the complex modalities of inclusion and exclusion in order to understand their role in making interoperability.

Conclusions

The data-political restructuring of the EU's borders through interoperability has been described as challenging by the EU's Fundamental Rights Agency, the European Data Protection Officer, and some fundamental rights NGOs. Against this backdrop, we were interested in assessing whether (and potentially how) CSO involvement could provide a relevant mitigation measure, as the lack of publics locks in security knowledges that are often rightfully problematized. However, as our analysis has shown, CSO involvement in R&D that is relevant for the implementation of interoperability is far from straightforward. Rather, it is an issue that engenders multiple challenges and requires a critical unpacking. What are these challenges?

First, interoperability, as an assemblage of data politics and security politics, underlies a two-edged logic of affecting publics while at the same time facing constrains of secrecy and opacity through being entangled with rationalities of security. As we found through our empirical analysis, this was presented as a major reason for the little involvement of CSOs in projects that engage with interoperability. While seen as a techno-political issue, interoperability was largely described as an administrative process that is ongoing within institutions rather than a larger reshuffling of a relationship between mobile publics and state institutions that control mobility. This, in consequence, was used as a justification for the non-involvement of publics.

Second, interoperability as a concept is not as clear as the regulations for database interoperability might suggest. Rather, we found out that different forms of situatedness shape how actors make meaning of interoperability, for example in security realms that lie outside of border management. Interoperability is rather a wide-reaching rationality that justifies certain technopolitical practices (Rose, 1999). This makes the (non)-involvement of publics particularly contentious, as CSOs could, in theory, shape understandings of interoperability through their specific expertise. Through this, the involvement of CSO results in a reproduction and reification of state security actors’ conceptualizations instead of a strengthening of public agency.

Third, the extent of CSO involvement is subject to power relations within the field of R&D. That means that it is generally state and EU actors that shape the making of the SRP, taking decisions on not only whether CSOs are involved, but also on the modes of their involvement if they are. It is exactly through this process that CSOs sometimes emerge as ‘mini-publics’, i.e. as representatives of specific parts of civil society. In consequence, this means that CSOs are integrated into projects if they are envisioned to take a specific role in technology development, further reifying state imaginations of interoperability within R&D.

Finally, our methodological choices have enabled the generation and curation of data in ways that, as proposed by Valdivia et al.'s (2022) transdisciplinary methodology to investigate datafication, challenge ‘dichotomies between qualitative/quantitative methods, disrupting binaries of opacity/transparency and examining power relations’. Indeed, we have shown how CSOs are conceptualized in the SRP and how their involvement in interoperability has been framed as a complex, contested issue, non-amenable to dichotomous conceptualizations. Public-funded R&D is often argued to strengthen public involvement. In our specific case, though, we show the discrepancies between public accountability and the making of data-security infrastructures. CSO involvement is thus neither straightforwardly enabled or obstructed, but rather works in complex ways through which a perception of public involvement is used as a formative element, while modes of substantially challenging policy objectives are rendered diffuse and complicated.