Linking Reflexivity and Institutional Theories for Cybersecurity and Other Commons Governance Policies
Total Page：16
File Type：pdf, Size：1020Kb
Institutions and Self-Governing Social Systems: Linking Reflexivity and Institutional Theories for Cybersecurity and Other Commons Governance Policies by Kenneth Norman Clark B.A. in Physics, May 1982, Whitman College B.S. in Electrical Engineering, May 1984, The University of New Mexico M.E. in Electronic Engineering, December 1987, The California State University-California Polytechnic State University A Dissertation submitted to The Faculty of The Columbian College of Arts and Sciences of The George Washington University in partial fulfillment of the requirements for the degree of Doctor of Philosophy August 31, 2012 Dissertation directed by Kathryn E. Newcomer Professor of Public Policy and Public Administration The Columbian College of Arts and Sciences of The George Washington University certifies that Kenneth Norman Clark has passed the Final Examination for the degree of Doctor of Philosophy as of April 23, 2012. This is the final and approved form of the dissertation. Institutions and Self-Governing Social Systems: Linking Reflexivity and Institutional Theories for Cybersecurity and Other Commons Governance Policies Kenneth Norman Clark Dissertation Research Committee: Kathryn E. Newcomer, Professor of Public Policy and Public Administration, Dissertation Director Donna L. Infeld, Professor of Public Policy and Public Administration, Committee Member Michael Harmon, Professor Emeritus of Public Policy and Public Administration, Committee Member ii © Copyright 2012 by Kenneth Norman Clark All rights reserved iii Dedication In memory of my father Norman H. Clark. Thank you for inspiring me and starting off with me on this long journey. I wish we could have arrived here together. iv Acknowledgments First of all, I am truly grateful to my Dissertation Research Committee: Professors Kathryn Newcomer, Donna Infeld, Michael Harmon, Costis Toregas, and Jerrold Post, all of The George Washington University. Your support and guidance throughout this process is greatly appreciated. I especially thank Kathryn Newcomer, my Dissertation Director, and Donna Infeld, our Ph.D. Program Director, for their dedication, patience, and optimism in guiding me through to completion. My thanks go out to all the survey participants and interviewees who volunteered their time and energy to answer some very important questions regarding cybersecurity, and who contributed to this research, which addresses one of our nation’s greatest national security threats. Thanks also to Professor Stuart Umpleby, who mentored me and inspired me to take on this study of Reflexivity Theory, always expressing confidence that I could complete the task. And to Charlotte Hess for her interest and support in my research, and leading the concept of the “New Commons” into the social sciences. I am also very grateful to Janet Hulstrand for her tireless support and encouragement. I am extremely grateful to my true friends Monique Vella, Dave Sapper, and Mike v Tovrea for all their encouragement, laughs, and unwavering support through the years: Cheers! Finally, a person cannot complete a task such as this without the love and support of family. I thank my sister, Karen Gould, for being there and encouraging me. I thank Ethel Maki: you were there on Day 1 and I am truly blessed that you are with me now. Susan McKeehan, you have always been and will be an inspiration and a shining light. I thank my Mom, Kathy Clark: you and Dad raised me and guided me toward new horizons in my life, as only the best parents in the world could do. I wish both of you could be here as I complete this journey. Most of all I thank my wife, Sheila, for all her love, unwavering support, inspiration, and encouragement throughout this long process. We made it! vi Abstract Institutions and Self-Governing Social Systems: Linking Reflexivity and Institutional Theories for Cybersecurity and Other Commons Governance Policies A commons is the conventional term that describes a widely accessible and shared resource, such as an ocean, open rangeland, a public park, or public portions of the Internet, which is difficult to exclude or limit use once naturally provided or humanly produced. Ruin of a commons can result when individuals use the resource recklessly and selfishly, rather than adhering to conservation-minded, collective action, with a view toward preserving the commons for future generations, in cooperation with others in the community. Employing a mixed methods research design with the U.S. Federal government’s use of the Internet as an illustrative case, the research described here explores how Reflexivity Theory and Institutional Theory, and their common theoretical element of human agency, can be used in developing new policy concepts for commons governance. The research answers the questions, "How may Reflexivity and Institutional Theories be used to help improve the formulation of commons governance policies?" and “How may Reflexivity and Institutional Theories be used to improve Federal cybersecurity policies governing use of the Internet?” Through interviews and an Internet-based survey to collect and analyze data, the research demonstrates that elements of these theories can be used to inform both Federal cybersecurity policies and governance policies affecting other commons. vii Table of Contents Dedication ............................................... iv Acknowledgments ........................................... v Abstract.. .............................................. vii List of Figures ......................................... xii List of Tables ......................................... xiii Chapter 1: Introduction and Overview of the Research ...... 1 Research Purpose........................................ 1 The Problem in Context: Commons Governance.............. 3 The Case: Federal Cybersecurity Policy................. 10 Research Strategy and Questions........................ 20 Summary................................................ 22 Chapter 2: Review of the Literature ...................... 24 Introduction........................................... 24 Social Systems and Reflexivity Theory.................. 24 Institutional Theory................................... 35 The IAD Framework ................................... 44 Linking Reflexivity and Institutional Theories ...... 47 The Research Case: Federal Cybersecurity Policy........ 50 viii Federal Cybersecurity Policy and the Federal Information Security Management Act of 2002 ......... 56 Reflexivity and Institutional Theories for Addressing Cybersecurity ....................................... 65 Summary................................................ 70 Chapter 3: Research Methodology and Design ............... 72 Introduction........................................... 72 Exploratory Mixed Methods Research..................... 72 Data Collection Process................................ 75 The Survey .......................................... 79 The Interviews ...................................... 88 Data Analysis Process.................................. 90 Research Validity and Limitations...................... 95 Summary............................................... 103 Chapter 4: Analysis of Data and Findings ................ 105 Introduction.......................................... 105 Results of the Quantitative Data Analysis............. 106 Quantitative Analysis Supporting Research Question #1. 115 Subsidiary Question #1a Results .................... 116 Subsidiary Question #1b Results .................... 126 Subsidiary Question #1c Results .................... 134 ix Subsidiary Question #1d Results .................... 140 Quantitative Research Results......................... 146 Results of the Qualitative Data Analysis.............. 147 Reflexivity Theory and Cybersecurity Policy ........ 149 Avoiding Behaviors That Impact Trust and Reciprocity ........................................ 153 Self-Monitoring Habits for Cybersecurity ........... 156 Strengths and Shortfalls of FISMA .................. 157 Additional Policy Ideas for Cybersecurity .......... 163 Integrating and Summarizing the Results............... 165 Summary............................................... 169 Chapter 5: Conclusions and Research Implications ........ 171 Introduction.......................................... 171 Summary of the Findings............................... 171 Implications for Future Policy........................ 175 Considerations for Future Research.................... 183 Concluding Remarks.................................... 185 Appendix A: Internet Survey ............................. 187 Appendix B: Interview Questions ......................... 197 Appendix C: Survey Solicitation ......................... 199 x Appendix D: References .................................. 200 xi List of Figures Figure 2.1: The IAD Framework ............................ 44 Figure 2.2: Reflexivity and Institutional Theory Linkage Point ........................................ 48 Figure 2.3: The IAD Framework and Cybersecurity .......... 67 Figure 4.1: Educational Levels of Survey Respondents .... 107 Figure 4.2: Current Occupation of Survey Respondents .... 108 Figure 4.3: Personal Security Concerns of Respondents ... 110 Figure 4.4: Views on Security Policy Enforcement. ....... 112 Figure 4.5: Views on Areas for Internet Security Policy. 113 Figure 5.1: Reflexivity and Institutional Theory in the IAD Framework. ....................... 173 xii List of Tables Table 2.1: Reflexivity and Insider Threat Promising Practices.