I see.

Again, there are many reasons why I think that’s a compelling, and prudent, and smart approach. I think this is what the advantages of not being a huge country with a sprawling administration .

It’s interesting. What I’m hearing you say, and I really got a sense of this in our earlier conversation, which was very informative, is that you are also very much adopting this fusional approach, where you’re integrating the digital economy interests and activities as well as the cybersecurity ones.

Especially, we already spoke about Ukraine, and we know, of course, in the regional context here…

These experiments, these case studies are clearly going to be ongoing, as is the other side, the side of the threats and the vulnerabilities.

Serious scholarship, and also events where we gather people and have very much conversations like these, but broader gathered field with some leading experts and practitioners such as yourself. I think this is everything that you’re saying, from my perspective, clearly resonates with what we’re trying to do.

Need I say again that there’s a lot of interesting things happening already on the ground in this country and other countries like France, Germany, Estonia, and others, that requires some real serious study and analysis.

I think what could be interesting here as experimental case study for analysis, is precisely this question of how the integration of distributed ledgers to improve interoperability of government data collection and exchange can support the goal of data integrity.

I see. As you know by now, I have in some respects very much a security mindset. When I hear something like what you are describing that is innovative and ambitious, I like to think what are the security benefits of this? I hear distributed ledgers and I immediately think, ...

There we go. My understanding correctly, that what you’re essentially envisaging is to put T-Road on blockchain.

Indeed. That’s more…There are echoes in what you are saying with the X-Road system, which I’m pretty…

We’re being facetious, [laughs] but there’s almost a certain element of truth in that statement. Again, what we’re trying to do, and we regard this as very much part of our mission statement, is we’re trying to provide those networks of support and those resources.

You might as well go and join the frontlines in Ukraine to get that training.

They’re basically… Let’s imagine you are an aspiring PhD student in political science and international affairs and economics. Take your pick of a social science discipline. You want to spend four years or so writing a thesis in this area. Where are you going to go, and who are you ...

Basically.

That’s the problem.

But, this is a disconnect in a way I’m getting at here. There’s a lot of demand from below. Certainly, if you look at the student level, students that are applying to Oxford to look at cyber and digital affairs from a political and international societal perspective. There’s a lot ...

I think the point that you’re making is very much a valid one. What’s going on in Ukraine will help to, I hope, spur some interest in further studies.

We had Victor Zhora join us from Ukraine. It’s straight from the frontlines of the cyber conflict there and, of course, the tragic war going on in his country. He made some very similar points to what you just said, where he’s saying, “Look, actually, we’re having some success in ...

It’s very interesting, Audrey, that you’re saying this because I was recently just a few weeks ago in Tallinn. There was a big NATO conference, the CyCon. It’s a yearly event. As a prelude to that conference, we had a smaller workshop involving various European and international cyber scholars.

Yeah.

Oh, it’s an app.

Like digital ministry or something?

What does Diia stand for?

Outside…

Indeed. I feel I really have to emphasize this point, Audrey. This is fashionable and self-evident for people like us in this room to discuss it, but then…

I think this isn’t a message that comes across to you with any difficulty, right?

This strikes me as an area that is amenable for serious and systematic analysis. Again, so few people and projects, if any, really do that, which is why we consider that what we’re proposing to do in Oxford is really quite path-breaking and innovating.

That has to do with a number of variables, differences in political culture, demographics, geopolitical situation, the extent and type of digitization of the economy, and also various institutional path dependencies.

We’re at a point in the development of what I call cyber studies from a research perspective where we can really start differentiate some different national models for how to do this organization.

A small country like Estonia can really pull it off in a successful way, but in the United States, you go to the Cyber Command people at the Pentagon and ask them about the digital economy, they will have a very different understanding, if any understanding, about what that might ...

What they learned very clearly from the 2007 cyber attack experience is that you cannot separate the two sides of policy and the two sets of interest no matter how differently people in each set might view things. That’s why they’ve had this overarching approach.

There’s a single architect and there’s also a fusional approach. What they insist, it’s kind of like a design principle, that we’re building a new software for government, and they said there’s the digital economy and there’s cybersecurity and defense.

Of course, there’s also an important set of competencies that reside in the Ministry of Defense and even in the paramilitary Defense League, but it’s all overseen and orchestrated from the Ministry of Economy and Communication.

What’s also interesting about the Estonian case, which illustrates the differentiation that I’m making here, is that that’s the same ministry that oversees not just the digital economy, but also cybersecurity.

You have someone who has the policy responsibility to be the Chief Information Officer of the republic.

Right. Returning again to the case study, because personally, it’s a fascinating case study, you have, for example, a person that I know very well, Luukas Ilves, the son of the longtime president, Toomas Hendrik Ilves, who serves as the government CIO.

Yeah, exactly.

It’s totally different, yeah.

Exactly. To a computer scientist, it’s the cryptographic protocols to protect data integrity, and then for…

They speak different languages, exactly. They speak different languages. Often, the people who work on digital economy don’t like to even use, in my experience, the word cyber, because it has the security and defense connotations.

That in itself is interesting, because those two broad sets of policy activity are often apart. They’re set apart.

What I mean by that, I mean that there has tended to be a single personality or institution that has the competence in the government to oversee the organization of the data economy and cybersecurity efforts.

Exactly. Yet what we see in the experience of small innovative countries like Estonia – and you’ll have to answer this for me, but my sense is that Taiwan is clearly moving in that direction, and in a sense is already there – is you see that there’s been more ...

Exactly. There isn’t an overarching policy framework for the digital economy.

Certainly, when it comes to the protection of the election infrastructure, because in the United States, you have a state-based, highly fragmented environment, that means that indeed…

In the United States.

This is very clearly the case in the United States, where you have these competencies for policy making distributed broadly across the Department of State, Department of Defense, Homeland Security, National Security Council, and so forth.

What we’ve seen is that large countries tend to have a diffusion of competencies for cyber and digital affairs across various government departments and agencies, which perhaps makes sense in a national context involving a diversity of interests and demographics and a sprawling government administration.

Some of the basic differences that I have observed, to address Jason’s question, is the difference between large countries like, say, the United States and Britain, and smaller nations like Estonia, for example.