Digital Governance Decision-Making in the Aftermath of Cybersecurity Crises, Lessons from Estonia

Authors: Logan Carmichael

Abstract:

As the world’s governments seek to increasingly digitize their service provisions, there exists a subsequent and fully valid concern about the security underpinning these digital governance provisions. Estonia, a small and innovative Baltic nation, has been refining both its digital governance structure and cybersecurity mechanisms for over three decades and has been praised as global ‘best practice’ in both fields. However, the security of the Estonian digital governance system has been ever-evolving and significantly shaped by cybersecurity crises. This paper examines said crises – 2007 cyberattacks on Estonian government, banks, and news media; the 2017 e-ID crisis; the ongoing COVID-19 pandemic; and the 2022 Russian invasion of Ukraine – and how governance decision-making following these crises has shaped the cybersecurity of the digital governance structure in Estonia. This paper employs a blended constructivist and historical institutionalist theoretical approach as a useful means to view governance and decision-making in the wake of cybersecurity incidents affecting the Estonian digital governance structure. Together, these theoretical groundings frame the topics of cybersecurity and digital governance in an Estonian context through a lens of ideation and experience, as well as institutional path dependencies over time and cybersecurity crises as critical junctures to study. Furthermore, this paper takes a qualitative approach, employing discourse analysis, policy analysis, and elite interviewing of Estonian officials involved in digital governance and cybersecurity in order to glean nuanced perspectives into the processes that followed these four crises. Ultimately, the results of this paper will offer insight into how governments undertake policy-driven change following cybersecurity crises to ensure sufficient security of their digitized service provisions. This paper’s findings are informative not only in continued decision-making in the Estonian system but also in other states currently implementing a digital governance structure, for which security mechanisms are of the utmost importance.

Keywords: cybersecurity, digital governance, Estonia, crisis management, governance in crisis