When Cybersecurity Meets the Regulatory State: Case-Study Analysis of the Israeli Cybersecurity Regulatory Regime

Abstract

The literature on risk and regulatory governance has barely heeded the institutionalization of cybersecurity regulatory practices by national policy regimes. As the role of the state in cybersecurity governance is gradually expanding, we still lack an empirical and theoretical understanding of how the regulatory state copes with the cybersecurity governance challenge. Therefore, we ask how the role of the state has expanded in leading cybersecurity governance efforts? What characteristics of cybersecurity governance challenge the regulatory state? And how the Israeli cybersecurity regulatory regime has been addressing those challenges? We trace the literature on the new roles of the state in cybersecurity governance and build an analytical framework based on the challenging characteristics of cybersecurity governance. We then conduct an in-depth case study analysis of the Israeli cybersecurity regulatory regime. In contrast to arguments about the inability of the state to cope with dynamic technological changes, we find that the state is ever more relevant, restructuring the government and creating new methods, institutional settings, and incentives to cope with the cybersecurity governance problem. The intersection of cybersecurity with the regulatory state creates new avenues of regulatory development, shedding light on new directions for regulatory governance in the digital age.