Corporate Hackers: Defense Contractors and Offensive Cyber Security Operations

• In Event: Technology and Public-Private Relations

Abstract

Research on cyber security has primarily focused on three types of actors: governments, multinational corporations not affiliated with states, and non-state collectives often referred to as hackers. Surprisingly, little research has examined the rapidly growing role that defense contractors—sometimes referred to as private military and security companies (PMSCs)—perform in global cyber operations. This inquiry addresses this gap in the literature by examining cyber operations implemented by corporations contracted by governments. The study develops a typology of cyber operations carried out by defense contractors by breaking down their activities into either defensive cyber, offensive cyber, or cyber analytics. Subsequently, data from the United States defense industry is used to compare spending in each of these service areas and demonstrates the offensive cyber is the fastest growing field in the industry. Finally, a principal-agent model is advanced to characterize the dynamics between governments and corporations in the cyber security industry. The model indicates that governments possess leverage over firms in the cyber security industry because barriers to entry are relatively low. However, the large number of companies in cyber field suggests that oversight of firms is difficult, thus increasing the likelihood that companies will not fully comply with contractual obligations.

Author

• Charles W. Mahoney, California State University, Long Beach