Risk and Extortion XLII: Cyberrisks and Cybersecurity 2

Blind Spots in the Sociology of Risk: Real Abstraction and the Technological Agency of Emerging Computer Viruses

It is difficult to speak of “the” Sociology of Risk as if it were a unified field of social science applied to the specific phenomenon of “risk.” Deborah Lupton’s (1999) quite useful theoretical tetrad—which she derived from a 2×2 matrix based on two dimensions: (1) realist versus constructivist and (2) pragmatic versus critical—also contains the more generic opposition between macro-social analyses of risk society and risk culture and micro-social and psychological analyses of risk perceptions and risk behaviour. She uses this matrix to classify different theories and to position herself in the fourth quadrant of critical constructivism, for which she deploys the Foucauldian concept of governmentality to bind a more generic, macro-sociological conception of disciplinary power to a more specific, micro-sociological analysis of neurotic self-regulation.

Lupton’s work was published at the beginning of the phase in which the digital revolution was being rolled out beyond the military and scientific communities to become a major player in the everyday lives of billions of people worldwide. Academics had already been experimenting with the internet for a few decades by then but, by and large, struggled to come to terms with the revolutionary character of digitalisation (Kittler, 2010). For example, while there was a growing interest in digital media, the discussions primarily focused on ideology, misinformation, and—more recently—fake news. These were already part of the established repertoire of critical media studies. The digital aspect was merely considered a visual medium that changed few-to-many broadcasting into many-to-many narrowcasting. The risks considered within this frame were primarily concerned with the formation of “opinion bubbles” and “echo chambers.”

These risks are not to be underestimated, as they lie at the heart of the rise of kakistocracy (Van Loon, 2024). In particular, the collapse of an institutionalised public sphere has been detrimental to the functioning of journalism as a “Fourth Estate.” In addition, the enabling of a sense of pseudo-anonymity as a condition for participating in digitalised communications seems to have had a detrimental effect on sustaining a shared political subjectivity based on honesty, loyalty, truthfulness, honour, fidelity, and charity. Acting in bad faith (e.g. trolling and gaslighting) has become the norm.

Indeed, even in more traditional critical media studies, the specificities of digital communication media had been noticed. The vast majority of critiques, however, did not attribute these specificities to digital technologies themselves. At best, the collapse of the public sphere and of an enlightened, humanist political subjectivity was associated with the affordances of digital media—as instruments facilitating the interests of powerful, rich, white men. That is, the interests that could be recognised were exclusively human.

However, at the same time that media studies became concerned with the digital, it also became more obvious that other risks were emerging. Attached to the prefix “cyber,” derived from a separate tradition in information and communication science called cybernetics, a different conception of risks had been acknowledged—one that almost completely bypassed the canons of the sociology of risk. These risks did not, for example, appear in Lupton’s tetrad, nor did they feature in Ulrich Beck’s World Risk Society (2007).

Thirty years ago, the story of emergent computer viruses was very contagious on the growing market of personal computers. Personal computers were seen as being at risk of infection by viruses, in close analogy to HIV/AIDS: unprotected sharing of data was seen as the main cause of viral spread. Needless to say, these were golden times for developers of antivirus software. At the time, we did not need to know much about the motivation of computer viruses: they merely existed to destroy. Another analogy comes to mind: the description of terrorists is similar. We do not need to know much about them, as their only motivation is destruction derived from an essence of evil.

The idea of autotelic violence that is attached to terrorism renders the agency of terrorists obsolete. Any attempt to defy the notion of the autotelic element of terrorism can be reconstructed as its justification—i.e., as an extension of terrorism—even if the intention is legitimated as prophylaxis. In this respect, terrorists are treated like viruses. It seems of very little interest to ask “What does a virus want?”—even though this is exactly what interests virologists when they try to isolate and cultivate viruses. For immunologists and epidemiologists, this question is also of major interest when seeking to establish how to enable organisms to deny viruses what they want. The reason why this question was never raised in reference to computer viruses is because they are not framed as virulent life forms but instead—like terrorists—as instruments of destruction. This is why there is no virology, immunology, or epidemiology of cyberrisks.

The aforementioned separations between nature and technology, materiality and sociality, and technicity and humanity explain why computer viruses and biological viruses are only considered analogically, and why the social sciences and humanities have no interest in their agency. The autotelic thrust of destruction is merely considered a risk as long as it remains unknown and undetected. The securitisation of such risks consists of identification, detection, quarantine, elimination, immunisation, and prevention. These are mere technical operations that only require limited risk awareness among users. The expansion of cybersecurity against this type of cyberrisk in the realm of immunisation and prevention takes place through digital automation—for example, through firewalls and continuous virus scanning.

As a first manifestation of cyberrisks, computer viruses seem to have very little in common with the main concerns of either the sociology of risk or the sociology of media. They are more insidious, more indiscriminate, and seemingly less political—and perhaps therefore of little sociological interest. What made computer viruses uninteresting was perhaps that they did not fit the main theoretical framings around realism versus constructivism, critical versus pragmatic, and macro versus micro. They are obviously constructed but also very real. They do not seem to fit any political interests apart from chaos and destruction, and their anomalous character was treated as a mere reflection of criminal intent that shifts attention away from the entity toward the mindset of its creator, which itself has no discernible function for society.

The anomalies surrounding cyberrisks such as computer viruses, worms, and trojans had primarily become invisible because the social sciences and humanities had by and large turned away from historical materialism. Instead, the historical and material elements were increasingly split between, on the one hand, a distinctively humanist, constructivist understanding of history and, on the other, a distinctively ahistorical “new materialism.” The former pursued the political aspects of critique in relation to human/social interests (e.g., media representations); the latter became conducive to debates over technologies enabling or disabling social change (e.g., democratisation). Sadly, both sides of this split ended up in the hubris of post-humanism and failed to recognise that they had been distracted from fundamental questions about the conditions under which “we” were making history.

In Risk and Technological Culture (Van Loon, 2002), I attempted to integrate various concerns related to risk into a more generic historical-materialist framework. This was a first attempt to clarify the integrative function of technology by incorporating Actor-Network Theory into the sociology of risk, without abandoning a historical-materialist critique of humanism and social constructivism on the one hand, and the celebrations and condemnations of post-humanism on the other. At that time, it was not fully clear to me, however, that cyberrisks are more than merely a manifestation of the contradictions of capitalism. This is because I had not yet thought through the implications of the Marxist critique of real abstraction.

Most Marxists working on the theory of real abstraction understand commodity fetishism in relation to human labour—that is, fetishism is the negation of human labour as value creation (Postone, 1993). This also explains why they do not distinguish clearly between capitalism and industrialism. With the advent of automated production and digitalisation, as well as the decline of industrial dominance in “post-industrial society” (Touraine, Bell, Kerr), this conception of real abstraction seems to have lost its appeal. In sociology, this was reflected in a sharp decline of interest in class analysis as fundamental to understanding social order, in favour of analyses of class as epiphenomena of cultural practices.

However, there have always been dissident voices that tried to avoid an exclusive focus on the Industrial Revolution as the chronological starting point of capitalism. One of them was Alfred Sohn-Rethel, who reflected on the intersections between manual and intellectual labour to understand practices of real abstraction. His focus was on the role of money in enabling modern philosophy—particularly that of Immanuel Kant—to engage in practices of conceptual abstraction. The role of money in both production and exchange, enabling an abstraction of value that becomes real through its use, allows the quantification of passionate interests—needs and desires—as well as (paid and unpaid) labour, energy, raw materials, space, and time (e.g., speed).

Real abstraction enables the quantification (nomos) of everything. This is the birthplace of risk, of debt, of governmentality, of security, of insurance, of digitalisation—but also of alienation, proletarianisation, class struggle, national sovereignty, gender, sexuality, race, etc. As we shall see below, artificial intelligence is also a product of real abstraction.

Whereas those working in Marxist traditions of historical materialism would still prefer to use the term capitalism—Matteo Pasquinelli, for example, refers to cyberfossil capitalism—it is not difficult to see that real abstraction serves not only the interplay between modes of production and consumption. A third mode should be introduced: namely, the mode of securing the conditions of this interplay. What secures access to energy, raw materials, food, labour, etc.? Securing access to extractive resources is related to territorialisation, and territorialisation is related to the threat and/or exercise of violence. That is, the interplay between modes of production and consumption is itself deeply intertwined with modes of territorialisation.

Cyberrisks such as computer viruses, worms, and trojans, however, are vectors of deterritorialisation. They belong to what Deleuze and Guattari (1988) have called the nomadic war-machine. This may also explain why the social sciences and humanities have not shown much interest in cyberrisks of this kind: their logic operates outside of the state apparatus. The state apparatus deploys technologies of securitisation through containment, immunisation, and prevention—all conceptions derived from striated space: boundaries, walls, fences, gates, barbed wire, buffer zones.

It is now also clear why the absence of a sustained invocation of real abstraction within the sociology of risk has created a blind spot toward cyberrisks. Sociology has come into existence as an extension of the state apparatus, seeking to extend its capillaries of power into the fabric of society through social engineering. This is why Lupton was convinced that her “critical constructivism,” derived from Foucault’s critique of governmentality, represented the zenith of the sociology of risk. It had successfully identified the function of risk for the state apparatus as a means of expanding control through securitisation. However, because it failed to consider the primacy of real abstraction, it regressed into liberal humanism by misunderstanding commodity fetishism as a mere symptom. It had not, for example, considered the libidinal economics of anxiety, neurosis, and fear as produced by the dialectic of Enlightenment. Instead, like Foucault himself, the critique regressed into liberal individualism.

The problem with this regression is that it can only criticise conceptions of risk as acts of fear-mongering, designed to control individuals (cf. Furedi, 2001). This is not as critical as its proponents may suggest. This is because it merely ends up suggesting that everyone should decide for themselves whether to engage in acts of securitisation or not. That is, risk management becomes a matter of individual choice. As virulent epidemics have shown, this is exactly what many viruses want. Furthermore, individual securitisation often becomes a mere practice of consumption. That is, many critiques of governmentality and the culture of fear completely fail to engage in a critique of commodification. At the heart of technological culture, commodification is a manifestation of real abstraction.