Louise Marie Hurel (@LouMarieHSD) is a PhD researcher in Data, Networks and Society at the London School of Economics’ Department of Media and Communications. Her research focuses on risk, cybersecurity governance, and incident response. Louise is also Special Digital Security Policy Advisor at Instituto Igarapé’s Digital Security Programme, where she leads multiple efforts on cyber policy engagement at the national, regional and international levels. Her research interests include cybersecurity and Internet governance, platform and infrastructure studies, cyber norms, non-state actors, computer-mediated communication, critical security studies, and risks.

Laurin Weissinger (@LB_W_) is a consultant and researcher in the cybersecurity space. Apart from his long-term experience in system architecture, operations, and security management, he also conducted years of research into the problem of trust assurance in cyber security, (cyber) security threats more generally, cooperation in international and organizational cybersecurity, risk analysis, security policy, as well as cybercrime and anti-abuse. He completed his PhD at the University of Oxford on the question of trust and risk in the cybersecurity field, and has since taught at Yale Law School and the Fletcher School, Tufts University. Laurin currently works with industry groups M3AAWG and APWG as expert advisor and research fellow, respectively.

‍

Incident responders have long played a special role. Tasked with responding to security incidents, they are crucial in keeping the internet and other key systems operational. We argue that while incident response may have started as an aspect of routine, maintenance work, governments and private companies have contributed to an institutionalization of these practices and the relationships between incident responders. This paper discusses various pressures and their impact on the practice of incident response, namely professionalization, regulation, and political influence. The paper considers various players and how their interests and activities impact on incident response practice, politics, cooperation between different teams. We observe that the practices of incident responders are changing; but more so, the political position and power of incident response teams, as well as their ability to cooperate, are being affected by government and private action.