IEEE Technology and Society Magazine - December 2020 - 29

of such security - the effective production of sufficient food, or food availability. Technology has always been an integral part of humanity's efforts to
optimize food production processes. Already thousands of years ago, farming tools such as plows were
used, first by humans, then with animals, to improve
conditions for planting crops and thereby increase
yields. Modern food production has seen an explosion of both the amount and the sophistication of
technologies used, and has increasingly moved to
sophisticated digital technologies such as robots,
sensor-driven systems, drones, and automated image analysis [11].
Such digital technologies, for all the benefits they
bring, also come with new challenges, including that of
ensuring their " cyberbiosecurity " - ensuring that there
are no vulnerabilities at the intersection of their cybersecurity, cyber-physical security, and their biosecurity
[27]. Recent research has highlighted the variety of
cybersecurity threats and attack vectors the food sector
faces (from attacks on farm data or networking and
equipment, to the wider supply chain, and even terrorism, cf. [3], [14]), as well as having documented data
breaches in agricultural organizations, and finding that
many farmers and agribusiness owners had been affected by computer security incidents [16]. The consequences of attacks on a digitized food sector may not be as
immediately obvious as the impacts for other critical
infrastructure (e.g., sudden loss of power, disruption of
transport). But food availability may likely be impacted
as a result of cyberattacks through a delayed effect. A
cyberattack may for example cause food production
capability to be lowered, and thereby set off a ripple
effect moving through the food production chain and
related infrastructures of processing and distribution,
until eventually consumers are faced with empty
shelves in supermarkets [21]. Both the actual technologies used for food production (operational technology
or OT) and the computer systems that surround it
(information technology or IT), need adequate protection from accidental and malicious attacks that can disrupt food production processes. Such attacks have
become increasingly common, as evidenced in increasing numbers of phishing and ransomware attacks on
farms and agriculture companies, such as the ransomware attack on the U.K.'s National Milk Group in 2019.
However, little attention has been paid to the socio-cultural context in which digital technologies for food production is developed and used, and how that may
mitigate or worsen potential attack vectors and the
impact of concrete threats.
To that end, this article has two purposes: 1) to start a
discussion on how the food sector is stimulated to
increasingly adopt new digital technologies, without
DECEMBER 2020

∕

having as much opportunity to consider its cybersecurity
implications, and 2) to shed light on how socio-cultural
context is intertwined with the development and use of
cyber-secure technologies, and how unforeseen risks may
arise when technologies developed in one socio-cultural
context are adopted in others. We do so by analyzing the
conflicting demands on use of technologies in the food
sector in the U.K. on the one hand, and lack of support for
its cybersecurity on the other hand, followed by an exploratory case study of what drives the development and use
of a technological solution for dairy farming developed in
Israel, now increasingly adopted in the U.K.

The Digitized Food Sector: Technology First,
Cybersecurity Later?
The U.K. government, through the Department for Environment, Food and Rural Affairs (DEFRA), heavily promotes the adoption of operational precision agriculture
technologies in order to stimulate increased efficiency
of its food (production) sector [17]. Research has shown
that such technologies exhibit rapid adoption patterns
[24], meaning that once some farms adopt a particular
type of technology, that new technology is likely to
quickly spread throughout the sector and be adopted by
other farmers. Moreover, the sector typically favors technologies that can be readily bought and implemented
" off the shelf, " which has been shown to cause rapid
wide-scale adoption [28]. The food sector is thus pressured to quickly adopt new technologies both vertically
(i.e., the government stimulating adoption of new technology), and laterally (i.e., competitors adopting new
technology), giving it little time to perform meaningful
in-depth reflections on how these technologies will
change the nature of their work and what new risks and
threats it may bring.
In 2017, the U.K. Government explicitly called to
defend the food sector from deliberate attacks, including " cyber enabled industrial espionage, or hacking -
gaining unauthorized access to computer systems,
perhaps with malicious intent " [18]. Yet, even though
there is a relevant EU Directive on security of network
and information systems for critical national infrastructure (the " NIS " Directive), the U.K. Government has not
included the food sector to fall within its remit. While
farmers and other stakeholders in the food sector have
explicitly called for the NIS directive to apply to the food
sector in order to increase cybersecurity standards,
doing so is postponed until the legislation's first re-evaluation [19]. Moreover, while relevant Publicly Available
Specifications (PASs) sponsored by the U.K. Government
[18] describe several cyber threats that the food sector
needs to deal with (e.g., DDOS attacks on web-based
ordering systems, loss of GPS-based navigation, ex-filtration of sensitive data due to phishing emails), little

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

29
IEEE Technology and Society Magazine - December 2020

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2020
