IEEE Technology and Society Magazine - December 2020 - 34

grant access to their systems in order to allow the vendor to set up and configure the technology - reducing
the risk of poorly configured systems that are more susceptible to data breaches.
This combination of the socio-cultural origin of the
agriculture sector and its lasting effect on the attitudes
of farmers in terms of data sharing on the one hand,
and the primary attack vector being focused on holding
data ransom, does not mean that this attack vector as

The socio-cultural context in which
technology is situated thus has an
effect on the impact of a cyberattack.

used by cyber criminals is suddenly gone - they will
still attempt to attack IT layers and steal data. But the
impact of this primary threat is significantly reduced, as
farmers would have no incentive to pay for, e.g., unlocking encrypted data as a result of ransomware attacks,
because other farmers would likely stand in solidarity
with them and freely share the data they would need to
continue operations.

Discussion-Where It Was Made Matters
Due to its success in increasing dairy farmers' productivity, sensor technology has been increasingly adopted
outside of Israel. However, due to the cultural origins of
the agriculture sector and its effect on farmers' attitudes, key cybersecurity threats faced by the technology
are effectively mitigated (i.e., ransomware threats
focused on " locking " away data fail because day-to-day
data is not seen as vital, and long-term data is freely
shared across the sector). This may not be the case in
other countries where the agriculture sector may have
developed in different ways, with radically different
social origins.
Returning to the U.K. context, in our interview the
vendor noted complications with the technology's initial
adoption in the U.K., as farmers' attitudes towards data
sharing are far less open. Sensor data is perceived to be
more commercially sensitive, as the sector does not
engage in similar open sharing as in Israel, evidenced
by the vendor's experiences and, e.g., industrial reports
focused on the U.K. context noting the " leaking of confidential farm data, " including livestock health and economic indicators, as a major threat [3]. This difference
in attitude means that unlike in Israel, U.K. farmers may
be less likely to allow the vendor access to their

information technology layer to setup and configure the
operational technology, increasing the risk of poor configurations being abused as a threat vector, and more
critically, increasing the impact of such risks, as farmers
in the U.K. more likely cannot fall back on other farmers' willingness to share data. We thus argue that
threats that did not make sense in one socio-cultural
context suddenly become relevant again. Compare for
example the threat of commercial sabotage, which was
mitigated in Israel due to the sector collaborating rather
than competing, now is no longer mitigated, being a
more valid threat, and thereby likely also attracting
increased attention from cyber criminals as an opportune attack vector.
Thus, it seems that adoption of technologies built in
one socio-cultural context into another comes with consequences for cybersecurity, if key assumptions for the
safe and secure operation of the system in context are
not made explicit. This case study has raised only one
example of such socio-cultural factors, notably, the
openness of a sector to share, rather than compete, and
how it changes the impact of cyberattacks. This changes the way that risks should be analyzed. Typically, risks
are assessed by quantifying their impact (from, say, negligible to catastrophic) and their likelihood of occurring
(from, say, rare to certain) (cf., [7]). For example, if we
know cyber criminals are actively using ransomware
attacks to lock up IT layers in the food sector, and we
assume that devices in that layer are poorly protected
against key delivery vectors (e.g., people are not trained
to detect phishing, and firewall and antivirus software
are not kept up to date), we could say it has a high likelihood. But what would the impact be? If they succeed in
an attack, and lock up data, farmers would effectively
shrug, replace the computer rather than pay the ransom, and go about their day, using data willingly shared
by other farmers. More realistically, the likelihood of the
attack is affected by the socio-cultural context of the
technology as well, as farmers are happy to allow the
vendor to securely configure the technology, thereby
reducing the likelihood of a poor configuration being
abused as a threat vector.
The socio-cultural context in which technology is situated thus has an effect on the impact of a cyberattack.
But the very likelihood of it from the attackers' point of
view may also be affected, as cyber criminals will (eventually) realize their actions are fruitless in this context,
motivating them drop such attack vectors for better
opportunities. Thus, in order to assess the socio-culturally dependent risk of a cyberattack, both impact and
likelihood need to be understood in the context of the
sector and the attitude of people within it. This raises an
important call for research in protection of national
infrastructures, or indeed any sector, to better understand

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

∕

DECEMBER 2020

IEEE Technology and Society Magazine - December 2020

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2020