MEDIANA Y MEDIA DE UNA CURVA DE DENSIDAD

The final branch of theory most pertinent and appropriate to this thesis is institutionalism. This approach is predicated upon studying the influence of institutional forces on social, economic and political phenomena. To bring clarity to this position, Hall and Taylor (1996) establish three “types” of institutional analysis: rational choice institutionalism, historical institutionalism and sociological institutionalism. While not going so far as to claim separate methodologies for the three types, Hall and Taylor argue that these were in fact three different approaches to the study of the role of institutional drivers of change and actor preference (Hall & Taylor, 1996; Steinmo, 2008, p. 118; Bache, George, & Bulmer, 2011). Although distinct, the three approaches are mutually complementary and share the same key trait: examining the influence of institutions on the interaction of rational actors. Where they differ is in the priorities they place on key features of that interaction, the preferences actors bring to it, and perhaps most crucially, on the precise nature of institutions.

Rational choice institutionalism (RCI) is predicated upon understanding actor preference within an institutional setting. Steinmo (2008, p. 162) argues that, in RCI, institutions frame individual actor behaviour and preferences. These preferences are exogenous: they are brought to the formal arena of interaction and are limited by it (Hall & Taylor, 1996, p. 943). The goals and values of the institution restrict the actors’ capacity to achieve all of their aims in what is known as “bounded rationality” (Peters, 2005, p. 56). Nevertheless, there is a certain utility to engaging with an institution and the actors within it: the reason actors choose to co-operate is because they get more with co-operation than without it (Steinmo, 2008, p. 127).

Sociological institutionalism (SI) by contrast focusses less on the formal structures of the arena of interaction, and describes as institutions anything that “provides [a] frame of meaning guiding human action” (Bache et al., 2011, p. 26). Accordingly, cultural constructs such as religions, ideologies, social class or any collection of “culturally specific properties” (Hall and Taylor, 1996, p. 946) are also institutional constructions and influence policy decisions. SI therefore blurs the lines between formal institutions and abstract culture, enabling a more nuanced study of political processes. Furthermore, it stipulates that institutions affect not only the calculations made by individuals in political interaction, but also their most basic preferences and even their identity (Hall & Taylor, 1996, p. 947) prior to their engagement with the institution.

Finally, historical institutionalist (HI)11 scholarship argues that key decisions made at the inception or initiation of an institutional body continue to influence the subsequent evolution of the institution and determine the tenor of future policy decisions made by actors (Peters, 2005, p. 71). Rather than treat institutions as arena structures where the political interaction is the most significant element, HI represents an attempt to show how political struggles are “mediated by the institutional forces in which they take place” (Thelen and Steinmo, 1992, p. 2).

The key aspect which differentiates HI from rational and sociological variants is that an HI framework “recognises that political development must be understood as a process that unfolds over time” (Pierson, 2000, p. 264). As shown in Chapters 1 and 3, this notion of temporal longevity is key to the structure and research framework of this thesis. Policies, political action, social strategies and solution-building may occur on an ad hoc basis in

11 _{The coining of the term “historical Institutionalism” is attributed to Thelen and Steinmo (1992, p. 1) in the} first chapter of their volume Structuring Politics: Historical Institutionalism in Comparative Analysis.

response to particular exogenous shocks. However, the tenor and nuances of the policy solutions adopted are based on norms and paths set down much earlier in the policy process, even at the establishment of the institutions in which they are developed. This leads to the concept of a “timescape”: the temporal features of decision-making that exist across the polity, politics and policy dimensions (Bulmer, 2009, p. 307; Meyer-Sahling and Goetz, 2009, pp. 326–327). Future policy decisions and actor preferences will be directly affected by, for example, the values and goals of the institutions set down at their foundation. In the case of the EU, the establishment of a socio-economic cyber security discourse makes such solutions more likely to be selected over other, more militaristic, national security-focused measures. This is an effect known as “path dependency” (Pierson, 2000; Thelen and Steinmo, 1992, p. 2).

Path dependency functions in a similar way to Haas’s process of functional spill-over (Haas, 1961, p. 368). Certain policies and modes of actor behaviour endure over time due to the difficulty involved in unseating long-standing attitudes and policies. Where path dependency differs from spill-over is that the initial task or decision is not expanded to incorporate functionally or ideologically similar areas. Instead, subsequent tasks and policy choices are dependent on the initial decision. Krasner (1984, p. 240) explains that when a policy is embarked upon, the institution enters a period of stasis, continuing on its path until an event or critical juncture shifts the policy into a new period of stasis: so called “punctuated equilibrium”. The punctuation point could be an external catalytic event generating particular policy decisions which deviate from the original equilibrium. In cyber security analyses, examples of such catalytic events include the 2007 cyber-attacks on the Estonian banking sector or the 2014 Snowden revelations. Chapters 8 and 9 examine a series of major events which occurred between 2007 and 2009 and which severely tested the strength of path dependent forces in EU cyber security.

In addition to path dependency, another key feature of HI is that actor preferences and decisions must be contextualised, and that context studied over a period of time. It is not enough to examine the immediate causes of a policy decision in situ. The full background of that decision must be understood. Such historical study of political interaction lends a certain empirical basis to institutionalism (Pierson and Skocpol, 2002, p. 2). What HI does is provide a durational context for political and social interaction which goes beyond the immediate cause of political decisions (Thelen, 2002, p. 93). Such a provision means that HI lends itself to the study of the European Union and EU policy-making in general – and this study of cyber security policy more specifically – as it enables a more nuanced study

beyond simple interest-based, cause-and-effect decision-making explanations. The institutional structure of the EU affects the decisions taken by the constituent actors involved in those institutions but that interaction takes place within the overarching political landscape established by the Union’s operational treaties.

In summary, HI as an approach to the study of politics

pays attention to real world empirical questions, its historical orientation and its attention to the ways in which institutions structure and shape political behaviour and outcomes (Steinmo, 2008, p. 118).

HI scholars are sceptical when seeking to establish large universal laws for actor behaviour. Instead they focus on contextualised theory-building to develop deeper understandings of causal relationships through “an intense and focused examination of…carefully selected cases” (Thelen, 2002, p. 95). For the study of cyber security, HI adds a long-term, longitudinal component missing from much of the current discourse in the field and other theoretical approaches.

Bannerman and Haggart (2014, p. 1) support the point that historical institutionalism is one of the dominant approaches in studies of the European Union. The topics analysed under its banner range from abstract, macro-level examinations of the logic of integration and decision-making (Kerremans, 1996; Pierson, 1996), through meso-level investigations of the governance of the single market (Bulmer, 1998) to analyses of specific policy fields such as telecommunications (Goodman, 2006) or the development of economic and monetary union (Verdun, 2015, 2007). Jupille and Caporaso’s (1999, p. 430) review of institutionalist literature and theory as applied to the EU concluded that the “institutional turn” of the late 1990s provided an ability to generalize about EU actor-institution relationships. This placed EU studies more centrally within the broader HI theory literature itself (Jupille and Caporaso, 1999, p. 441). HI is therefore an eminently suitable theoretical framework for examining EU policy development in general, and cyber security policy more specifically.

One final consideration brought to the fore by the range of issues to which HI analysis has been applied, and which highlights HI’s appropriateness to this thesis, is that it is not so heavily focussed on integration. Studies of the EU which employ HI, such as the work of Pierson (1996), Bulmer (2008; Bulmer and Padgett, 2005) or Hall (1998) acknowledge the importance of integration. Mühlböck and Rittberger (2015, p. 11) argue that HI has been prominently applied to this topic, in particular to studies of the Council of the European

Union and the Parliament. Integration is not however, the sole focus. As a result, HI is, as Bulmer (1997, p. 368) states, “agnostic on the end-goal of the integration process”. This agnosticism fits with the implicit denial of integration in the EUCSS itself. The main concern with employing neofunctionalism, intergovernmentalism or constructivism as theoretical frameworks for this research is those theories’ concentration on integration. Cyber security is not an integrationist policy in the EU. A theoretical framework which does not place so heavy a concentration on this aspect of EU policy, such as HI, is therefore more appropriate. The precise mechanisms of HI as an approach to the study of EU policy-making processes and phenomena will be set out in Chapter 4.