This was the subject of an interdisciplinary workshop in October 2024 in Reykyavik. It was jointly organised by the University of Iceland (Háskóli Íslands) and The Open University, as part of a NERC-funded project on Socio-technical Modelling of Resilient Arctic Communities. In cybersecurity terms, Iceland is geographically isolated and Icelandic society has unique characteristics such as high levels of interpersonal trust and digital literacy which makes it an interesting case study in socio-technical resilience. Attendees agreed that Iceland’s situation and approach provided much food for thought.
There was a thought-provoking and varied set of presentations across two days of discussions, interactions and sightseeing. The broad range of disciplines represented by attendees meant that there were many cross-disciplinary perspectives in the room, including software engineering, social sciences, education and the humanities. And there were representatives from public and private organisations with particular insights and experiences to share.
On the first day we heard reflections on culture as a key element of bottom-up resilience from Dr Sigurður Emil Pálson (Operations Branch of the NATO CCDCOE), about “islandness” from Dr Sarah Robinson[1] (University College Cork, Ireland), and the power of place from Prof Mark Levine (Lancaster University, UK). On the second day Dr Melissa Anne Pfeffer (Icelandic Met Office) shared insights on volcanic hazards and risk assessments, and how these may be modelled, Theódór Gíslason (Defend Iceland) spoke about responsible disclosures of security vulnerabilities, Dr Amel Bennaceur (The Open University UK) presented her work on simulation of disaster situations, and colleagues Marianne Lindroth and Ottilia Nikula from Finland discussed national cyber security policies and strategies for training of “cyber citizens”.
At the end of the second day, everyone was asked to suggest three key takeaways from the workshop, written on post-it notes, as is the tradition :-). The full set of take-aways is available for download, and the word cloud below highlights the most popular themes.
A word cloud highlighting key themes of the workshop as identified by the attendees
There was a lot of interest in the notion of “islandness” and its implications for understanding commmunity. We discussed the fact that “island” can be interpreted in many different ways – as a community that’s isolated in one way or another – or perhaps as a coherent community, whether isolated or not. Living on an island is associated with certain characteristics, such as the relationship with the sea. The sea can be regarded as both an obstacle that isolates islanders from “the rest”, but also as a means of connection because the sea is a route to many other places. Islandness creates a tight knit community, with those who are “in” and those who are “out”. This notion resonated with many attendees, particularly those who had experience of other rural locations or close communities.
The strength of communities was another common theme that was discussed, leading to an observation that there isn’t one prescribed way to maintain resilience. Instead, communities find their own way, shaped by their own culture, identity and place. The impact of culture in socio-technical resilience was highlighted in different contributions. Culture helps to establish coherence and informs everyday actions, responses and “the way things are done around here”, which in turn informs how resilience is maintained. One observation about culture that is particularly relevant to software teams is that in small communities formalising things may not be an effective use of effort because “everyone knows” (see below).
Scaling, whether large or small, and its effect on resilience and security are often overlooked but both ends of the spectrum bring challenges. We also shouldn’t forget characteristics of the physical space in which activity takes place, and their impact on cyberspace. In this case, Iceland’s geographical isolation may increase societal vulnerability due to its reliance on offshore cyber-physical systems, and the ongoing volcanic activity generates a particular attitude towards risk.
The notion of “place” captures some of these attributes, but place can be interpreted as context too – within a community, within a particular domain, and with particular physical or virtual constraints
The workshop provided insights into the interplay between all of these aspects, and their impact on resilience – the impression was of a truly socio-technical perspective on these issues, together with a heightened awareness of the role of place and physical characteristics. The broad nature of socio-technical resilience and its role in cybersecurity underpins the need for multi and interdisciplinary work in resilience research, and the importance of suitable training and education.
Putting the discussions in the context of socio-technical resilience in software teams, a further set of points stand out:
- The idea of resilience goals has not been widely recognised in the context of software development, but in the contexts discussed at the workshop, resilience goals are recognised and understood. Resilience goals were particularly clear in the talks from the Met Office and NATO. In a software development context their importance is not just to identify resilience but also for teams to know what to prioritise – and to be alert to the subgoals other subsystems (teams) might prioritise that would compromise the organisation’s overall resilience.
- Measuring and monitoring, for example of weather patterns and volcanic activity, are important in Iceland to maintain resilience. But as mentioned above, resilience goals in those contexts appear to be fairly clear and so there is an understanding of what to measure and why. In the context of software teams perhaps resilience goals are not so explicit and hence knowing what to measure or assess to determine or maintain the resilience of teams is trickier.
- In small communities it may not be effective to expend effort in formalising things – instead formal structures are replaced by informal networks with relatively little documentation because “everyone knows” what to do – which is the basis of culture. In the small community that is a software team, this notion has been researched but its implications for resilience are not yet fully explored.
- Writing down formal instructions or plans has limited applicability in software teams because instructions can never cover all the possibilities – some things have to be left to human judgment at the end of the day. This may have implications for automation and machine learning too – it’s not about rules but about making connections, balancing and “understanding” – being driven by resilience goals to prioritise the right things.
- Self-sufficiency is important and yet it may be compromised if too many external dependencies exist. Within many software teams there is a desire to be self-sufficient as much as possible, but with the explosion in technology underpinning software systems and the inter-connected nature of software endeavours, this is hard to maintain. Dependencies need to be carefully acknowledged and managed.
- Which is the key to socio-technical resilience: preparedness or planning? This came out particularly in the presentation from the Met Office, although it also resonated with others. For some situations planning isn’t enough. Planning is inflexible but preparedness is flexible. You plan for specific events (‘what if’s) but preparedness allows you to handle unexpected events. The Met Office does a lot of modelling for lava flows, for example, but when an eruption happens there are always unexpected consequences. Modelling helps, and prompts some actions to be taken, but it’s never quite as the models predict. Preparedness also requires people to be adaptable, able to handle changes in day-to-day situations, and to trust those around them.
[1] Sarah Robinson, Nicola J. Bidwell, Roberto Cibin, Conor Linehan, Laura Maye, John Mccarthy, Nadia Pantidi, and Maurizio Teli. 2021. Rural Islandness as a Lens for (Rural) HCI. ACM Trans. Comput.-Hum. Interact. 28, 3, Article 20 (June 2021), 32 pages. https://doi.org/10.1145/3443704