Jusletter IT

Twenty-five years ago in 1997 I wrote a list of the significant risks of information society from data and information security perspective. Risk mapping was part of a legal study on information security carried out at the University of Lapland together with Ahti Saarenpää, Mikko Sarja, Viveca Still and Ruxandra Balboa.¹ Study was commissioned by the Government of Finland, Ministry of Finance to have a broader view to information security and to have an informed discussion on the legislative and regulatory needs on information security. Studying information security and risks related to ICT and data processing was seen then and continues to be seen a task of the legal informatics.² I attach myself to the Nordic or Scandinavian tradition of legal informatics launched by Peter Seipel, Jon Bing and Peter Blume and in Finland by Ahti Saarenpää and later his students including myself.³

Variations of legal informatics provides disciplined methods and research traditions to analyse interactions between data and information, information and communication technology (ICT) and law.⁴ Addressing unknown terrains between law, information and information & communication technology ICT have been the benchmarks of legal informatics in the efforts to find general logical solutions to formalise legal knowledge and reasoning to computable formats, to address risks in for traditional lawyers cumbersome phenomena like predictive modelling, or to analyse and develop automated rule-making or quantitative analyses of legal materials.⁵ Legal informatics is a gentle enlightener of practitioners and legislators.⁶ Legal informatics acts as a conscience for the deep impacts of the ICT and data processing to law and needs of legal protection in constitutional rule of law.⁷

In this contribution I will revisit the list of risks recognised in our 1997 study on information security and I will inquire about the current socio-technical conception of risks to which cyber and information security is situated in law. On the bases of that I will ask how legal informatics in socio-legal analyses will help future-proofing legislation. While doing this I will also make observations of the journey of thinking from technical data security to societal cyber and information security currently legislated in law and unfolding in the offing.

The idea of the list of information society risks in our 1997 study was that through a macro-level, societal risk conception, information security could be placed into a wider context for better analyses of the future legislative needs.⁸ ‘Leitmotiv’ of our information society risk list and the whole information security study was strikingly similar to the study carried out 23 years later by the Joint Research Centre of the European Commission: Cyber and information security is an essential societal need.⁹ Regulatory theory and its conceptions of risks and the legislative studies concerning Nordic private law were taken as a primary theoretical reference for our 1997 study.¹⁰ Following Helmut Willke we saw the role of legislator and government to provide governance and management of these risks based on law.¹¹ The quest for holistic approach to information security and beyond was rare at that time. In 2020s holistic approaches to cyber and information security are mainstream of cyber and information security thinking.¹² The list identified 20 risks of an information society. Risk list was a hermeneutic interpretation of the research data consisting of official policy documents and legal sources and legal literature on risks and regulation.¹³

The Organization for Economic Co-operation and Development OECD, which is influential in digitalization and information & digital security policies, issued its first recommendation on the security of information systems already in 1992.¹⁴ Ten years later the OECD updated that recommendation and enlargened its scope of application to cover the security of information networks. Development of the OECD recommendations tells about a considerable widening of the perspective and understanding of the concept; a move from technical protection of some elements of data in an individual information system to a broad, multi-angle principle of digital security as a fundamental element of the quality of infrastructures and services in society.¹⁵ In 2003, the OECD published an extensive assessment of emerging Systemic risks in the 21st century. Report discussed large-scale risks and analysed changes in the quality and spreading of risks and the needs for new perspectives in risk management at the societal and international level.¹⁶ Differentiation between systematic risk and systemic risk are essential in law, policy and management. Systemic risk generally refers to a situation where a vulnerability or disruption extensively spreads in networks and causes serious problems to the functioning of an entire sector or the society as a whole.¹⁷ An individual design or underlying thinking failure or vulnerability or programming error or pertinent human skills or attention problems are sources for systematic risks leading to repeated security incidents or other harmful events.¹⁸

Unknown, complex and turbulent problems may have wide consequences and for which new kinds of governance approaches are needed. These problems have become increasingly visible.¹⁹ Challenge and possibility to cyber and information security follows from an increasing human – machine – confluence and collaboration. Security relies there partly on automatic monitoring. Human – machine interaction can be a significant source of vulnerabilities and security incidents. In that some traditional human controls simply would not work any longer.²⁰

OECD changed its information security recommendation into a recommendation on digital security risk management in order to promote social and economic prosperity in 2015. This signals a final turn from a technical issue related to availability, integrity and confidentiality of information systems and data to a wide and inter-connected societal and economic issue. Cyber and information security is a multidimensional issue with individual and organizational micro-levels, administrative branch or subsector of society wide meso-level and whole-of-society macro levels.²¹ Later OECD updated recommendation on the protection of critical infrastructures.²² In 2022 the OECD adopted a package of four recommendations on various aspects of digital security updating or replacing earlier policy instruments and underlining digital security as a strategic whole-of-society and whole-of-government issue. Underlying ideas are the inter-connectedness of digital security and the need to develop trust to and within the digital environment and the embed balanced equilibrium between usability and security by security-by-default to infrastructure and product and services of digital society. Cyber and information security is a fundamental quality element of all infrastructures.²³

The role of law extends and the law as a system of society reaches beyond the issues of regulation and governance: law is an institutional system representing and realising liberty and justice.²⁴ The legislator reacts to risks and uncertainties by principles and rules on risk-sharing and by setting specific risk management and compliance requirements as legal duties. The EU General Data Protection Regulation (EU) 2016/679, the GDPR, represents an explicitly risk-centric approach with also some societal precautionary approaches continuing from its predecessor, the EU Personal Data Directive.²⁵ The Personal Data Directive art. 17 and art. 32 of the GDPR contain a general information security provision. Due to wide definition of personal data in art. 4 (1) of the GDPR – ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified – the GDPR is pretty much the law of nearly any data processing or data medium and information management system. The GDPR recognises also network and information security work as a legitimate objective for processing of personal data for secondary purposes. The GDPR is more concrete than its predecessor with examples of possible security techniques such as pseudonymisation and encryption. The GDPR links information security explicitly to the rights and freedoms of data subjects. The technical and organisational security measures in art. 32 of the GDPR are connected to general risk management and risk assessment duties further specified in art. 35 on the data protection impact assessments.²⁶ The information security in GDPR is an element of data protection by design and default in art.25, protection measures in art. 22 on automatic decision-making and the documentation required for the principle of accountability, which in art. 5 (2) is elevated to one of the general data protection principles. The principle of accountability serves also as legal foundation for an obligation to organise auditable and systematic network and information security work at the data controllers and processors. Art. 25 and 32 of the GDPR lay down foundations for security by design and default in processing of personal data and in ICT systems potentially processing such data. Duties of notification of personal data breaches to supervisory authority and to data subject pursuant to art. 33 and 34 are novelties in the EU-wide legislation in the GDPR compared to Personal Data Directive. Conceptually the information security in art. 32 (1b) of the GDPR includes the recovery from vulnerabilities and the elements of wider resilience.

The GDPR is not the only widely applicable cyber and information security provision in the Union legislation. EU Directive on privacy and electronic communications 2002/58/EC includes significant network and communications security provisions.²⁷ European Commission has proposed to replace directive with Regulation on Privacy and Electronic Communications in order to have a coherent set of legislation with the GDPR but the legislative procedure is delayed and still on-going.²⁸ The Union legislator has enacted EU-wide cybersecurity legislation by adopting NIS Directive (EU) 2016/1148 and EU Cyber Security Act (EU) 2019/881.²⁹ Cyber Security Act establishes ENISA as a permanent Union agency and sets a voluntary security certification scheme. NIS Directive explicitly departs from the vital role of the network and information security for societal and economic activities. It emphasises the magnitude and impact of the security incidents and the specific concerns and interests on the security of essential services and infrastructures. NIS Directive is explicit on the systemic risks, inter-connectedness of and dependence on technology across essential sectors. It seeks to enhance good security management practises related to digital systems and information processing.³⁰

The European Commission presented a proposal for NIS2 Directive in 2020 in order to include more sectors and harmonise further security requirements and to bring further change of mind-set in legislation and regulation.³¹ NIS2 Directive is linked with wider topics of strategic and operational resilience and quality of the infrastructures, which all are part of the security and well-functioning of the markets in the European Union. To these objectives also the European Commission proposal for CER Directive seeks to contribute as part of a wider Security Union Strategy.³²

Several sectorial Union acts contain significant provisions relevant to cyber and information security directly or indirectly via generic risk management and conformity requirements.³³ Union however lacks a coherent policy and legislation setting horizontal cyber and information security requirements.³⁴

Similar lack exists in Finland. The recommendation in our 1997 information security study of the need of a general act of parliament on information security was ignored at the time albeit many elements of the legislating on information security beyond the implementation of that time Personal Data Directive was included to sectorial legislation. Concerning Finland’s public sector the Openness in the Government Act (621/1999) originally included section 18 on the good information management practise including inter-operability of information systems and information security and the Finland’s Personal Data Act had a general principle and objective of good information processing practise as its parallel covering both public and private law. Provisions in section 18 of the Openness in the Government Act suffered from weak enforcement. The implementation was not sanctioned sufficiently strictly. The provision had the modern feature of connecting information security to a wider principle of good information management practise, which was also open for the development of technology and ethics of data processing.³⁵ This was a feature fully in line with much later NIS Directive.

Difficulties in the inter-operability of the public sector ICT systems led to the enactment of Act on the Steering of the Public Administration Information Management (634/2011), which deployed systematic enterprise, process, information and systems architecture model. This act proved to be too difficult to apply due to the demanding enterprise architecture method. The act was replaced in 2019 by the Public Information Management Act (906/2019), which also repealed the section 18 of the Openness in the Government Act.³⁶ Public Information Management Act contains more specific cyber and information security provisions for public authorities and sets general leadership responsibilities for senior executives of government entities. But it lacks the systemic principle of good information management practise. This may become a problem when technology and its application in various context develops.

These imperfections and limits of law as forum of justice and as instrument of good governance policies follow from the scarcity of legal thinking, dissatisfactory regulatory patterns and legislative and legal design models guiding information and information systems management and development. Fragmentation of law, absence of clear systematics, lack of sufficiently wide thinking and perspectives and weaknesses in the application and implementation processes remain constant problems in the law of cyber and information security.³⁷

When revisited with the perspectives of current security research, international policy documents and Union legislation related to cyber and information security the 1997 risk list had decently endured the test of time. Nearly all risks identified in some form in the 1997 risk list appear to be highly relevant today albeit in 1997 terminology was not stable and legal categorization of many risks was only at its initial stateges. Today identification of risks is founded on a significant number of scientific research in different disciplines of socio-technological studies and computer science. The European Union and Finland‘s national legislation has changed and the addressing the risks of digital network society have become more widely explicit in law. However, the piecemeal legislation leads to that a coherent overall picture to risks may vanish in the middle of many details. In 2023 I will synthetize a list of key societal risks in digital network society with particular relevance to cyber and information security to the following 20 points:

1. Trustworthiness risks related to technology and socio-technological governance, which maintains general and specific trust in society. ³⁸ Number of specific reported security vulnerabilities in software and ICT is growing. ³⁹ New technologies also create new weaknesses, vulnerabilities and risks. ⁴⁰ Trustworthiness of technologies is a key objective and concern in the recent European Union legislative initiatives and policies, for example concerning artificial intelligence. Trustworthiness depends on technical, ethical and legal aspects. ⁴¹ The resilient functioning of digital technologies and cyber and information security depend on the whole life cycle of the system and the whole path of the information. ⁴² Security should also then be security by design and default option including resilience by design and default. The vulnerabilities unavoidably do realize and attacks do happen. ⁴³

2. Data, information, knowledge and cognitive risks. These include classic issues of authentication, authenticity, availability, integrity and confidentiality of data and information which have long been in the agenda of information security. Integrity of evidence and the risks of corruption of digital documents and digital evidence are legally relevant specific aspects of that. ⁴⁴ With the increased fluidity of data the risks of combining of data, correctness and use of the inferred information and the security of the metadata and the inferred data shall be added to the issues of legal concern and concern for cyber and information security work. Duties of care and informing data subjects and users about the risks involved extends to metadata and inferred data. ⁴⁵ In Finland, the Constitutional law Committee has particularly emphasised the risks posed by large data repositories and, in particular, of the special categories of personal data referred to in the GDPR. ⁴⁶ Societal level of cyber and information security nowadays increasingly extends to cognitive issues and fighting misinformation and governs cognitive risks. ⁴⁷ Cognitive security in security and ICT technical term refers to the use of artificial intelligence techniques modelling human thought processes, that is, to cognitive computing techniques, used to detect security vulnerabilities. ⁴⁸

3. Risks of communication, authenticity and interaction in digital communications which include a wide array of technical network and information security risks but, additionally several aspects related to the planning, design and maintenance of the information and communication systems. ⁴⁹ These also include technical risks of network and communication security including authenticity and identification of the parties of communication and the risks to the communication related services and service infrastructure. Domain name servers, and routers and the application programme interfaces (APIs) in general have constantly proven to be weak points and call upon better embedded security at the level of architectures, protocols, software, authentication policies and configurations. ⁵⁰ Deep fake techniques create also a significant risk to authenticity and should lead to question the value of image as evidence and foundation for cognition in media and society. ⁵¹ In the future increased computing power in networks and particularly provided by quantum computers may even shake the foundations of cryptography in communications security. ⁵²

4. Legal risks. Legal risk often refers to non-compliance with the requirements and the legal consequences under contracts or under legal regulation that apply to failure to comply with legal requirements such as art. 25 and 32 of the GDPR or the conformity requirements in Medical Devices Regulation or Product Safety Directive or in other acts setting conformity requirements or in contractual requirements. ⁵³ Legal risk management has become a vital part of corporate governance and compliance in regulated sectors where producers and service providers shall ensure compliance with a significant number of different types of laws and standards further detailing the regulatory requirements. ⁵⁴ It is not rare that the standards developed for different legitimate purposes conflict with each other: for example standards on environmental and social responsibility may require transparency on aspects where transparency may be problematic from the cyber and information security point of view.

5. Risks in logistics, value chains and supply chains which are increasingly a general concern for European Union legislator and for businesses in general and which are also dependent on digital platforms, communication and steering systems. Supply chains can be used also on intentional attacks on the resources of final customer. ⁵⁵ Long value chains also create new vulnerabilities and also possibilities for abuse and make it difficult to assess security of a software code consisting of several layers of code coming from different software developers. ⁵⁶

6. Series of financial technology and financial system risks where payment method and payment system risks, including risks related to payment transactions, account systems and card payment and, also, currency risks, to which have been added the risks associated with cryptocurrencies including criminality and odd activities with them. Payment security has proven to be one of the eventual weak links in the overall digital security and cyber and information security in particular. Digital finances and financial technologies and the general dependence on the payment systems even in the many basic services of economic and societal interest have increased the societal interest on cyber and information security in the financial sector in general and on payments systems in particular, and of the resilience of the payment system. Vulnerabilities and disruption of service in the financial infrastructure may cause severe perturbations in many critical societal functions. The Finnish Parliament’s Economic Committee interestingly called upon a constant dialogue with stakeholders to maintain up-to-date threat awareness when issuing a report for the Plenary on the proposal for an Act of Parliament in which the government was named to maintain an alternative resilience payment system should the payments systems fail. ⁵⁷

7. Credit risks and risks of over-indebtedness; Digital society is very much a credit and credit worthiness society. Credit risks are managed through credit information services and positive credit registers, among other things, but the tools of which create also new risks and vulnerabilities, credit data risks, in the form of concentration of personal data. Particular requirements for the correctness and security of credit data and credit data information systems follow from the value and significance of such data for participation to economy and society. ⁵⁸

8. Data protection risks and other information-rights risks which are threats against data protection rights and other information- and information processing dependent rights. The GDPR seeks to control the risks related to the possibilities to combine data and data protection issues concern today both inferred data and metadata. ⁵⁹ Risks related to the digital identity and operating profiles of legal persons, that is data protection beyond the current boundaries of EU data protection law, belong also to this category of information-rights risks. ⁶⁰ Question is also of confidence to the sources of applications (and data) distributed under trustworthy names and marketplaces such as the shops and stores of Tech Giants trough which also malware has been spreading. Abuse of names and operating profiles in getting attention and in scams is a wide phenomena.

9. Technology risks associated with the thinking, design and maintenance of the overall architecture and operating architecture, system architecture and the information system environment. This category of risks does not concern trustworthiness in general but the realization and maintenance in specific situations. ⁶¹ Thinking errors or limits of design constantly appear as the root causes of many legal problems. ⁶² Weak governance and mal-aligned incentives for the security in the development of technology and software and the trade-offs between efficiency and security are often root causes for these risks. ⁶³ Considerable trade-offs exists between ease of use and security. All too often the choice is for lower costs and ease of use at the costs of security. European Union law and Member States law has been weak to provide theses incentives as shown in the legal informatics studies of the software development. ⁶⁴ European Union searches for the rectification of at least some of these problems by proposing new European Parliament and Council Regulation on horizontal cybersecurity requirements for products with digital elements. The proposed regulation seeks to strengthen cyber resilience by introducing horizontal cyber security requirements for products with digital elements, particularly with software and hardware vulnerabilities and to force manufacturers to provide better information on the cyber security. ⁶⁵

10. Platform and ecosystem risks and the related (11) risks of the abuse of private and public power contained in digital platforms and the service network created around them and the application risks of an individual information system or application. Competition in the digital economy is increasingly between ecosystems organised around platforms. This creates an ecosystem risk for individual businesses and other actors. All services attached to a platform and its ecosystem are technologically and operationally dependent on that platform. Hence, security vulnerabilities multiply. Economic and government actors as well as consumers and citizens may be locked into an ecosystem. Platforms use considerable power and modify legally relevant power positions. ⁶⁶ This creates new inconsistencies with law by adding the platform service provider between the classic partners of producer/seller – consumer/user and, consequently risks of confusion, uncertainty and abuse of power emerge. New question of the basis of allocation of duties of care, for example in the provision of cyber and information security unfold. ⁶⁷ Competition law and data protection law and broader information law come and need to come closer together as coherent preventive and reactive systems of remedies for abuse of power and disproportionate positions of power. ⁶⁸ European Union has started to address power inequalities and the risks of abuse of market power by the new Digital Services Act (EU) 2022/2065 and Digital Market Act and the Data Act (EU) 2022/1925 seek to address some of the new informational power asymmetries in platforms and ecosystems based on platforms. ⁶⁹

12. Risks of abusive or suppressive bio-politics via personalised mass-influencing. Dataification with BigData and SmartData analytics and platforms enable also personalised and massive influencing to large parts of population by both private and public actors. ⁷⁰ These changes in the possibilities provided by the technology blur also the borders between private and public and personal and mass communications. The bio-politics described by Michel Foucault in his famous series of lectures in the College of France has become a reality with un-precended possibilities and risks for abuse of power. Abusive bio-politics is not necessarily evil dictatorship. It can also be well-intentioned but imposed policies and restrictions of competition seeking short term consumer benefit or general happiness but supressing autonomic, well-informed decision making with real possibilities of a choice. ⁷¹ Cyber and information security are elements, which maintain psychological, cognitive and even physical integrity and dignity for individuals to make informed choices and keep choices relevant, not only a tick-a-box -formality. ⁷²

13. Democracy risks. Informational rights are at the heart of liberal democracy and constitutional state based on democracy and rule of law, the freedom of expression and, right to informational selfdetermination and privacy, are the necessary conditions for democracy. In digital society democracy and citizenship are realised on and is dependent of the quality of digital infrastructures. ⁷³ Information and communication technologies including artificial intelligence can in many sense enhance access to information and exchange of information. Concurrently with promises social media and ICT based communications have enhanced communicational phenomena weakening or threatening democracy. ⁷⁴ Safeguarding good citizenship and sensible, pluralistic public discourses in the current digitalized speech and media context with automated and personalized content curation are concerns for international organizations and legislators. Here digital security in general and cyber and information security in particular together with human-rights-friendly infrastructures and access to content and good content assessment skills are essential elements in democracy in the digital age. ⁷⁵ Serious defects in cyber and information security may establish also a chilling effect on free speech and access to information.

14. Risks of digital exclusion. Digital society offers empowerment and tools for human agency but also gaps and obstacles to public and private participation. These replicate existing inequalities but depend also on multi-faceted issues of access to use of digital infrastructure and tools to use digital procedures as well as of skills and even physical conditions. ⁷⁶ Accessibility issues together with the cyber and information security become preconditions for equal rights and participation to which both European and national legislators and constitutional guardians have paid attention to by the EU accessibility directive (EU) 2016/2102 and by national laws and calls on to work with solving structural forms of digital exclusion and enhance inclusion in digital world. ⁷⁷ EU accessibility legislation covers mainly public sector. Accessibility issues are often considered separate from the cyber and information security issues. This is a problem. For example, elderly persons are vulnerable and targeted in computer crimes. Accessibility shall also be guaranteed in balance with cyber and information security of the applications. Security thinking and accessibility issues are part of a wider and yet to be solved paradox between usability and security.

15. Control risks for public authorities were on the original risk list of 1997. Control risks for public authorities related in the original risk list to the capacity for the public authorities to exercise legitimate control and oversight for example concerning double-use technologies or taxation in platforms. Double use technology legislation covers increasingly everyday items due to the embedded nature of the advanced digital technology, which can have also military use. ⁷⁸ Specific cyber and information security control risk is the abuse of cyber surveillance technology for non-authorised military purposes and for spying. ⁷⁹ Cyber and information security is today essentially a public good depending also on the situation awareness and activities of the government and its agencies to detect and prevent risks and of the strategic leadership and planning required in the NIS Directive and recommended in the 2022 OECD digital security guidelines. This requires also up-to-date legal framework for cyber and information security awareness and co-operation within the government and between government entities and the society at large. ⁸⁰

16. Today human control risks concern securing human autonomy and agency including informed decision-making and assessment in a virtual-physical environment where humans live together with and as part of a technological system consisting of ubiquitous digital technologies with certain degree of autonomy. ⁸¹ Human control or user control can in this context be rather seen as realization of the principles of accountability and responsibility in the whole life cycle of automatic systems. ⁸² Some human control arrangements create risks and blindspots themselves. Human control can be a fallacy giving a false sense of security. In complex systems environment human controls are not sufficient for effective security and oversight. ⁸³ Humans are one of the most vulnerable parts in the cyber and information security. ⁸⁴ The eventual use of artificial intelligence tools to cyber criminality is an increasing thread which is likely to realize and calling for additional sophistication in the security thinking and tools. ⁸⁵ Cyber and information security arrangements and the law on cyber and information security ultimately protects human autonomy, which is one of the most fundamental principles and values in law.

17. Risks of cybercrime and other crime taking advantage of technological environment and constantly developing technological tools. Cybercrime has received considerable attention by international organizations and European and national legislators. The Council of Europe Convention on Cybercrime (ETS No. 185, Budapest Convention) and the European Union Directive 2013/40/EU on the attacks against information systems are principal European level legislative instruments. ⁸⁶ The Council of Europe Convention on Cybercrime was the first international treaty on crime committed in the digital network environment and providing criminal law and procedure protection for network security. ⁸⁷ Cybercrime continues to be an increasing threat where benefits of attacks seem to be greater than costs and risks to attackers. ⁸⁸ Cybercrime is estimated by the European Commission’s Joint Research Centre to cause annual costs of 5,5 trillion euros and an increasing trend of cyber attacks is observed since 2015. ⁸⁹ Prevention of cyber crime depends on the effective realization of GDPR and security by design and default protecting not only systems but the rights of the users and stakeholders. ⁹⁰

18. Risks of hybrid influencing and cyber warfare. ⁹¹ In the current security situation in Europe hybrid influencing and use of cyber means are topical issues. ⁹² Hybrid influencing and cyber warfare are significant national security and European Union security concerns. ⁹³ These concerns have in Finland led to definition of serious hybrid influencing as as a new category of national emergencies in the Emergency Powers Act, which is enacted as a permanent but limited exception to Constitution. ⁹⁴

19. Risks in cooperation and creation of epistemic awareness and shared understanding between and beyond different professions. Risk for effective governance for cyber and information security and for the realization of rights in the digital environment is the lack of cooperation beyond narrow perspectives of individual disciplines and their subfields and the various obstacles and misunderstandings in the multi-disciplinary and multi-perspective collaboration and situational awareness. Finding a common language and methods for multi-disciplinary work is not of the smallest problems.

20. Risks of legal regulation and the scarcity of legal thinking, legislation and application of justice. Law is a stabilizing force in society. Law may be at odds with the future since the law in statutes, precedents and established practises repeats solutions developed to past conflicts and problems. All too often the law as legislated and practiced suffers from narrow thinking, a scarcity of justice in terms of thinking and quality argumentation or scarcities in terms of tools and legislative and regulatory models. These scarcities makes the law to be imperfect or to fail, or unreasonably costly, to realize the fundamental ratio of law: protection of humans and predictable provision of legal certainty. While certain in-determination is an inherent and unavoidable nature of law and justice – and hence factors making full automation of judicial decision-making extremely difficult – features in positive law and scarcity in legal thinking and argumentation may accelerate this weakness of law beyond reasonable limits. ⁹⁵ In a policy perspective failures and caveats of legal regulation in the attainment of the objectives of the legislation are valid and legitimate reasons to revise acts. Law may also have transformative goals towards the future to change thinking and action paradigms. Not rarely will the law also encounter shortcomings in this transformative mission. This is explicitly cited to be behind the Commission proposal for NIS2 –Directive: to overcome limitations in the current NIS Directive. ⁹⁶ The lack of universal cyber and information security requirements and the fragmented, piecemeal approach to it in the various acts and policies of the Union is recognised to contribute to these weaknesses and failures of Union law. ⁹⁷

Studies on the impacts and risks of technologies and data processing practises can and even shall be taken into account in the interpretation of the data protection principles and other legislative provisions as well as in the de lege ferenda consideration of new legislation.⁹⁸ The identification and categorization of wider societal risks with particular relevance to cyber and information security serves the future proofing of law and setting legal requirements on cyber and information security to a relevant context where it is easier to see the ratio of law and eventual needs for revised legislation. Performing socio-legal and sociotechnical studies, which provide scientific basis for coherent, balanced, understandable and up-to-date legislation is among tasks of legal informatics. Legal informatics has particular value in the provision of coherent theories and scientifically robust views beyond specific fields of law. Legal informatics contributes to the general theory and conception of security, risks in ICT and human-technology relations. Its task is also to develop common languages and tools to multidisciplinary research and collaboration between practitioners overcoming the scarcities of justice and understanding between professions and their epistemic communities. These tools include concepts, models, design patterns and contributions to security libraries. Risk analyses are a very small contribution in this mission. Name of the discipline and paradigm may be different than legal informatics and the research methods evolve over time but these fundamental questions needs robustly founded answers.⁹⁹

This scientific mission touches profound questions of the role and limits of law. The old security paradox is that technology is used to overcome security challenges but this increases the complexity of the systems and creates new security vulnerabilities. Technology to assist humans can then exceed the human capacity of oversight: a guard’s problem where the guard looses insight into the activity to be guarded unfolds.¹⁰⁰ Security paradox and the guard’s problem represent a general feature of living in the digital society. Mystification of digital technologies either as utopia or dystopia shall be avoided.¹⁰¹ Particularly in artificial intelligence context critical capacity to review both the process of reasoning and outputs of the automatic systems will be needed when artificial intelligence solutions can produce texts and analyses seemingly decent or good but not always with quality. Human history and progress of humanity is about learning to use tools and built collaborations. There is a partnership between human agent and partly autonomous, ‘’intelligent’’ systems to augment human problem-solving power. But the very same capacities will also be used for deception, fraud, harm and war, that is all the evils we know and creative mind is able to innovate. We live and work together with hybrid systems and architecture in human – machine collaboration, as actors of a socio-technical system.¹⁰²

Interactions with the technical systems are not one-directional.¹⁰³ Good architecture of security is hybrid including both humans and technical solutions. Security solutions and strategies need to be kept constantly up to date.¹⁰⁴ The blind spots of cyber and information security and the needs of legal certainty and justice call upon to reconsider repair and remedies. Maintenance is as important as creation of completely new systems and solutions. Care and duties of care need to be at the heart of user-centricness and security. Reconfiguration of the human – machine –relations is needed.¹⁰⁵ Information and communication technology is not only a tool but a mediator of experience and actor influencing on human behaviour and transcending meanings in socio-technical systems.¹⁰⁶ New kind of moral and legal crumble zones emerge and raise the issue on the human autonomy, one of the very foundations of respect for humanity and human autonomy.¹⁰⁷ Legal regulation and remedies concern riginal design, maintenance and repair in the human – machine interaction and confluence in the hybrid architectures with hybrid intelligence. The remit of law extends beyond mere human to human – relations to cover human – computer-relations. Legal informatics cares for the general scientific foundations of this extended realm of law and conceptualises the languages of its legislation.

The value of legal informatics has been, is and will in the future be in building shared understanding between computer science, information systems management and science and other data sciences and with socio-technological studies related to law in systematic ways.

Legal informatics aims for and fosters cross-disciplinary understanding of the legal dimensions of current and future phenomena in law’s intersection with digitalisation, like legislation on cyber and information security. It also develops and maintains tools and conditions for professional understanding between various disciplines working with digitalization. Such an understanding and putting that to a societal context is one of the paradigmatic challenges of cyber and information security and its legal governance. The general scientific mission of legal informatics and the societal need for it have remained the same during the last 25 years albeit science has advanced tremendously during that time. Technical solutions and contents of law have changed. The concept of data security referring to technical arrangements for the protection of integrity, confidentiality and accessibility and usability of data has become cyber and information security with multiple societal perspectives to digital security and ultimately protection of human autonomy in a world were information and communication technology is embedded nearly everywhere. The role of law is to lay foundations and hold accountable for the creation of a culture of security by design and default and the for the everyday maintenance ad repair this requires. Law also provides remedies for failures in this culture of good security by design and default and in maintenance. Legal informatics is needed to contribute to the understanding of the possibilities and challenges in this design, maintenance and to understand what are the effective remedies and relevant issues in this highly technical but still societal context. Legal informatis is also needed to provide a common community of knowledge between legal profession, sociology and economics and the various branches of data, information systems management and computer sciences.