Cyber Strategy Workshop for African Union Member States July 23-27, 2018 Addis Ababa, Ethiopia

Understanding the Forces of Change in Cyber Capacity Building

Change Happens In every situation, there are forces or factors that support change, and forces or factors that resist change Cyber Capacity Building brings significant change, in technology, processes, work skills, transaction speed, risk, personal relationships Cyber also brings opportunity, in connection, access to knowledge, spread of technologies, transparency, investment and innovation

Example Drivers Against Change Many factors may weigh against change related to cyber capabilities: Resourcing (fiscal and human) Comfort with existing, well- established processes Fear that technology will undermine traditional values and skills Concerns about shifting power balances Cost or complexity of technology Long lifecycles (e.g., infrastructure) Current Laws or Policies

Example Drivers for Change Many factors may also support change related to cyber capabilities: Evolving technologies or changing risk factors Societal Expectations/Demands Desire for speed & transparency in services Top-down mandates Improved security in key systems and services Credibility of government Growing cybercrime Jobs and investment

Force Field Analysis Example In this example, a company is considering changing their management structure from hierarchical to hub-spoke From Gamestorming, Dave Gray, at http://gamestorming.com/about/

Force Field Analysis Exercise People Processes Technology This exercise looks at the forces for and against increasing government emphasis on cyber capacity that may be common among the participants’ countries. It is framed in terms of P/P/T/I, but other environmental or other aspects may emerge—these can be captured around the edges. This slide or a similar handout can be in the take-away package—we can do this on a central whiteboard in breakout groups (preferably after the initial intro slides/discussion in plenary). Emphasize that it is meant to help consider all perspectives of a change problem and that it can help illuminate otherwise unnoticed or hidden factors influencing the strategic environment and help clarify stakeholder perspectives. Infrastructure

Common Reasons People Resist Change What Does That Mean? What Can We Do? Misunderstanding the need or rationale People may not understand the risks and opportunities associated with cyber Explain cyber risks and goals in narrow, simple terms that are meaningful to individuals Concern that things will be worse People may fear that changes will make even more things go wrong Listen to their fears. Many reflect a lack of information about the technology or the plans to pursue it Fear of Irrelevancy Cyber requires new skills—many people may fear they will not be able to compete Discuss training options and other types of compensation for people with traditional skills Saturation Cyber is everywhere. People can’t process it anymore Focus on communicating only those aspects that are immediately relevant to people, and explain why they matter in personally relatable terms Perceived Disadvantage People feel that building more cyber capacity will shift resources away from them Communicate the role of cyber in national prosperity and connect that prosperity to them. Explain why spending resources on cyber is important. Lack of Communication/ Inclusion People simply don’t feel like they know what’s going on or why Communicate at every opportunity—goals, reasons, plans, expected benefits!

Take-aways This exercise is not unique to cyber—it can be used to help groups understand the reasons various stakeholders support or resist change, and communicate their perspectives to each other It can be used to identify environmental or contextual factors that are hindering a desired change, or forcing an undesired one, so that those factors can be addressed It can help identify stakeholders and their roles, as well as processes or institutions that might affect or be affected by a particular change We recommend trying this exercise on some minor change when you return home, in order to familiarize other stakeholders with it, and to facilitate the kinds of discussions that foster good internal understanding and partnerships