Gradually and then suddenly: the effects of Russia’s attacks on the evolution of cybersecurity policy in Lithuania

ABSTRACT

This article examines how public policy, governance and institutional structures have been established and transformed in response to cyberattacks attributed to Russia that focused political attention in Lithuania. It argues that, despite the growing number of cyberattacks, political and institutional change has initially been slow and it has taken a decade to establish an adequate legal and institutional framework. The reasons for such a slow change are analysed, highlighting limited capacity (lack of understanding of cybersecurity by policy-makers and the lack of attention and other resources allocated to it), institutional fragmentation and coordination problems. It was only after Russia’s aggression against Ukraine in 2014 that cybersecurity policy started to be seen through the prism of national security and parliamentary elections created a window of opportunity for change, which resulted in significant policy transformation in 2017–2018. Interestingly, since then it remained relatively stable, even after Russia’s large scale war against Ukraine in 2022, which had only led to operational cybersecurity policy changes in Lithuania. The article contributes to the debates on the role of external shocks on policy change and the mediating factors which can slow down or facilitate change.

KEYWORDS:

• Cybersecurity policy
• Russia
• war against Ukraine
• Baltic States
• policy change
• external shock
• punctuated-equilibrium model
• EU and NATO

Acknowledgements

The research conducted for this study benefited from funding by the Lithuanian Research Council for the project “Resilience of welfare institutions in Lithuania and the impact of significant events in adapting to systemic risks in 2004–2020", No. S-GEV-21-3. The author is grateful to two anonymous reviewers for their comments, to interviewees for their time and insights and to Rasa Bortkevičiūtė, Vitalis Nakrošis and Inga Patkauskaitė-Tiuchtienė for their feedback during the research.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Correction Statement

This article has been corrected with minor changes. These changes do not impact the academic content of the article.

Additional information

Funding

This work was supported by Lithuanian Research Council [grant number S-GEV-21-3].

Notes on contributors

Ramūnas Vilpišauskas

Ramūnas Vilpišauskas is a professor at the Institute of International Relations and Political Science, Vilnius University. In 2020, he was awarded the Jean Monnet Chair for 2020–2023. From 2009 to 2019 he was a director of the Institute. In 2004–2009, he worked as Chief Economic Policy Advisor to the President of Lithuania Valdas Adamkus. His main research interests include public policy analysis and public sector reforms, the political economy of European integration, EU public policies, and geoeconomics.