Abstract
From data leaks of sensitive information to the degrading or halting of complete systems upon which integral societal process rely, there are daily reminders of the precariousness of networked institutions. This form of vulnerability extends beyond services to also threaten foundational values, such as privacy, movement, and free speech. Yet, given the awareness of vulnerability to cyber disruption, little is known about how massive cyber failures might disrupt the lives of ordinary people at a micro-scale. Because technology is imbued in everyday life, and people use internet systems in bundled, complex ways to accomplish a myriad of unknown activities, a complicated web of cyber-vulnerability likely exists. Thus, the goal of this paper is to explore one dimension of this vulnerability as it pertains to public security. Terrorism is predicted to remain an urban phenomenon, and terrorists are increasingly exploiting cyber-systems. The aims of terrorism to disrupt democratic systems are perfectly achieved by cyber disruption, and this paper explores how those goals were facilitated during the Boston Marathon Bombing in 2013. By drawing on interviews with public safety officials and ordinary people who relied on the internet and linked technology during that emergency, I demonstrate the complex ways that cyber-systems limited the effectiveness of public security in times of terror. The results suggest a rethinking of the social amplification of risk paradigm that dominates in risk hazards research as well as several policy interventions in security communication and information dissemination, population management during crisis, and resilience.
Kitchin and Dodge (2011) conceptualized “code/space” as the creation and transformation of spaces in response to the digital revolution. As people increasingly rely on technology, code has become a pervasive, yet nearly invisible, element of life. By offering new possibilities of interaction, management of complex systems, and unparalleled opportunities for entertainment, code is creating new spaces, it is transforming existing ones, and it is altering the meaning that humans generate with regard to both. Moreover, the complex ways that people link up technological systems to accomplish activities are as unknown as they are ephemeral, creating unstable epistemologies and ontologies with regard to studying these conditions. This situation exacerbates attempts to identify related vulnerabilities, which is problematic because municipal governments are pushing “smart city” programs (Kitchin, 2014) at the very same moment that cyber-terrorism is becoming a dangerous possibility.
The situation is worsened by the broad focus of vulnerability analyses on environmental hazards. In this context, vulnerability refers to the degree to which a risk-affected population is likely to suffer loss (Cutter, 1996). It is a product of exposure to risk, and the ability to resist and respond (Mitchell, 2006). The well-developed environmental risk frameworks have focused on social (Smith, 2006) and institutional (Zaidi and Pelling, 2015) conditions that reduce a person’s response ability as well as the psychological dimensions that lead people to amplify their risk perceptions (Kasperson, 1988). Scholars have also used vulnerability frameworks to study terrorism (Mitchell, 2003a, 2003c).
In the context of cyber-vulnerabilities, however, the utility of these frameworks is poorly understood. First, it is not known what suffering will occur when cyber-systems fail because it is not known how people utilize these systems in combinatory ways. Without this knowledge, it can’t be known what will be lost and to what degree, which are essential components of understanding vulnerability. The tremendous uncertainty about the Y2K bug on 1 January 2001 underscores this point. More recently, hackers have demonstrated that ransomware can have an equally pernicious effect. In the State of South Carolina, for example, there has been a string of ransomware attacks that have prevented school administrators from accessing essential information, including student enrollment data, course schedules, and even grades and diplomas! One school district had to pay $3,000 to access records (Yee, 2017). Further, the possibility of temporary failures, degradation without complete failure, and the cascading of failure in one system into others, add to the complexity of determining the nature of cyber-vulnerability. For example, wireless telephone services were overwhelmed during 9/11, resulting in legions of people waiting to use the now unheard of public pay telephone. Mobile systems become inoperable when demand peaks after a disaster. As people increase their reliance on these systems, the possibilities of a cascading disaster increase as well.
It is also not known if people have amplified risk perceptions in a cyber environment that emphasizes ephemerality and the option to “switch off.” Such environments may attenuate risk perception by downplaying the realness of a hazard despite the actual presence of risk. Further still, the institutions that support cyber-systems seem to upend institutional approaches to vulnerability. Cyber institutions have disproportionately benefitted the wealthy, who have had advanced access to the life-enhancing systems that technology supports. This condition may leave the poor in a relatively better position when it comes to actual vulnerability to cyber disruptions—a condition markedly different from traditional vulnerability assessments (Cutter et al., 2000). Finally, it is not known how people might resist and recover from cyber-vulnerabilities as is the case with environmental and terrorism hazards. People may be unaware of how they themselves rely upon cyber-systems, and their resourcefulness in replacing lost or degraded systems has not been tested on a large scale nor is there accounting of which essential life functions might be disrupted. People also may be unaware of how disruption to the systems that others rely upon, but which they themselves do not, might be personally debilitating.
The advanced societal reliance on cyber-systems, the dearth of knowledge about how these conditions create vulnerability, and questions about the applicability of existing frameworks for studying such vulnerability signal the need to rethink risk analysis and vulnerability awareness with regard to the prevalence of code/space. The goal of this paper is to explore how vulnerability is created via cyber-systems, with a particular focus on the creation of insecure spaces during terrorist attacks that do not directly target cyber infrastructure. By drawing on a dataset of 111 in-depth, semi-structured interviews conducted with residents and public safety officials in the Boston Metropolitan Area before the 4-15-13 Boston Marathon bombing and a smaller data set of 17 interviews with residents and public safety officials conducted after the bombing, I demonstrate how cyber-systems functioned as information sources in previously unknown ways. As the bombing unfolded, and in the days afterward, cyber-systems compounded rather than alleviated vulnerability by facilitating the spread of erroneous information. This condition, which was largely unnoticed, resulted in a community that was potentially less safe than would have otherwise been the case. Several important lessons follow from this study, and each of them is relevant for public safety officials, the communities that they serve, and our broader understanding of cyber vulnerability.
I begin by reviewing cyber vulnerability theories, followed by risk-hazards scholarship. I point out the limitations of existing work and the possibilities where risk-hazards frameworks may potentially inform theory of cyber-vulnerability, and vice-versa. Second, I explain the project’s method, which involved a qualitative design including pre- and post-disaster in-depth interviews, followed by coding to develop an understanding of the contexts within which people made decisions before and after an act of terrorism. I then explain four key findings: (1) the rapid evolution of smart devices and social media have degraded the ability of public safety officials to manage public response to a terrorist attack; (2) residents are substituting cyber access for spatial mobility in times of terrorism; (3) ordinary people have been enlisted into the surveillance state—and seem to have willingly accepted this condition—during times of terror; and (4) public safety officials have not yet grasped these emergent situations, their spatial implications and resulting vulnerabilities, and they have not thought of ways to respond to it. Finally, I conclude by suggesting policy responses and additional research needs.
Key concepts for understanding cyber-vulnerability
Cyber-vulnerability refers to the degree to which people suffer loss when networked systems fail or are degraded. Several concepts help explain this vulnerability: (1) the embedding of networked computers into everything, including humans (Batty, 2013); (2) urban policies that are informed by big data, which captures meta-processes but not complex emotions (which deeply affect vulnerability) (Kitchin, 2013); (3) technological unconsciousness (Kitchin and Dodge, 2011), which occurs as people rely on cyber-systems without realizing it; and (4) the impact of social media, which are supported by cyber-systems, that both empower and disempower people (Kitchin et al., 2013). There are also epistemological concepts that must be challenged: (1) cyber-system code reflects the worldviews of privileged people (Kitchin, 2011), and it shapes society in a way that potentially exacerbates the vulnerability of the unprivileged; (2) most smart city programs are created for neoliberal regimes, creating a biased urban system (Kitchin, 2014). This condition embeds bias into research on cyber-vulnerability from the outset.
Bias may be as embedded in research as computers are embedded into societies. Computers, and the systems that support them, are now found in places as diverse as the human body (e.g., pacemakers) and the traffic light. As Batty (2013) argued, this situation allows for an enormous amount of data to be collected. In cities, the data collection possibilities are additionally enhanced as people come into contact with many data collection points. This occurs in mundane activities such as passing smart stop lights or by submitting oneself to surveillance by choosing one path to work over another (Ball and Webster, 2003; Lyon, 2003; Wood et al., 2003). Yet, these systems do not capture everything. In part, the omissions are the result of not knowing all of the ways that people utilize cyber-systems to do different things, but it is also the result of some dimensions of life not relying on a cyber-system. The conditions of increasingly prevalent cyber-systems and not knowing exactly how they are used signal new forms of vulnerability.
Yet, this pending vulnerability is masked by celebrations of how smart urbanism yields efficiency. Kitchin (2014) argues that many proponents of “big” data systems believe that such systems benefit municipal governments and their residents. These data allow government service providers to respond quickly to changing preferences. For example, traffic lights in some cities are coordinated to alleviate rush hour congestion. Big data can also be used for future-oriented planning, such as renovating subway entrances after determining which ones have the most usage. In these cases, policy that was formerly reliant upon “small” data sets is viewed as limited, resulting in bad policy. However, though cyber-systems hold the potential for ever increasing data to inform policy, they also increase the opportunity for such data to be degraded format as well as the possibility of manipulation. While substantial manipulations are likely to be noticed, low-level degradation could go unnoticed and be enough to nullify any efficiency achievements if not create insecurity.
The possibility that low-level degradation goes unnoticed in cyber-systems signals the condition of technological unconsciousness (Kitchin and Dodge, 2011). Ordinary people—and the scholars who study them—are largely unaware of how cyber-systems support various dimensions of life, especially when people use multiple systems in diverse ways. The reliance often becomes evident only when these systems fail. Kitchin and Dodge theorize a “secondary agency” that cyber-systems give to people, which frees them to focus on more complex activities. However, this agency and the fact that most people are unaware of it points to potentially deep vulnerability. Without knowledge of what people rely on, there is little that can be done to prepare for the absence of supporting systems. Further, it is not clear how equipped people will be to resume activities that they once did, but are now completed by technology.
For example, technology provides the means to communicate about many dimensions of life. This condition has been conceptualized as empowering, particularly when it is used to understand government and to mobilize citizens to resist (Kitchin et al., 2013). As the dramatic social movements in response to the deaths of black men in the US demonstrate, social media can quickly disseminate images and help organize people. However, the growth of social media as public communication also creates the opportunity for false information to spread. The absence of knowledge that verification is necessary, and the inability to verify even if there is knowledge, foreshadows new forms of vulnerability. At least some communications that are enabled by cyber-systems may increase, rather than alleviate, vulnerability.
Studying each of these possible conditions of cyber-vulnerability—the embeddedness of technology, our technological unconscious, the smart city programs, and the possible disempowering roles of technology—is compounded by the uniformity of epistemological stances that create cyber-systems. Though the world of technology and cyber-systems is ephemeral, the epistemologies that created this world have been stable. The mostly white, male, and affluent people who created the internet shaped the world of code/space in a way that reflects their values and needs (Kitchin, 2011). Understanding how this condition shapes vulnerability throughout society requires methodologies that are open to theorizing the world beyond initial structures. Qualitative methodologies provide these abilities by allowing theory to emerge from the data and for activist epistemologies that challenge existing knowledge structures (Charmaz, 2003; Denzin, 2003; Flick, 2009).
And activism is needed in this moment of smart city programs, as Kitchin (2014) has theorized the role of cyber-systems in supporting neoliberal regimes. Indeed, the focus on efficiency via cyber infrastructure is peddled to secure the city as safe space for capitalism. This condition gives little recognition to how such systems might be used to actually enhance the right to the city held by residents. While it is true that city programs, such as library internet access, bring opportunities to people, it is also the case that the vulnerability should these systems fail is hardly ever discussed. Rather, the concerns about vulnerability are most often articulated around the need to protect financial circuits and urban systems to which the disadvantaged are poorly linked. Epistemologies are needed to understand not just how neo-liberal frameworks manifest themselves, but also to develop alternative frameworks that prioritize the study of existing forms of vulnerability (and resilience). These other forms are often both a product of neoliberal regimes but also a potential response to them and the vulnerability that they create.
The role of risk-hazards scholarship
Risk-hazards scholarship studies how vulnerability is created at the intersection of natural hazards and social institutions. There are three foci: (1) understanding the psycho-social conditions of risk perceptions; (2) the role of human institutions in creating vulnerability; and (3) understanding human adaptations in response to climate change. In the current moment, the concept of ambiguity is being developed as a frame for analysis, suggesting a fourth focus.
Risk-hazards scholarship developed to understand how humans perceived their risk from spatially predictable natural hazards, such as floods (White, 1945). This scholarship explored how a person’s social environment affected his or her decisions with regard to risk, both in ways that created risk but also in ways that mitigated it. For example, Drabek (1969) showed that people decided to evacuate from a flood when they saw their neighbors doing so, while White (1945) demonstrated that structural incentives or restrictions (such as preventing settlement in floodplains) could limit risk. This early scholarship led to analyses of the broad phenomena of a society that caused people to amplify their risk perception (Kasperson, 1988), which in turn led those people to irrational public policy demands. The conclusion from this research was that both scientific experts and the lay public must learn from each other in order to fully understand risk (Slovic, 1987).
These ideas eventually lead to the recognition of the roles of human institutions—from capitalist economies to cultural systems—in creating vulnerability. The post-disaster desire to restore previous social arrangements was recognized as serving the interests of advanced capitalists to the detriment of others (MacKinnon and Derickson, 2012), while cultural systems were found to complicate communication strategies among scientists and lay people (Rayner and Cantor, 1998). Further still, it was not only culture that shaped risk perception and actual vulnerability, but gender and race were found to matter too (Cutter et al., 2006; Derickson, 2014; Klinenberg, 2002). These conditions signaled the broad contours of a society that was put together by institutions in ways that created or exacerbated its own vulnerability (Zaidi and Pelling, 2015), leading Smith (2006) to claim that there is no such thing as a “natural” disaster. In this research, risk and vulnerability were not conditions given from nature, but were rather human constructs inherent in unequal societies.
In addition to such human constructs creating vulnerability, there has also been ample research on how to use these same constructs to alleviate vulnerability. This work has focused on adaptations to climate change. The recognition of the various components that contribute to climate change, as well as the variety of adaptations, led scholars to shift emphasis away from discrete states of being and towards an understanding of processes that contribute to or alleviate vulnerability. Shifting the conceptualization of vulnerability towards a process that unfolds over spaces and via various actors (Mitchell, 2003b) opened up a broader consideration of what constitutes vulnerability. Though psychometric considerations and institutional contributions to risk are still important dimensions, vulnerability analyses have advanced beyond these topics (Mitchell, 2016a). Vulnerability analyses can now take the form of studying how the multiple dimensions of a person’s life contribute to both actual vulnerability and awareness or misperception of such vulnerability, and how adaptations are influenced by a variety of phenomena, including local places (Cutter et al., 2000), social networks (Klinenberg, 2002), context (Mitchell, 2006), politics (Pelling and Dill, 2010), and even mental health (Zahran et al., 2011). This literature on vulnerability and climate change adaptation strategies provided valuable inputs vis-à-vis both conceptualizing process in vulnerability studies and recognizing the complexity of how adaptations are formulated.
In the current moment, risk-hazards frameworks are again in transformation, increasingly recognizing that broad swaths of the public find themselves in ambiguous situations with regard to risk. Given the growth of distrust in a variety of institutions, as well as the successful amelioration of some risks and the creation of others, many people are uncertain what to fear and where to fear it. Advanced technology has contributed to this outcome (Howie, 2015), bringing the realistic experience of unlikely hazards on to everyone’s computer screen. So too did the spectacular 9/11 attacks and the associated political responses that continue to stoke fear. The post-9/11 moment introduced the idea of human intentionality to risk perception, a condition that Katz (2007) theorized led to a perception that security was needed in every place—not just when a hazard approached. Gregory (2011) labeled this condition the “everywhere war.” Several scholars have begun to utilize the concept of ambiguity to explain the amorphous and undefined condition in risk perception (Mitchell, 2016b; Renn and Klinke, 2016).
Towards a new framework
Blending concepts for studying cyber-vulnerability with natural hazards concepts advances several dimensions of cyber-vulnerability analyses. First, cyber-vulnerability analysis must consider how cyber access can both amplify and attenuate risk perception, and what this means for actual vulnerability. Second, there are a variety of institutions that govern the creation and operation of cyber-systems, and there are even more that govern how cyber-systems are put to use by the general public. While the former has been somewhat theorized, the latter is still largely unknown. In both cases, there are questions regarding how institutions also amplify or attenuate actual risk and vulnerability. Finally, it is unknown how people use cyber-systems to adapt to changing vulnerabilities, and what will occur when these systems are unavailable.
The role of cyber-systems in shaping risk perception is an important, and unanswered, question. Howie (2015) has argued that global television networks and advanced communication technologies allow people far from a disaster to “witness” it. Coupled with advanced technologies that replicate sound, enhance visualization, and stimulate other sensory experiences, it is possible for a person completely out of harm’s way to momentarily experience a hazard as if actually in the place where that hazard is occurring. This raises several questions: Does the person feel the same level of fear as one who is actually present? What does the person do with this fear as he or she realizes the different context? And, how does seeing hazards that are unlikely in one’s current place affect how the person subsequently interprets the hazard profile of that place? These ideas echo the risk-hazards research on the amplification of risk via traditional media, but they are different in the context of ubiquitous access to cyber-systems and the enhanced abilities of technology to simulate real-life experiences. Borrowing from Gregory (2011), it is now possible for the “everywhereness” of a hazard to exist even in spaces where perception of risk would previously have not occurred.
Further, the availability of multiple different systems and sources of information will complicate any singular interpretation of a hazard. It may give people a false sense of invulnerability as they may assume that the failure of one cyber-system upon which they rely is not a problem as this system can be replaced by another. In this circumstance, the seeming ubiquity of cyber-systems may reduce the perception of vulnerability even though vulnerability is actually present. The, 2015 flooding in Lancaster, England evidenced the danger of this situation. During an extreme flooding event, an entire community was caught off guard when the power system failed. Absent electricity, a variety of hazards materialized, such as health crises, trapped residents due to elevators not working, and inability to communicate (Walport, 2016). Suddenly, a wide well of vulnerability became evident, yet understanding this vulnerability is deeply complicated because there is no longer any single manager of the complex, inter-reliant web of networks supporting society (Walport, 2016). While Graham (2007) pointed out that infrastructure only becomes visible when it fails, the Lancaster case demonstrates that even when failure occurs, visibility may be beside the point: all of the connections and spreading vulnerability may be so complex that the exact nature of vulnerability is incomprehensible. Additionally, cyber-systems do not have to fail to create vulnerability, but rather they can become degraded. This situation as well may not be understood as vulnerability, though in reality it may be a source of vulnerability.
Similarly, there are a variety of institutions that govern cyber-systems that may source vulnerability. Cyber-systems reflect the language of privileged people, which raises the question of how those who are less-privileged relate with and use these systems. While it is well known that the poor have very different access and usage levels of cyber-systems than do the rich, it could be the case that this situation actually will help lower-income, un-networked people survive a hazard. If these people have not come to rely on the internet to accomplish daily tasks, they have little to lose in their personal lives (though a lot to lose via broader service failure, such as 911 systems). Further, new forms of social arrangements have been forged with advanced cyber-systems, and a variety of integral economic, security, and health functions are performed with them. In the absence or slowing of these systems, it is not clear which institutions will survive, which will adapt to the new conditions, and which of the older institutions that cyber-systems replaced will be re-asserted and become viable once again.
One core institution that may be quickly reasserted, particularly by the poor, is the local social network. Gilbert (1998) demonstrated that by condition of their spatially limited lives, the poor usually have rich networks in close proximity. While it is true that the poor are often reliant on social services (e.g., welfare) that may become inoperable due to a cyber outage, and that they have homes less well-stocked than the wealthy, it is also the case that having nearby networks through which one might implement survival strategies may yield powerful resilience.
Finally, it is possible that people have already used cyber-systems to respond to vulnerabilities that have emerged in their lives. For example, many communities now use web sites to communicate and share information about local crimes, to barter and provide resources to one another, and to establish cohesion around place. These are integral elements in fostering sustainable communities, but are often dependent upon cyber-systems—particularly as the size of the neighborhood unit grows spatially and in density. It is possible that the inevitable re-scaling of the community after a prolonged cyber outage could be catastrophic, dramatically elevating the unsustainability of the community or the impacts of vulnerabilities that had been managed by cyber-systems up until that point. Identifying these adaptations, understanding their complexity and depth, and foreseeing the consequences should they fail will allow a more comprehensive articulation of the vulnerability that advanced cyber-systems create.
A new framework for studying the vulnerability of cyber-systems involves exploring how these systems amplify risk perception and vulnerability, how they are supported by a variety of problematic institutions, and how both these institutions and the individual’s adaptations to a changing world by using cyber-systems creates and alleviates vulnerability. Given that relatively little is known about each of these conditions, qualitative methods are particularly well-suited to begin the exploration (Cresswell, 1998).
Method
Study areas
I selected the Boston Metropolitan Area as the initial study site because the US Federal Government (Security, 2016) cited it as a likely terrorism target in the Urban Areas Security Initiative (UASI). Further, Boston was a relatively unstudied city vis-à-vis terrorism. The study area included the three core municipalities: the cities of Cambridge, Quincy, and Boston. These cities were subsequently selected for additional study because a terrorist attack occurred in Boston, while the terrorists lived in Cambridge and engaged in additional violence there. See Figure 1, which depicts the location where the bombs exploded during the Boston Marathon. Figure 2 depicts the areas affected by the pursuit of the perpetrator.

Location in Boston where bombs exploded during the Boston Marathon, 2013.

Location of communities surrounding Boston that the authorities placed under lockdown.
As determined by the US Census Bureau, Cambridge, the city to the North of Boston, is a relatively white (66%), wealthy (median income is $76,000), and well-educated community (75% of the population has a bachelor’s). Boston is less white (53% of population), less wealthy (median income at $54,000), and less well-educated (44% with bachelor’s degrees). Quincy is the whitest (67%), wealthier than Boston ($63,000 median income), and the least well-educated (40% with bachelor’s degrees).
Semi-structured interview design, sampling, coding, and analysis
There are two types of interview participants in this project: ordinary residents and public safety officials. Via a spatially stratified, random sample of high-, middle-, and low-income Census Tracts in each city, I contacted and interviewed 87 people in 2008. I contacted and interviewed an additional six people via snowball sampling. In addition, I interviewed 18 public safety officials. In each case, the officials served in administrative and managerial positions. After the 2013 Boston Marathon bombing, I contacted 62 of the original participants who indicated their willingness to be re-interviewed in the event of a terrorist attack in Boston, and nine of these people agreed to an additional interview. Most of the public safety officials that I interviewed in 2008 were no longer in their previous positions, but four of them were and agreed to be re-interviewed. Other public safety officials were suggested for interviews, resulting in four additional interviews with public safety officials after the bombings. In total, 17 interviews were conducted after the bombing.
For both groups of participants, the interviews lasted approximately 1 hour and 15 minutes, and I used a semi-structured format. This structure involved a mixture of closed-ended, quantifiable questions along with open-ended questions that allowed the participants to freely explore ideas. For the residents, the topics included sources of information about terrorism, perceptions of vulnerability in different places, and after the bombing, questions about how the respondent learned about the attacks. For the public safety officials, questions focused on their ideas of public safety, their understanding of the jurisdiction, and after the bombings, questions about resilience.
Each of the interviews were recorded and transcribed verbatim with the assistance of paid undergraduate and graduate student assistants. I imported the transcripts into the Nvivo software system, and I coded every single line of each one in an open coding procedure, as described by Bohm (2004) and Cope (2003). This procedure fractures the data, and it facilitates the emergence of larger codes that capture the main themes in the data. I then recoded each transcript around these larger codes, known as axial coding. I then refined the codes by recoding the transcript into the most compelling and clearly emergent topics, which is known as selective coding. I then compared the transcripts and codes created before the Marathon bombing with those created after, and the points of divergence form the crux of the findings discussed below. By exploring the selective codes in these two time periods, the deep impact of cyber-systems and the societal information-sharing processes that they support became evident. Further, the public safety officials’ unawareness of this condition was underscored.
Respondents
The original sample of 93 residents was 41% male and the average age was 57. These respondents were overwhelmingly middle- to upper-middle income. Seven respondents (7.5%) were living in poverty. The sample was mostly white, with five black people, three Asian people, and one Hispanic. There were no non-English speakers. Five of the nine respondents who agreed to be re-interviewed after the attacks were male, and all of them were white and middle- to upper-middle income. The average age of these respondents was 68. (When adjusted for the 5 year time lapse, the average age was 63. As a group, the post-Marathon respondents were older than the original cohort.)
All of the public safety officials were management personnel. In the original sample of 18 participants, all were white and just two were female. In the second round of eight respondents, one respondent was female and one was black. I did not ask these respondents for information about their ages or incomes, as these dimensions were not relevant to the policy analysis.
Ethics
Discussions of terrorism are inherently fraught with political meanings, psychological trauma, and possibly even fear. These conditions are largely the result of the political way with which the term terrorism has been deployed for a variety of nefarious goals (Gray and Wyly, 2007; Katz, 2007, 2008). Thus, it has been suggested that the method involved in this paper could be detrimental: by discussing terrorism with ordinary people, in the interviews conducted in the everyday settings of their lives, I might promote fear.
I respond to these concerns by grounding this project in the belief that oppression need not always be the result of discussions of violence. Several scholars have shown that discussions of violence in general, and of terrorism in particular, can actually reduce fear rather than elevate it (Caldeira, 2000; Keenan, 2018; West and Orr, 2005). Further, the direct engagement of the researcher with the participants is recommended as a transformative opportunity when conducting qualitative research: both the researcher and the subjects can see and challenge dominant discourses (Denzin, 2003). To this end, I have included the participants in the analysis, I have sought to produce ideas that are relevant for their lives, and I have shared with them resources on terrorism, islamophobia, and racism. Indeed, the interpretations and analysis that I have produced after their review have sought to create an emancipatory politics, rather than social control. Further still, I shared with each of the respondents who were not police officers information provided by the American Psychological Association and Project Liberty regarding professional services to deal with fear of terrorism.
Findings
Social media, advanced communications, and changing hazard risk perception
Advanced communications and social media may be altering risk perception. By changing how people acquire information about a hazard, the quality of this information, and what they do with it once they have it, cyber-systems may be amplifying the perception of erroneous risk—a risk not necessarily based in reality. These findings are different from the 2008 data, when respondents did not mention social media as affecting their risk perception.
There was a trend of people learning about a hazard via channels separate from authorities, close friends, and local contexts. Respondents reported a cornucopia of information arriving via text message, Facebook postings, and Twitter—sometimes from hundreds of miles away—that was later found to be incorrect. Respondents noted that even major news sources, such as CNN, which they often turned to after receiving prompts from social media, were also usually relying on similar prompts in the early moments after the terrorist attacks. The respondents reported learning this information before hearing from public authorities. Only one respondent carefully deciphered information given its possible unreliability, but this respondent was in an exceptional category as she directed corporate security for a large company. The data collected in 2013 suggests that emergency managers face new complexity in managing citizen responses to hazards: social networks in the digital age are rich with information, but there is potential for much of that information to be incorrect. Cyber-systems and the activities that they support, in this case social media, seem to be amplifying risk perception. The amplification occurred vis-à-vis random and often false information, rather than in risk interpretations connected to reality.
Further, respondents reported the influence of advanced communications in how they learned about the hazard as it occurred. Because learning about a hazard influences how people ultimately adapt to it, vulnerability may be deepening at the outset of the hazard preparation and response cycle as people respond to false claims. Even respondents who relied primarily on traditional media could not escape the influence of a changed context and emergent ideas about how to exchange information. The following female respondent, 57 years old, high-income from Cambridge, illustrates how many respondents learned first about a hazard from social media even when they were regular users of traditional media. Even though this respondent suggests that she doesn’t use social media, she could not escape the engagement of her contacts with information that they had received from social media. I am really a Luddite. I read the Times almost every day and that’s how I get my news, and I don’t really watch the news on TV with any consistency. There was a story about a gunman at UMASS just before the end of school this past semester. It was false but one of my friends who loves to be out, she’s got Twitter and Facebook and all that stuff, she emailed me or texted me and said ‘Are you at school?’ And I said, ‘No, why?’ So she knew right away from Twitter that there was some problem at UMASS and she knew it before most of the people at UMASS knew it that were not tied to their social media. So, the answer to that question is: I really don’t have the experience of using all that stuff to get up-to-date information. So we were in Florida and I remember getting a text from my channel 5 WCBB app that initially there were two explosions on the marathon route in downtown Boston on Boylston Street but then my daughter, who is 17, she got the text from a friend here in Massachusetts … no not a text but a Facebook posting that was earlier than even the notification from the media came out. The kids found out about it earlier than the media did I guess. (male respondent, 53 years old, Boston, upper-middle-income)
Respondents are not only receiving information via social media, but they are spreading it too. The following respondent analyzes this process. He spread information about terrorism obtained via social media to his contacts, both family members and to friends far removed from his home location, the United States, and even the continent. My family certainly [referring to conversations he had about terrorism] … There was practically nothing else talked about by anybody for the first couple of weeks. I was online, on Facebook, on twitter. It was just the topic of conversation around here. People across the country and across the world, in Canada and England that I know on social media were asking me all sorts of specific questions about the location and what it was like and what was happening. (male respondent, 66 years old, Quincy, middle-income)
Institutions and adaptations in a changing (cyber) world
The ubiquity of information is also altering the role of space and place in engaging social contacts. While respondents in the 2008 interviews often mentioned exchanging hazard information related to terrorism at key places in their lives (such as work or home), the following respondent explains how he simply stayed at home and engaged his social contacts using text in 2013. Via this spatially circumscribed engagement, he was still able to learn information from contacts and spread some information too. This respondent also articulated confused instructions, hinting at the impact of informal information. He does not reside in a location that was affected by the restrictions on travel instituted in a few communities as authorities searched for the surviving terrorist, but he believes the entire state is under lockdown. They [referring to the state government] didn’t give us any sort of heed the warning. If anything it was sort of the global Massachusetts stay in your homes if you can, we don’t know where he’s going to be [referring to the Boston Marathon bomber]. But when they sort of started pin-pointing and they did the eight hours worth of search that … it just became another day you know? If you wanted to go out you could, but I pretty much sat glued and texted other people watching too, trying to find out what input they could give me if anything. (male respondent, 30 years old, suburb of Boston, middle-income) Watching it unfold in terms of trying to figure how it happened and why it happened, he seemed pretty proud in the end of the investigative capacity and the use of social media to connect in a way that … almost there’s a sense of security … if something like this happens it’s going to be alright. (male respondent, 76 years old, Boston, upper-middle-income) My twin brother was the religious superior of a community in Kansas and they had an honoring of him when he retired and he gave a little sermon that involves the quotations of the … this was in May so it wasn’t that far removed from the event and he sort of brought everybody to tears in reading this praise of the family who lost the brother and the family got hit pretty hard so it was a national scene in that sense … the connectedness to it. And then on Twitter I follow the Boston Police Department and Massachusetts Emergency Management, but I don’t follow all the news Twitters because they actually ended up being not very reliable during the marathon … the initial reaction to the marathon because they were reporting things that weren’t true. So you had to carefully cipher out what you thought was a reliable source. I thought the Boston Police Department actually did a pretty reasonable job. (female respondent, 54 years old, Cambridge, very high-income)
And it is not only people in their everyday lives who are rethinking risk in light of cyber-systems Table 1 lists the new concepts that emerge from this project, and it links those concepts to the participants who illuminated them and the changes that they are unleashing. In 2013, representatives from two public safety institutions reflected on the role of advancing cyber-systems in fostering greater vulnerability. In the first quote below, a representative from Boston Public Health specifically links cyber-systems to vulnerability vis-à-vis the possibility of a cascading outage. [Responding to a question about likely terrorist targets, as understood by the representative’s agency.] Our key … I would say our traditional infrastructure, so kind of the transportation, electricity, kind of the grade related things that make up the infrastructure. Everything else is built on top of that, including internet and cell towers, and then I would also say the … I would probably say the health care system. I’m trying to like parse stuff out but I think it makes more sense with the health care system because if a piece of it fails then it impacts the rest of the pieces even outside of the discipline. (Representative from Boston Public Health) Respondent: You know … and this thing here [respondent references to his smart phone]. The stuff you can find on the internet … to me it’s mind numbing. Interviewer: You mean in terms of helping people prepare for hazards … Respondent: No, helping people do harm! Concepts linked to quotations from respondents.
Conclusion
This paper sought to understand how code/space is transforming risk perception and vulnerability awareness. Utilizing a new framework that combines traditional risk hazards concepts with emergent theories of cyber-vulnerability, I explored the evolution of participants’ experience and understanding of terror violence. This has led to several findings. First, cyber-systems are facilitating transformations in traditional risk-hazards concepts, particularly vis-à-vis place and space. While Kitchin and Dodge (2011) theorized the ability of code to transform space, this paper reveals that these transformations, when applied to space and place in hazards research, are broadening the interpretation of vulnerability. People are now acquiring information from a variety of sources far from their current locations, as they did during the 2013 Boston Marathon attacks. This situation may be starting to degrade the ability of safety officials to manage community responses, particularly when the officials do not yet uniformly recognize the impact of cyber-systems on their community’s hazard experience. It also signals the need to re-engage with Coaffee et al.’s (2009) conceptualization of emergent systems of control in response to perceptions of urban terror threats. After the Boston attacks, authorities attempted to annihilate space by implementing a lockdown in several communities (see Figure 2). However, this command in effect transferred space to the cyber realm, where people enacted a wide variety of hazard personas that offer both glimpses of resilience and denial of social control, but also possibilities of greater vulnerability and oppressive security.
Second, cyber-systems are upending institutions that have structured risk-hazards and vulnerability analyses. The experience of place has changed from a location where structural elements combine to foment vulnerability (Cutter et al., 2000, 2008), to one where place is a backdrop against which a variety of characterizations of vulnerability are constructed with regard to information gleaned from quite distant places. No longer are neighbors and others who share the place the primary networks through which a hazard is understood. Indeed, one of the respondents discussed never leaving his home to talk to someone during the post-attack period in Boston, but rather learning of the unfolding hazard vis-à-vis texts, twitters, and Facebook. It seems that the dramatic acceleration of the surveillance society predicted after 9/11 (Lyon, 2003) is working two ways: ordinary citizens are subject to an extraordinary condition of surveillance by government and private entities, but they are also using these systems to look outward, surveilling the hazard-scape far from their own actual location. As the analysis revealed, the changing role of place and information exchange can be both a source of increased and decreased vulnerability. The variety of information sources, and the inability to check the information through these sources, may mean a person is greatly ill-informed. However, ideas of connectedness to a larger community also foster a sense of security, which is important to post-disaster resilience—especially psychological resilience (Barnett, 2004; Boscarino et al., 2003; Heldring, 2004).
Third, cyber-systems are signaling the need to rethink the individual in hazard situations. As one respondent pointed out, after the Boston attacks, everyone was suspected as a terrorist but everyone was also the police, looking for the criminals. This reveals the transforming role of how people use cyber-systems to respond to vulnerabilities, as well as how deeply embedded ideas of security are becoming in everyday practices. These respondents used the internet to learn information and respond, but it is unknown how else they may have used cyber-systems in both a preparatory and response mode. More research is needed to understand this dimension, particularly when public safety officials seem unaware of the changes and scholars caution about how the American public comes to accept and support a constant of war (Graham, 2008). While there is evidence that public safety officials recognize cyber-systems as critical infrastructure, that they fear cascading effects, and that they are concerned about terrorists using the internet to nurture deathly goals, there is less evidence that they understand cyber-systems and the “normal” activities that they enable as possible wellsprings of vulnerability. As Ferranti et al. (2017) remarked after studying the cascading failures of multiple systems in Lancaster, England after a flooding event in 2015, the resulting disaster was not a perfect storm of mishaps unlikely to occur again, but rather it was a harbinger of what the future is likely to hold.
In conclusion, almost 50 years ago, an entertaining film titled The Italian Job (Collinson, 1969) was released by Paramount Pictures. It depicted a successful robbery after thieves manipulated a centralized computer that controlled traffic lights in a crowded city to stop and rob a convoy carrying gold from China. The film reminds us that ideas of cyber-vulnerability have been around for a long time and that understanding this vulnerability requires a constant reexamination of existing concepts consistent with the ever-evolving cyber infrastructure and the society it supports. In that film, it was possible for hackers to halt traffic by manipulating a single computer system. Today, there is a complex web of interconnected systems with no clear overseer, and much more than traffic lights are at risk. No longer are services, such as finances, discretely bundled and received in tangible form. Rather, they are administered remotely and invisibly, as underscored by an increasing cashless society. Further, the systems that underpin Western society are not centrally located and easily identified, as they were in 1969. Finally, the single non-white person depicted in The Italian Job is an incompetent, giggly accomplice who crashes the getaway vehicle, taking the gold off a cliff and seemingly ruining the sophisticated white men’s heist. The obviousness of this racism is one interpretation. However, a second is that a relatively disempowered position within a broader society (albeit of thieves) foiled an enormous robbery with the threat of undermining the lifeblood of urban life: international trade. I began this paper by suggesting that epistemologies informed by those who were not responsible for creating code/space are needed to understand vulnerability in the current moment, and that these same people, by virtue of their less connected lives, may offer important wellsprings of information to understand contemporary resilience. This project has scratched the surface of rethinking vulnerability in an age of terror violence, cyber-systems, and transformations of code, space, and place.
Footnotes
Acknowledgments
I am thankful for the thoughtful critiques provided by the anonymous reviewers. Their comments have undeniably helped me improve the paper.
Declaration of conflicting interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author(s) disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: College of Charleston, National Consortium for the Study of Terrorism and Response to Terrorism, and National Science Foundation; Directorate for Social, Behavioral and Economic Sciences, Division of Behavioral and Cognitive Sciences (Grant number 0802718).
