Muddle and Match: Narrative Coherence in United States Cybersecurity Policy

ABSTRACT The Narrative Policy Framework (NPF) provides a systematic means of using narrative elements to describe how policymakers define issues, including characters, plot, and setting. In this article I introduce the concept of narrative coherence: the extent to which different narrative elements “fit” together in a logical way. Narrative coherence operates at three levels: facial validity across narrative elements, agreement across policy narrators, and consistency across issue domains. I then use narratives in U.S. congressional oversight reports on cybersecurity to generate hypotheses about the presence (or absence) and effects of narrative coherence and incoherence. Cybersecurity is a challenging policy problem for policymakers to define. The term generally refers to protection against vulnerabilities in computer systems and Internet activity, but cybersecurity has acquired multiple dimensions and causes with multiple component issues as more systems became connected to the Internet and computing changes in ways that create new vulnerabilities. I find that congressional oversight reports tell relatively coherent stories for individual component issues associated with cybersecurity, but across these component issues the overall narrative is less coherent. These findings indicate that policymakers define cybersecurity problems in different ways depending on what kind of vulnerability or problem they talk about, and calls into question the usefulness of cybersecurity as an umbrella term for some vulnerabilities. The article offers several hypotheses for further research into narrative coherence as both a dependent and independent variable.