Technology Assessment of Dual-Use ICTs – Herzlichen Glückwunsch an *Dr.rer.nat.* Thea Riebe zur erfolgreichen Verteidigung ihrer Doktorarbeit

Thea Riebe hat am Montag, 7. November 2022 ihre Disputation und damit den letzten Teil ihrer Promotionsprüfung zum „Dr. rer. nat.“ am Fachbereich Informatik der Technischen Universität Darmstadt bestanden. Ihre Dissertation Technology Assessment of Dual-Use ICTs – How to assess Diffusion, Governance and Design wurde zuvor von dem Referenten Prof. Dr. Dr. Christian Reuter und dem Korreferenten Prof. Dr. Alfred Nordmann (Fachgebiet Philosophie und Geschichte der Wissenschaften und Technowissenschaften) begutachtet und dem Fachbereich Informatik zur Annahme empfohlen. Die mündliche Prüfung fand unter dem Vorsitz von Prof. Dr. Max Mühlhäuser (Telekooperation) statt. Neben den beiden Referenten waren Prof. Dr. Gunnar Stevens (Wirtschaftsinformatik / Datenschutz und IT-Sicherheit, Universität Siegen) sowie Prof. Dr. Arjan Kuijper (Mathematisches und angewandtes Visual Computing) als weitere Prüfer beteiligt.

Das gesamte PEASEC-Team gratuliert Dr. Thea Riebe herzlich für die erfolgreiche Verteidigung ihrer Doktorarbeit!

Technology Assessment of Dual-Use ICTs – How to assess Diffusion, Governance and Design

Information and Communication Technologies (ICTs) have become relevant for human, national and even international security. IT research, artifacts and knowledge which can be applied in military and civilian contexts, can be used as part of weapon systems or to create harm while also being beneficial are called dual-use. While AutonomousWeapon Systems (AWS) are not yet regulated, the export of cryptography has been restricted by many states as a dual-use good for decades. Advances in Artificial Intelligence (AI), robotics, cybersecurity and social big data raise questions of dual-use risks. But how can the dual-use of such diverse technologies be assessed?

Research in the life sciences has worked on assessment approaches towards dual-use as a multi-layered challenge for the research and development community and industry. Yet, there are differences between the dual-use risks of pathogen research on viruses to the research and development of autonomous systems. Thus, case studies and even a systematic approach towards the assessment of dual-use ICT, as well as how to enable dual-use sensitive and responsible design is still missing. To address the research gap, this thesis uses Technology Assessment (TA) as the epistemological framework to bring together the approaches from Critical Security Studies (CSS) to systematize the dual-use risks and scenarios, as well as participatory design method and theory Value Sensitive Design (VSD) from the field of Human-Computer Interaction (HCI). As ICTs shape everyday socio-technical systems and interactions, this thesis uses a constructivist and post-positivist perspective, which aims to enable change through the assessment of technologies and its design.

For the monitoring of dual-use knowledge and innovation diffusion, this thesis explores the diffusion between civilian and military industry sectors in expert networks by the means of both social media and patent citation. The governance of dual-use is explored in two case studies which analyze technological ambiguity, e.g. one empirical study focuses on value conflicts which lead to the challenges to regulate AWS and investigates the contradictory strategic narratives and technological requirements which prevent an effective regulation.

The following study investigates the changes and consequences of the dual-use regulation of cryptography by the US and how that feeds into the capacity for mass surveillance as a result of a combination of technological regulation and organizational dependence on surveillance intermediaries. The design of dual-use ICT in the case study of an Open Source Intelligence System (OSINT) for public cybersecurity by Computer Emergency Response Teams (CERTs) is investigated using the VSD-approach. In the three investigations (conceptual, empirical and technical) four papers identify the relevant direct and indirect stakeholders, values and value conflicts as well as design approaches for the artifact contribution CySecAlert while integrating the dual-use assessment into the design approach.

Ausgewählte Veröffentlichungen im Rahmen der Promotion:

Die Forschungsarbeiten fanden im Rahmen der BMBF-Projekte CYWARN und KontiKat sowie des TU-FIF-IANUS-Projekts DualUse statt.