Cybersecurity, Critical Infrastructure and National Security in Developing States: A Theoretical Framework of Dependence, Capacity and Deterrence in the Digital Domain

Abstract

Developing states are digitising their financial systems, power grids, identity systems and government services faster than they are building the capacity to defend them, and they do so on hardware, software, cables and cloud infrastructure supplied by foreign firms and states. This theoretical paper develops a framework for cybersecurity as a national-security problem under conditions of dependence. Drawing on security studies and deterrence theory, on the literatures on cyber statecraft and strategic competition, on the cyber-capacity-building and cyber-diplomacy scholarship, on research on critical-infrastructure resilience, and on recent work on cybersecurity, cybercrime and digital sovereignty in Africa, it distinguishes three dimensions of the problem, dependence (the state does not control the systems it relies on), capacity (it cannot reliably detect, attribute or respond to intrusions) and deterrence (it cannot credibly threaten retaliation), and shows that the classical deterrence framework is largely unavailable to such states, whose security must instead rest on resilience, international cooperation and the deliberate management of dependence. The paper derives seven propositions about the conditions under which digitisation increases or reduces national vulnerability, about the relationship between cybercrime, which is largely a domestic governance problem, and cyber conflict, which is an international one, and about the institutional architecture appropriate to capacity-constrained states. Nigeria's financial system, power sector and digital-identity infrastructure anchor the analysis. The paper closes with implications for national cybersecurity strategy, capacity-building partners and research. It concludes that developing states should stop asking how to deter cyber attack and start asking how to remain functional when it occurs, how to govern the systems on which they depend, and how to protect their citizens from the crime that does them most harm, building security on redundancy, competence and cooperation rather than on a threat of retaliation they cannot credibly make.