At the boundaries of peer production: The organization of Internet security production in the cases of Estonia 2007 and Conficker

With the emergence of Internet based communication and collaboration, new forms of production have surfaced that are based on openness and non-proprietary resources. The paper analyses the role of open source and peer production elements in the response to the attacks on Estonian Internet services in 2007 and the Conficker botnet in 2008/2009.While both cases can not be classified as purely peer-produced security, the two cases of incident response examined here do show some of the characteristics of peer production. By applying certain institutional techniques, the communities balance their need for secrecy with their need to widely share information.The paper concludes with an explanatory model for the observed results. For appropriate policy outcomes, it suggests greater consideration of the role of social production by researchers and designers of the organisation of Internet security.

► In this study we operationalise peer production based on five categories.
► We examine the existence of peer production in Internet security incident response.
► Internet security communities balance costs of secrecy and openness.
► Current security incentive models fail to include the social dimension.