Prototypicality and platformisation in India’s CTI ecosystem

Imagine the internet as a giant, bustling city where information flows like traffic. In this city, sometimes things go wrong: a virus might crash a computer (a "fire"), or someone might spread a lie that causes panic (a "smoke" cloud). To keep the city safe, we need a system to share warnings about these dangers. This is called Cyber Threat Intelligence (CTI). Think of CTI as the city's emergency broadcast system, where different groups share data about bad actors so everyone can react quickly.

But here's the tricky part: sharing this data isn't just about plugging wires together. It's about how the people in charge think about their jobs. In science, we know that humans often use mental shortcuts, or "prototypes," to understand complex roles. For example, we might imagine a doctor as someone who heals, or a teacher as someone who instructs. These mental pictures aren't just fun stories; they actually decide how people act, what tools they build, and how they solve problems. This paper asks a big question: If the people running India's cyber safety think of themselves as firefighters or police officers, how does that change the way they build their digital safety nets?

This research dives into India's cyber security world to see how these mental "masks" affect the technology. The authors spent two years talking to experts, from government leaders to software engineers, and even ran a special test involving fake disinformation (lies spread online) to see how the system reacted. They found that the way these people see themselves is creating a bottleneck. Instead of building a flexible, smart system that can learn and adapt, the current mindset is causing the technology to get stuck in old, rigid ways. The paper suggests that until we change these mental models, India's digital defense will struggle to handle new, tricky threats like AI-generated lies.

The Four Characters in the Digital City

The researchers discovered that everyone in India's cyber security scene falls into one of four distinct character roles. These aren't official job titles; they are the mental "masks" people wear that dictate how they behave.

1. The Firefighters
These are the heroes who rush in when a building is already burning. In the cyber world, these are the teams that fix hacked computers, stop ransomware, and clean up data breaches. They are great at putting out fires, but they have a blind spot: they only care about the fire right now.
The paper found that because these "Firefighters" are so focused on immediate crises, they ignore the slow-burning problems. When asked about disinformation (lies that spread slowly but cause big damage), they said, "We don't have the time; we're busy with real fires." They treat disinformation as a future problem, not an emergency. This mindset means they don't build tools to catch lies early; they only build tools to clean up the mess after the damage is done. They are so busy reacting that they can't plan ahead.

2. The Smoke Detectors
These are the sensors that beep when they smell smoke. In the digital world, these are the companies and tools that constantly scan the internet for bad activity. They are data-hungry and love to collect information.
However, the paper shows that "Smoke Detectors" often forget about the people who actually have to use the data. They build fancy detection systems but don't care if the "Firefighters" can actually use them. It's like a smoke detector that beeps loudly but doesn't tell you where the fire is. Also, because these detectors rely on expensive data from big tech companies (like social media giants), they can't always see everything. The cost of the data is so high that only the richest companies can afford to be "Smoke Detectors," leaving everyone else in the dark.

3. The Bystanders
These are the people standing on the sidewalk watching the fire, taking notes, and saying, "Someone should do something." In India, this role is often played by standard-setting organizations (groups that write the rules for how technology should work).
The paper found that these "Bystanders" are too passive. They wait for someone else to tell them what to do. Instead of creating new, local rules that fit India's specific needs, they just copy-paste rules from other countries. They act like a referee who only blows the whistle when a rule is broken, rather than a coach who helps the team learn how to play better. Because they are so focused on following the rules and checking boxes, they miss the chance to innovate or fix the system before a crisis happens.

4. The Danda
This is the most unique character. "Danda" is an ancient Indian word for a staff or a rod, symbolizing the power to punish. In this story, the Danda represents the authority that enforces rules through fear and punishment.
The paper explains that the Danda is the shadow that looms over everyone else. It's the idea that the best way to manage cyber security is to threaten people with fines or jail if they don't comply. The "Firefighters" and "Bystanders" often act the way they do because they are afraid of the Danda. Instead of building a system that encourages teamwork and creativity, the Danda forces everyone to just follow orders and avoid getting punished. The paper suggests that while the Danda is good at stopping bad behavior, it is terrible at encouraging new ideas. It makes people focus on "not getting caught" rather than "making things better."

The Big Test: What Happens When Lies Spread?

To see how these characters work together, the researchers set up a "stress test." They introduced a fake scenario involving disinformation (lies spread by bots and AI) and watched how the different groups reacted.

The result was a bit of a disaster. Because the "Firefighters" were busy with traditional cyber attacks, they ignored the lies. The "Smoke Detectors" had the data but didn't know how to share it with the Firefighters. The "Bystanders" were just watching and waiting for instructions. And the "Danda" was ready to punish anyone who messed up, but didn't offer any help on how to fix the problem.

The paper found that this mix of roles created a fragmented system.

• Firefighters said, "We don't have the bandwidth (time/resources) to deal with this."
• Smoke Detectors said, "We can detect it, but it's too expensive to get the data."
• Bystanders said, "We will write a rule about it, but only if someone asks us to."
• The Danda said, "If you don't follow the rules, you will be punished."

None of them were working together to build a new, smart system that could handle lies. Instead, they were stuck in their old roles. The paper suggests that this is why India's cyber security infrastructure is struggling to adapt to new threats like AI and disinformation. The mental models are too rigid.

Why This Matters for the Future

The authors argue that the problem isn't just a lack of money or technology. The problem is in the minds of the people running the show. As long as everyone thinks they are just a "Firefighter" waiting for a fire, or a "Bystander" waiting for orders, they won't build the flexible, open systems needed for the future.

The paper suggests that to fix this, India needs to change these mental prototypes. They need to move away from a system based on fear (the Danda) and reaction (the Firefighter) toward a system based on collaboration and innovation. They need to build "open" platforms where everyone can share data and work together, rather than "closed" systems where only a few companies hold the keys.

The study concludes that until these mental models change, India's cyber security will remain stuck in a loop of reacting to crises rather than preventing them. The "Firefighters" will keep running around putting out fires, the "Smoke Detectors" will keep beeping, and the "Bystanders" will keep taking notes, while the real danger—the slow, spreading fire of disinformation—keeps growing. The paper doesn't say this is impossible to fix, but it does suggest that the current way of thinking is a major roadblock that needs to be cleared before any real progress can be made.