Renier Van Heerden

Mercia M Malan
email: malan747@gmail.com

Francois Mouton
email: moutonf@gmail.com

Barry Irwin
email: b.irwin@ru.ac.za

Human perception of the measurement of a network attack taxonomy in near real-time

Keywords: Network Attack, near real-time, Network Attack Taxonomy

This paper investigates how the measurement of a network attack taxonomy can be related to human perception. Network attacks do not have a time limitation, but the earlier its detected, the more damage can be prevented and the more preventative actions can be taken. This paper evaluate how elements of network attacks can be measured in near real-time(60 seconds). The taxonomy we use was developed by van Heerden et al (2012) with over 100 classes. These classes present the attack and defenders point of view. The degree to which each class can be quantified or measured is determined by investigating the accuracy of various assessment methods. We classify each class as either defined, high, low or not quantifiable. For example, it may not be possible to determine the instigator of an attack (Aggressor), but only that the attack has been launched by a Hacker (Actor). Some classes can only be quantified with a low confidence or not at all in a sort (near real-time) time. The IP address of an attack can easily be faked thus reducing the confidence in the information obtained from it, and thus determining the origin of an attack with a low confidence. This determination itself is subjective. All the evaluations of the classes in this paper is subjective, but due to the very basic grouping (High, Low or Not Quantifiable) a subjective value can be used. The complexity of the taxonomy can be significantly reduced if classes with only a high perceptive accuracy is used.

Introduction

Network attacks do not have a time limitation, but the earlier its detected, the more damage can be prevented and the more preventative actions can be taken.

This paper builds on a previous taxonomy, the taxonomy is used a base to measurement of a network attack taxonomy in near real-time. The taxonomy we use was developed by van Heerden et al (2012) with over 100 classes. These classes present the attack and defenders point of view. The degree to which each class can be quantified or measured is determined by investigating the accuracy of various assessment methods.

We classify each class as either defined, high, low or not quantifiable. For example, it may not be possible to determine the instigator of an attack (Aggressor), but only that the attack has been launched by a Hacker (Actor). Some classes can only be quantified with a low confidence or not at all in a sort (near real-time) time. The IP address of an attack can easily be faked thus reducing the confidence in the information obtained from it, and thus determining the origin of an attack with a low confidence. This determination itself is subjective.

All the evaluations of the classes in this paper is subjective, but due to the very basic grouping (High, Low or Not Quantifiable) a subjective value can be used. The complexity of the taxonomy can be significantly reduced if classes with only a high perceptive accuracy is used. The taxonomy refers to both the view of the attacker and the defender with relation of network attacks, whereas other taxonomies concentrate on either attack or defend.

Table 1 is a recap the network attack taxonomy developed in van Heerden (2012) [Error! Reference source not found., Error! Reference source not found.].

Class Description

Actor

The group or individual that is performing the action of an attack.This class points to the entity that physically performs the attack, not to the person instigating the attack.

Actor Location

The physical location, such as a country or a state, from where an attack was launched.

Aggressor

The mastermind behind the attack. This person, group or organisation can be the actor or can instruct the actor to attack a network. For example, Brenner suggested that France, Russia, Japan, China, Germany, Israel and South Korea are actively engaged in economic espionage by means of the Internet and computer network attacks [Error! Reference source not found., Error! Reference source not found.].

Asset

The non-personalised item that is under attack. This class distinguishes between different assets that can be attacked. Examples of assets are information stored as data, the system that uses computers or the network infrastructure itself.

Attack Goal

The goal that the Aggressor wants to achieve. The first four goals correspond with the traditional CIA$+$+ information security principles (Confidentiality, Availability, Integrity Authentication).

Attack Mechanism

The approach used in the attack. This approach refers to the methodology that was used in the attack. This class has over thirty sub-classes which describes some of the methodologies available.

Attack Scenario

The broad categories which attacks can belong to. Further explained below.

Automation Level

The degree that the attack can be programmed automatically beforehand compared to the amount of manual effort required during the attack.

Effects

The impact of an attack and are classified as four levels: Null, Minor, Major and Catastrophic. "Null" refers to no effect on the target, "Minor" to recoverable damage and "Major" to nonrecoverable damage. "Catastrophic" refers to damage of such a nature that the target ceases to operate as an entity, for example the declaration of bankruptcy.

Motivation

The incentive for the attack.

Phase

The temporal stages of an attack. These temporal phases are developed by evaluating the most commonly used phases during an attack [Error! Reference source not found., Error! Reference source not found.].

Sabotage

The form of damage or loss that has been achieved by the attack and is classified as either physical, financial, virtual or reputational. Physical sabotage refers to physical damage to a device, Financial sabotage refers to monetary loss. Virtual sabotage occurs when computer resources are lost (such as processing, bandwidth or memory). Reputational loss is not a measurable, tangible loss but may result in other related problems for a company at a later stage.

Scope

The

Taxonomy Quantification

Each of the classes and sub-classes can either be directly or indirectly quantified. They can also be defined by the system under attack's configuration. Some classes cannot be quantified in a near real-time environment. There are three levels of quantification. This paper describes in which of the three levels of quantification each class is classified when measured. Some classes are not measured but defined by the nature of the attack and thus an accuracy of the quantification is assigned to it. Four levels of accuracy are assigned: High, medium, low or not quantifiable.

Fenz et al states [Error! Reference source not found.]: "Since the threat probability or in influencing factors cannot be determined quantitatively, a qualitative rating is used in this approach. In contrast to a quantitative rating with which it is hardly possible to determine the occurrence of a certain threat with a 67% and not with a 68% chance, a qualitative rating (e.g.high, medium, and low)"

Since the accuracy of quantifying the classes are also defined, the researcher effectively uses three levels of qualitative ratings.

Each of the classes defined in Section Error! Reference source not found. are investigated as to how they can be measured or quantified in near real-time. Some of the classes are quantified by definition, and do not require any sensors to determine their value and these classes are referred to as: Defined. For example, the target of an attack is not measured or quantified, but rather defined by the attack. Some attacks are named after the target, such as the cases of the SCO and SpamHaus attacks. Some classes can not be measured in near real-time environment. These class's values only become apparent long after an attack and even then it is sometimes only speculation. For example, the Aggressor can not be determined in a near real-time environment and for some attacks the real power behind the attack is never determined or proven.

Actor Quantification

The Group Actor sub-class and its sub-classes, Organised Criminal Group, Protest Group and Cyber Army, can be quantified by their IP addresses. An IP address can be used to find the physical location of a Group Actor. Free and subscription geolocation databases exist which claim to be capable of identifying the physical location of any IP address worldwide and the lookup of IP addresses is thus considered a direct quantification. By utilising the gained IP location, the group that owns or rents the location can be determined. The Group Actor can be determined indirectly by using the IP address.

Shavitt studied the accuracy of geolocation databases and found that the results of most databases are similar, that the accuracy cannot be trusted [Error! Reference source not found.]. Errors included wrongful estimation of distances and incorrect identification of the country. IP addresses can be spoofed, and intermediate computers located anywhere in the world can be used for attack.

For these reasons, using IP to locate the Group Actor is assigned a low accuracy. IP address location falls within the Network Layer.

The Hacker sub-class and its sub-classes Script Kiddy and Skilled Hacker can be quantified by looking at the pattern of an attack. Stoll [Error! Reference source not found.] documented one of the first hacking attempts by a skilled hacker. It was determined that the hacker was extremely skilled by printing out all the keystrokes of the attack. Script Kiddies use standardised tools of which the characteristics (or fingerprint) are static and can be identified. For example, the pattern of standard Nmap scans can easily be identified [Error! Reference source not found.]. By using an elaborate honeypot, the skill level of a Hacker Actor can also be determined [Error! Reference source not found.]. Script Kiddies will attack the honeypot directly with standard tools such as Metasploit1 with all the possible exploits, whereas skilled hackers will use more subtle techniques and only targeted exploits and also try to hide their origin [Error! Reference source not found.].

The skill level of hackers can also be deduced by the consequences of their attacks. If the attack was successful in web defacement or a secure server was compromised, it can be assumed that a skilled hacker was involved. Tripwire2 and other Host-based Intrusion Detection Systems (IDS's) can alert system administrators to compromises, although they can not prevent attacks. They notify administrators that some secure data has been accessed or modified.

For these reasons, the Hacker Actor can be measured indirectly, and the accuracy is low. Honeypot measurements fall within the Session Layer. Host-based IDS's work in the Application Layer.

Insider threats can be detected by internally-orientated honeypots or telescopes [Error! Reference source not found., Error! Reference source not found.]. These insider honeypots work according to the same principle as externally-orientated honeypots, but reside within a network and are not accessible from outside. Externally-orientated honeypots are connected to external networks and capture traffic from attackers from outside the scope of the defender's network. Insider honeypots can detect a Normal User but not an Administrator.

Administrators have access to most of the network. No network can be made safe against its own administrators, and thus administrators fall within the unmeasurable group whereas normal users can be measured directly. When such honeypots are triggered, the odds of it being an insider is low due to possible false positives or attackers masquerading as insiders. As previously stated, Honeypot measurements fall within the Session Layer.

All the sub-classes for theActor class have a low accuracy, thus is summary, the Actor class accuracy in defined as low.

Actor Location Quantification

The Actor Location class and its sub-classes can be measured similarly to the Group Actor sub-class by means of IP location. Only a single look-up in a geolocation database is required, thus it is considered to be directly measurable. The values from geolocation database are also considered unreliable, with Poese stating that these geolocation databases are accurate at a country level but not at a city level [Error! Reference source not found.]. An alternative method to find the location of IP addresses is to use latency measurements [Error! Reference source not found.]. Katz was able to achieve a medium error of 67 km in optimal circumstances. The same accuracy problems as stated for the Group Actor apply to the Actor Location sub-classes and thus the accuracy is considered to be low. As mentioned above, an IP address falls within the Network Layer.

Aggressor, Motivation, Effect and Sabotage Quantification

The Aggressor cannot be quantified in near real-time. In most cases the aggressor is only determined months after an attack. For example, it took a few months before the aggressor behind the Stuxnet attack was confirmed [Error! Reference source not found.]. The aggressor and people behind most viruses is difficult if not impossible to obtain [Error! Reference source not found.].

The Aggressor class and its sub-classes are considered as being not quantifiable. The same holds for the motivation of an aggressor, which can also not be determined in near real-time. The type of sabotage caused by an attack can only be calculated after the full impact of an attack is known, and thus can to be measured in real-time. The effects of an attack can only be quantified with a full investigation into the compromised systems and assessments of the damage done. This means that the Aggressor, Effect, Motivation and Sabotage class and its sub-classes cannot be measured in near real-time.

Asset Quantification

The Access and System sub-classes of the Asset class can be measured with automated testing scripts. These testing scripts simulate human requests at a very basic level, and can indicate when access to the system, or the system functionally have been altered. Stout stated that automated testing is critical to a quality website and his statement holds true for all servers [Error! Reference source not found.]. The scripts directly measure access and the system's functionality, and the accuracy of these quantifications are regarded to be as high, on the Application layer.

The Data sub-class of Asset class can be quantified by host-based IDS. These sensors are capable of determining alterations to data. Typically, two main aspects of the data can be measured, namely unauthorised access or unauthorised manipulation of the data [Error! Reference source not found.]. These quantification are direct and occur in the Application layer. Although there is a possibility for false alarms [Error! Reference source not found.], these quantifications are considered to have a high accuracy.

The Network sub-class of the Asset class can be quantified indirectly by looking the networking performance of devices or testing whether systems in the network can communicate [Error! Reference source not found.]. Communication errors, hardware breakdown or system misconfiguration can be possible reasons for disruption of communications. The accuracy of quantifying an attack on the network is regarded as high. Network communications are on the Network Layer.

All the sub-classes for Asset class have a high accuracy, and thus Asset class accuracy is defined as high.

Attack Goal Determination

The Attack Goal can be determined indirectly by finding the asset which is The accuracy of determining the goal is considered to be high. These determinations occur in the Application layer, and on the Network layer if the disruption is with communication.

The Gain Resources sub-class of the Attack Goal class can be determined by intercepting communications that do not fit the normal profile. Strayer developed a system that identifies networks that support malicious traffic [START_REF] Joyal | Industrial espionage today and information wars of tomorrow[END_REF] . Thus malicious traffic bound for addresses listed in their system can be null-routed. The Finding Rogue Network project has since been discontinued, but similar work is done commercially by Lastline [START_REF] Burstein | Trade secrecy as an instrument of national security-rethinking the foundations of economic espionage[END_REF] . It can be determined if local systems are being used as a springboard for attacks on others. Since this determination depends on the accuracy of the identification of malicious networks, and the possibility of misconfigured networks looking like botnets, the determination of Gain Control are considered of low accuracy.

This determination uses IP addresses as references, thus it occurs in the Network Layer.

Since five out of the six sub-classes have a high accuracy, the Attack Goal class accuracy is defined as high.

Attack Mechanism Determination

The Information Gathering sub-class of the Attack Mechanism class can be indirectly measured by detecting scans. These scans can be detected by interpreting access logs or analysing network traffic [Error! Reference source not found.]. Port scanning and vulnerability scan determination have a high accuracy rate. Port scanning is determined on the Network and Transport layers and have a high accuracy.

The Brute Force, Escalation, Spoofing, Session Hijack and Buffer Overflow subclasses can be identified by network-based IDS and by looking at access logs. These are directly identified by matching known methods to observed events. These events are defined in the Application layer. The accuracy of identifying these attacks mechanisms are high.

The Spear Phishing and Social Engineering sub-classes can be identified by specially crafted traps that lure such attackers to a fake target [Error! Reference source not found., Error! Reference source not found.]. These traps operate in the Application layer. Due to the difficulty of detecting social engineering attacks, to determine that one of these attack mechanisms was used has a low confidence [Error! Reference source not found., Error! Reference source not found., Error! Reference source not found.].

The Network Based sub-class can be identified indirectly by intercepting strange communications or by monitoring the amount of traffic on the system [Error! Reference source not found.]. These strange communications can be occur in Data, Network or Session layers. Although it is difficult to distinguish between attacks and innocent network anomalies, it is simple to detect and thus the accuracy is high.

The Malware attack mechanism can be identified either on the OSI Application layer with Antivirus software, or in the OSI Network layer by IDS software [Error! Reference source not found.]. Malware can be identified directly and the accuracy of the identification is high with a low false positive rate. False positive is when a classifier classifies some item as harmful incorrectly [Error! Reference source not found.]. Malware that is not detectable is also a concern [Error! Reference source not found.]. False negative refers to malware that is not detected. In Figure Error Since most of the sub-classes of the Attack Mechanism class have a high accuracy, the accuracy for the Attack Mechanism class is high.

Automation Level Quantification

The Automatic sub-class of the Automation Level class can be indirectly quantified by observing the scanning pattern and other features with honeypots and other scan detection sensors. Kuwatly was able to detect Nmap5 scans by training their detection systems to recognise Nmap specific scan characteristics. Similarly it should be possible to detect automated tools by their specific behaviour. A lack of automation can point to the Manual or Semi-automatic automation level. The accuracy level for these quantifications are low, since the difference between automation and the other modes are difficult to determine and thus difficult to quantify and use data from the Network and Transport layers.

Phase Classification

The Phase sub-classed can only be measured indirectly. The Target Identification and Reconnaissance sub-classes can be identified by intercepting scans. These scans can be IP or Port based, or scans that crawl through web pages. The accuracy of determining that an attack is in the reconnaissance phase is high after a scan has been detected. These scans occur in the Network, Transport, or Session layers.

The "Ramp-up" sub-class can be identified with honeypots or anomaly detectors that identify strange communications or attempts at obtaining unauthorised access. These measurements occur in the Application layer and have a medium accuracy.

The "Damage" sub-class is measured when the network, computers or systems stop working according to specifications. Host-based IDS can determine if the network is currently being damaged. It is difficult to determine if damage is being caused by an attack or by some other unrelated error, thus the accuracy is medium. Damage can be measured in the Network or Application Layers.

The "Residue" sub-class can be detected by communications similar to these in the Damage phase, but only on a limited scale. These measurements can also be influenced by other system errors and thus are considered to be of medium accuracy. Residue can be measured in the Network or Application Layers.

The "Post-Attack" sub-class can be measured by detecting unallocated communications after an attack. These are typically IP connections to and from unknown hosts at strange times. These measurements take place in the Network Layer. It is difficult to prove that the same attacker is snooping around again, thus these measurements are considered to be of low accuracy. Phase on average is of medium accuracy.

Scope and Scope Size Measurement

The target scope and the scope size are defined by the entity under attack. These classes represent physical attributes of the target, which can not be measured or quantified, but rather should be considered to be defined.

Target Monitoring

The Target class and its sub-classes can be monitored indirectly by observing which systems are not performing as expected.

The Network Infrastructure sub-class can be observed by monitoring network performance in the Network layer. Attacks that affect the PC sub-class can be observed with anti-virus software. Antivirus software monitor data in the Network, Session and Application layers. The Server sub-class can be monitored by heart-beat sensors or data integrity sensors [Error! Reference source not found.]. These sensors monitor on the Application layer.

Industrial Equipment are monitored directly via their control software [Error! Reference source not found.]. Industrial equipment can monitor communications in the Physical, Network and Application layers. Even though system problems or other errors can also lead to system failures, monitoring these classes are considered to be highly accurate.

Vulnerability Identification

The Vulnerability class and its sub-classes can be directly identified with a combination of IDS and honeypots [Error! Reference source not found.]. Although IDS can have false positives (incorrectly identify attacks), their accuracy are considered to be high.

Conclusion

In Table Error! Reference source not found., a summary of the required quantification is shown. This table lists all the classes with respect to quantification methodology and accuracy. Only five of the classes is considered quantified or measurable of high accuracy: Asset, Target, Vulnerability, Attack Mechanism and Attack Goal. Three classes are considered low: Automation Level, Actor and Actor Location. Four classed can not be measured or quantified in a near real-time environment: Sabotage, Effect, Aggressor and Motivation. The remaining two classes are defined: Scope and Scope Size and OSI layer within which the classes are quantified. The quantification are tabulated with respect to OSI layer and Accuracy level. By only considering which elements of the taxonomy can be measurement of a network attack taxonomy in near real-time. Thus by only this reduces elements are of use when looking at attacks in near-real time

  under attack. Similar to the Data sub-class of the Asset class, the Destroy Data, Steal Data, Gain Control, Spread and Change Data sub-classes can be determined by host-based IDS [Error! Reference source not found.]. The Disrupt sub-class can be determined indirectly by looking at the type of attack that is launched on a honeypot or similarly to the Network sub-class of the Asset class, by monitoring network performance [Error! Reference source not found., Error! Reference source not found.].

  ! Reference source not found. the difference between False Negative and FalsePositive is shown. The detection of Malware has a high accuracy.

Fig. 1

 1 Fig. 1 The Difference between False Negative and False Positive If a sub-system is abused, it can be measured simply by looking at at systems logs. The processing utilisation and disk usage can be measured on systems directly. Firewalls and some advanced routers can measure the network throughput, thus identifying bandwidth abuse. The detection of System Abuse has a high accuracy. A Web Application such as a SQL Injection or a Web Crawl attack mechanism can be detected directly with specially crafted traps or logging of unusual web behaviour [Error! Reference source not found.]. Error messages can also be used to detect SQL Injection attacks [Error! Reference source not found.]. SQL queries can be used to identify safe request and then identity attacks by restricting the allowed queries [Error! Reference source not found.]. Misuse of Web applications are detected in the Application layer and has a high accuracy level. XSS Web Application attack mechanisms can be detected indirectly by comparing posted URL to black-listed sites [Error! Reference source not found.], by identifying typical XSS coding patterns [Error! Reference source not found.]. The detection and prevention of XSS attack are difficult because of incomplete implementations, inherent limitations, the complexity of development frameworks and the requirement for run-time compatibility [Error! Reference source not found.]. The efficiency of this detection method is determined by the quality of the blacklist and accuracy level is low and is detected in the Presentation layer. Denial-of-Service attack mechanisms can mostly be detected by filtering incoming network traffic [Error! Reference source not found.]. Mirkovic presented a taxonomy in defences that can be used against DoS attacks, which includes: system security, protocol security, resource accounting, resource multiplication, pattern matching, anomaly detection, filtering, automated reconfiguring, rate limiting and agent identification [Error! Reference source not found.]. The accuracy of detecting DoS attack mechanisms is high. Since most of the sub-classes of the Attack Mechanism class have a high accuracy, the accuracy for the Attack Mechanism class is high.

Table 1 .

 1 Taxonomy classes

Reference source not found., Error! Reference source not found.]. These

	medium and large networks and thus the separation is a subjective
	judgement. Single size is used to present attacks on a single person
		or a single computer.
	Target	The Target The physical devices targeted in the attack, such as a
	Server, Personal computer, Network infrastructure or SCADA.
	Vulnerability	The methodology of the attack and denotes the weakness
		exploited in the attack.
	The Attack Scenario class was originally developed by van Heerden (2012)
	[Error! scenarios are:
	 Denial of Service,
	 Industrial Espionage,
	 Web Defacement,
	 Unauthorised Data Access,
	 Financial Theft,
	 Industrial Sabotage,
	 System Compromise,
	 Cyber Warfare and
	 Runaway Malware.
		network type that is attacked and are further classified into
	three types: Corporate network, government network and private
	network. Corporate networks are networks controlled by private
	companies, Government networks are networks controlled by the
	government and Private networks are networks that serves one
		person in his/her private capacity.
	Scope Size	The size of the network under attack. If the attack affects a large
		portion of the internet or multiple countries, the scope size is
	referred to as a Global network. A Large network represent large
		corporates or significant government networks such as state
	departments. There are no solid definitions that separate small,

Table 2 .

 2 Summary of the Measurement Taxonomy

	Class	Quantification	Accuracy
	Actor	Indirect	Low
	Actor Location	Direct	Low
	Aggressor	Not Quantifiable	N/A
	Asset	Direct	High
	Attack Goal	Indirect	High

http://www.metasploit.com/

http://www.tripwire.org/

http://maliciousnetworks.org/

http://www.lastline.com/

http://nmap.org


Joey Jansen Van Vuuren

Marthie Grobler
email: mgrobler1@csir.co.za

Louise Leenen
email: lleenen@csir.co.za

Jackie Phahlamohlaka
email: jphahlamohlaka@csir.co.za

Proposed Model for a Cybersecurity Centre of Innovation for South Africa

Keywords: Cybersecurity, South Africa, Centre of Innovation, national security

Most communications in the new era are dependent on Information and Communication Technology (ICT). In addition, infrastructure is becoming increasingly interconnected. This not only makes lives easier, but also leaves technology users more vulnerable. Cybercrime, digital espionage and other cyber disturbances dictate the news reports on a daily basis. In general, cyberattacks are no longer confined to small-scale rogue hackers. Cyber-attacks are now a part of organised crime and the underground economy, posing a real threat to critical infrastructure; possibly with state actors driving these actions. The responsibility to protect ICT stretches beyond individual companies, sectors and even beyond nations. The authors of this paper propose a Cybersecurity Centre Of Innovation (CCOI) as a central point for the South African government, business and academia to create a secure cyber space for the country: a cyber space without crime that is resilient and resistant to disruptions; a cyber space that promotes innovation, helps the economy and enhances national security. The key driver of the proposed CCOI is collaboration; solutions to cyber risks require a combined approach. This paper describes the organisational structure, functions, activities and benefits of a CCOI.

Introduction

The increase in African broadband access has had a significant impact on Internet access in South Africa. More rural communities are becoming integrated into the global village due to increased hardware and software corporate donations, the proliferation of mobile Internet devices and government programmes aimed at bridging the digital divide through major broadband expansion projects. These measures facilitate the rapid growth in the number of South African Internet citizens through desktop or laptop computers, iPads and mobile phones. South Africa currently has a greater exposure to cyber threats than before the significant increase in broadband availability in 2009 (Jansen van Vuuren et al. 2010); however, a large percentage of the population have not received adequate training in cybersecurity awareness, nor regular and sustained exposure to technological devices and broadband Internet access. An additional threat is that South Africa in many ways serves as the Internet entry point to the African continent and could therefore be used as a central point for launching cyber warfare type attacks on the rest of the world. Cybersecurity has therefore been identified as a critical component contributing towards National Security in South Africa.

(Jansen van Vuuren et al. 2009)

A particularly serious dimension of the cyber domain is that attacks and crimes may be orchestrated from anywhere in the world. Many countries do not have effective laws to deal with cyber crime, and there are not sufficient international collaboration and standards in place yet to deal with the complexity of these crimes and attacks.

The next section provides a motivation for the establishment of a South African Cybersecurity Centre of Innovation.

Motivation

South Africa has largely kept up with the global ICT trends and usage. While overall Internet penetration is still fairly low, in most provinces less than 10% (StatsSA 2012), the use of Internet today is essential for government, business and organisations. Further ICT development in South Africa, such as increased penetration of broad bandwidth Internet access, will lead to an exponential increase in risks as inadequate user experience, awareness and sophistication lead to increased vulnerability to cyber threats, even when counter measures exist (this holds at individual, organisation and government level).

While South Africa has not had a major cyber-attack similar to recent attacks on the United States, Estonia, Korea, the United Kingdom, Iran and Georgia, evidence points to the real possibility of an attack. Information from the South African Police Service and other sources indicate the existence of botnets (controllable malware clandestinely installed on a computer), as well as botnet control servers on South African networks. In general, these risks and threats cause a lack of confidentiality, integrity and availability of information and ICT systems belonging to government, business and citizens. Although technology is not the only defence, when threats spread within seconds they can no longer be dealt with through human intervention -technology is required to implement resilient network and service infrastructures that can mitigate against such threats. The nature of ICT systems makes it possible for a single incident to affect all systems that are connected in the same network. It is therefore not sufficient for an individual firm or government to work in solo on resolving these incidents.

Currently, the majority of Internet users in South Africa have access to the Internet from their workplaces or via their mobile phones (Jansen van Vuuren et al. 2012).

These developments indicate that South Africans are becoming more active online. In addition, an online environment has no border control such as employed in physical borders. There is no police force to guard against those entering the country online. This means that everyone who goes online is on his/her own regarding malicious and criminal activities. Users cannot protect themselves adequately from these incidents. The current situation in South Africa is that each role player in the ICT industry has their own response mechanism, of which most are not congruent with their clients, neighbours and competitors. While there is significant cyber security expertise in South Africa, the country is at risk because there is neither a national understanding nor a coherent action plan in terms of addressing cybercrime in South Africa.

In this paper the authors argue that the establishment of a Cybersecurity Centre of Innovation (CCOI) should rectify this situation. The aim of CCOI is to offer a platform for collaboration of all entities that can contribute to a secure cyberspace for South Africa.

Section 3 gives an overview of similar initiatives on other countries. In Section 4 the authors give an outline of the structure, function activities, opportunities and benefits of a CCOI. The paper is concluded in Section 5.

Similar Initiatives

A number of international cyber security innovation initiatives have been launched. This section provides an overview of some of these initiatives which serve as input to the Cybersecurity Centre of Innovation.

Advanced Cyber Security Center (ACSC)

ASCS is a not-for-profit consortium that was launched and supported by Mass Insight Global Partnerships. From its offices at MITRE in Bedford, Massachusetts, the Advanced Cyber Security Center uses the advantage of New England's unparalleled academic, industrial and research resources to develop next-generation solutions and strategies for protecting the nation's public and private IT infrastructure. The centre focuses on sharing cyber threat information, the development of innovative ways to address the most advanced cyber threats in next-generation cybersecurity research and development, as well as creating education programmes that will address the shortfall in cyber talent (ASCS 2013). The centre also functions as a cybersecurity operations centre (MITRE Corporation n.d.).

The centre has three key initiatives:

 Information sharing between expert practitioners and researchers to conduct threat analysis; identification of new threat indicators and the sharing of best practices under a Non-Disclosure Agreement. A cyber portal is used to share sensitive realtime threat information, building on the trust established at the "in person" sessions.  Research and development, and education where cybersecurity solutions are developed to address cybersecurity gaps. Provision of graduate education opportunities for new talent in the cybersecurity field.  Development of policies for federal legislation and the establishment of ASCS as best practice laboratory.

NexGen Cyber Innovation and Technology Center

The NexGen Cyber Innovation and Technology Center is aimed at preserving and protecting Lockheed Martin customer missions and addresses the greater cybersecurity challenges worldwide. It is a world-class centre designed for cyber research and development, customer and partner collaboration and innovation. At the centre, Lockheed Martin and partner technologies are integrated to create rapid prototypes to speed the innovation of solution delivery and provide seamless security. Through this meshing of innovation, technology and talent, Lockheed Martin and its partners work to solve the most difficult cyber challenges and help customers to define their own solutions (Lockheed Martin 2013).

The centre is fully equipped for live cyber technology exercises and demonstrations to help customers integrate solutions and test them in environments that are representative of their missions. The centre is the anchor point for a new Global Cyber Innovation range, enabling safe testing in both simulated and real world environments for the development of integrated cyber solutions. Some of the centre's key features include:

 Seven collaboration areas.  A Global Cyber range.  Cloud computing platforms.  A green IT data center (Lockheed Martin 2013).

Cyber Innovation Centre (CIC)

The CIC is a not-for-profit corporation located in Bossier City, Louisiana that has been established to meet growing cyber demands by promoting research, education, and technological innovation and transfer of knowledge with strategic alliances between governmental agencies, private industry and academic institutions. In order to achieve this they partner with the United States government (National Security Agency and Department of Homeland Security), industry, research and academia. The CIC uses their National Integrated Cyber Education Research Center (NICERC) to create a knowledge-based workforce and to do academic outreach.

The CIC goals are to:

 Stimulate innovation-based economic growth through strategic partnerships.

 Develop a knowledge-based workforce.

 Foster collaboration and serve as a conduit for governmental agencies, private industries and academic institutions to share ideas and advance research.  Build the necessary critical infrastructure that will attract federal programs to the area (Cyber Innovation Centre 2013).

Centre for Cyber Security Sciences (CCySS)

The CCySS in the United Kingdom was created in early 2011. It is based on the work done by research groups within the City University of London's School of Engineering and Mathematical Sciences, the School of Informatics and the Cass Business School (City University London n.d.). The Centre is invaluable through its combination of expertise in reliability, safety and security in audit and risk management. CCySS focuses its work in three critical areas. These are:

 Impact of cybersecurity on business, including impact on information risk governance, economics of security, information risk decisions.  Security of the Internet, World Wide Web and cloud, and a deep analysis of related attacks.  The evaluation and communication of the dependability and trustworthiness of complex socio-technical systems, using formal, rigorous and quantitative methods and associated evidence.

The centre's organisational structure is made up of nine core members and eight associate members. These members are active in contributing to the university's undergraduate and postgraduate programmes. The centre supports the doctoral students in research areas related to cybersecurity (City University London n.d.).

Academic Centre of Excellence for Cyber Security Research

The Academic Centre of Excellence for Cyber Security Research in the United Kingdom was created in 2012. The Centre is home to leading researchers, covering a wide range of cybersecurity related areas, including cryptography, human factors in security, end-to-end systems security, language-based security, program verification and analysis, automated program analysis, verification of computer software, vulnerability discovery, malware analysis and classification of code and the improved defences and mitigations (EPSRC (Engineering and Physical Sciences Research Council) 2013).

The Centre is tasked to assist the United Kingdom government, businesses and consumers in being more resilient to cyber-attacks by extending knowledge and enhancing skills in cybersecurity. In particular, the centre is tasked to:

 Enhance the United Kingdom's cyber knowledge base, skills and capability through original research.  Provide top quality graduates in the field of cyber security.  Support GCHQ's (the parent company) cybersecurity mission.  Drive up the advancements and the level of innovation (Information Security Group, 2013).  Address cybercrime and make the United Kingdom one of the most secure places in the world to do business in cyber space. This research will allow leading United Kingdom academics in the field of cybersecurity to connect with industry security experts and international researchers to tackle some of the United Kingdom's toughest challenges in cybersecurity. This collaborative approach between academia, industry and government will ensure that research is relevant and inspired by real world, cutting edge, security issues (EPSRC (Engineering and Physical Sciences Research Council) 2013).

3.6

Research Institute in the Science of Cyber Security (RISCC)

RISCC was created in 2012 at the University College London in the United Kingdom. The institute will work alongside the University of Aberdeen, Imperial College, Queen Mary College, Royal Holloway, Newcastle University and Northumbria University [START_REF] Kaelin | UK's GCHQ announces a new cyber security institute[END_REF]).

The institute is focused on giving organisations more evidence to allow them to make better decisions, aiding in the development of cybersecurity as a science. It collects evidence about what degree of risk mitigation can be achieved through a particular method, including the costs of its introduction and on-going costs such as the impact on productivity, to balance the total cost of ownership against the risk. The institute's main goal is to move security from common, established practice to an evidence base, the same way it happened in medicine (UCL 2013). The institute will focus on four research areas:

 Productive security by assistance to decision makers in the field of information security to make more optimal choices with respect to both the security and productivity of organisations.  Choice architecture for information security by the establishment of rigorous mathematical approaches to include uncertainty about unknowns in cybersecurity analysis in an attempt to derive a theory about the value of rigour. Research is done in terms of consumerisation, or the use in the workplace of people's own technologies.  Games and abstraction to make better decisions and the development of new approaches to decision support based on game theory.  Cybersecurity cartographies explore the methods that security managers use to develop, maintain and the use of visibility of both social and technical asset compliance behaviours for the management of cybersecurity risks (UCL 2013).

Global Cyber Security Capacity Building Centre (GCSCBC)

The aim of the GCSCBC (also referred to as the United Kingdom Cybersecurity Hub) is to understand how to deliver effective cyber security both within the United Kingdom and internationally. Its aim is to make this knowledge available to governments, communities and organisations to underpin the increase of their capacity in ways appropriate to ensuring a cyberspace which can continue to grow and innovate in support of well-being, human rights and prosperity for all (University of Oxford n.d.a)

The GCSCBC is focused on developing a framework for understanding what works and what does not work across all cybersecurity dimensions in order to identify and adopt policies which have the potential to significantly enhance our safety and securi-ty in cyberspace in ways that respect other core values and interests, such as in privacy and freedom of expression (University of Oxford n.d.-a).

The GCSCBC is focused on helping the international community increase the impact, scale and pace of cyber security capacity building by:  Investigating the drivers for current capacity building activities and the conditions required to increase resources.  Providing the scientific framework to enable individuals and institutions to measure and understand effective cybersecurity, providing an evidence base and model for supporting benchmarking, policy formation and measuring effectiveness.  Pooling, evaluating and sharing information on best practice and experiences in capacity building activities.  Creating and keeping up to date a critical guide to global expertise on cybersecurity.  Setting out what needs to be done in order to analyse priorities, and identify and close gaps in the global response (University of Oxford n.d.-b).

The Hague Security Delta (HSD) Cybersecurity

The HSD Cybersecurity in the Netherlands is a security cluster where companies, governments and research institutions work together on innovations and knowledge in the field of cybersecurity, national and urban security, protection of critical infrastructure and forensics. It was initiated by a consortium of Netherlands Organisation for Applied Scientific Research (TNO), Twynstra Gudde, the Hague University of Applied Sciences, HCSS, the Chamber of Commerce, the Netherlands Forensic Institute and the West Holland Foreign Investment Agency (HSD, 2013). The most important initiatives include:

 The Cyber Security Academy's main initiatives are a master's program in Cybersecurity and a cybersecurity traineeship that is done in close cooperation with both public and private partners. Their facilities also include a communal place or 'campus', where professionals, researchers and students meet for education, research and sharing expertise in the field of cybersecurity.  The Cyber Incident Experience Lab is used as a gaming lab where professionals and (top) managers gain new experience, insights and knowledge with respect to cybersecurity in familiar, challenging and real environments.

Cybersecurity Centre of Innovation for South Africa

This section contains details on the functions, constituency, organisational structure and benefits of the proposed centre.

The authors' preferred model amongst the similar initiatives is the ACSC discussed in Section 3.1. ACSC has managed to establish efficient processes to share information amongst government agencies, industries and academic institutions, and they have strong academic support. ACSC is funded by government and industry.

Functions

A key aspect of the centre is collaboration, since no single organisation can respond effectively taking into account that:

 Attacks are increasing in sophistication.  Current solutions are not adequate.

 Organisations want to increase the training and and sophistication of their employees and solutions (Jansen van Vuuren 2014).

The CCOI should aim to establish a partnership between businesses and industry, academia, government and research institutions and to provide these partners with a greater understanding of cybercrime and practical applications in terms of defending against these crimes. The diagram below describes the benefits of such collaboration. In addition, the CCOI must aim to be a world-class institution designed for cyber research and development, customer and partner collaboration and innovation, fully equipped for live cyber technology exercises and demonstrations required by industry and must be able to do safe testing in both simulated and real world environments for development of integrated cyber solutions.

Three key activities of the CCOI are discussed below.

The first key activity, cybersecurity information sharing, will be the coordination of collaboration to bring together expert practitioners and researchers in the field of cybersecurity.

This includes:

 Building cross sector networks and personal relations.  Sharing best practices under a Non-Disclosure Agreement.  Arrange technical exchange meetings for the exchange of technical information building of personal relationships among front-line cyber operations experts.  Identify new threat indicators.  Set-up and maintenance of a secure Cybersecurity Web Portal to enhance information sharing and access to key data.  Collaboration with the South African Cybersecurity Hub (National Cyber Security Incident Response Team), the centre to be established by the Department of Communication with the objective to pool public and private sector threat information for the purposes of processing and disseminating such information to relevant stakeholders and to promote cybersecurity in South Africa.

The second key activity, cybersecurity education and awareness, will be to expand education opportunities for workforce and pipeline in the cyber security field.

This includes:

 Development of new cybersecurity qualifications and certifications.  Expansion of education opportunities for pipeline and knowledge workers in the cybersecurity field.  Availability of bursaries, internships and studentships.  Hosting live cyber technology exercises and demonstrations required by industry.  Cybersecurity awareness training for industry and citizen to gain an improvement of cybersecurity awareness for the workforce and citizens.

The third key activity, cybersecurity research, development and innovation, will be research with the focus to development innovation solutions to improve cybersecurity.

This includes:

 Cybersecurity research to improve cybersecurity and address cybersecurity gaps.  Development of innovative cybersecurity solutions and patents.

 Appointing qualified research chairs.  Conducting quantitative cybersecurity threat analysis and red teaming.  Perform safe testing in both a simulated and real world environment for development of integrated cybersecurity solutions.

 Development of a scientific framework to enable individuals and institutions to measure and understand effective cybersecurity.  Provide support for policy development and legislation.  Protection and resilience of society, focusing on the government as a policy maker and regulator.

Cybersecurity research and development will mostly be funded by government and National Research Foundation where intellectual property (IP) will be open. Research support for industry will result in the propriety of IP.

Organisational Structure

The envisioned management and staffing requirements for the Cybersecurity Centre of Innovation is presented in Fig. 2.

Constituency

Fig. 3 shows the relationships between the constituency partners of the CCOI. The CCOI will serve as a central point for the South African businesses and industry, the academia and higher education institutions, local and international research institutions and the South African government in terms of cybersecurity. In addition, the CCIO will have a direct relationship with the South African Cybersecurity Hub. The role-players that have been identified include, but are not limited to, the following:



Key challenges

The proposed centre has to address challenges that are specific to South Africa:

 Only the banking sector has managed to establish collaboration in terms of cybersecurity information exchange. Government and the rest of the private sector will have to establish similar collaborations.  Academic institutions offer no formal qualifications in cybersecurity and no such curricula exist yet. This challenge can be addressed by establishing a group responsible for the curriculation of formal cybersecurity qualifications.

Conclusion

The establishment of the CCOI in South Africa is essential to combat the current cybersecurity threat. However, processes in South Africa make it difficult to establish collaboration. For example, although the establishment of the South African Cybersecurity Hub has started already in 2011, it is not yet operational and therefore the inherent value of collaborating with this entity cannot be fully understood. In addition, the National Cybersecurity Policy Framework and policies have not been published yet. As a result, many of the South African stakeholders are not comfortable to engage in any concrete action in terms of cybersecurity and cybersecurity collaboration. One of the reasons for the difficulty in establishing collaboration may be the lack of skills in cybersecurity. Another reason is that cybersecurity a rather vague and undefined concept. As such, there exist no concrete international agreement on the definition of cybersecurity or what exactly it is comprised of. In addition, the cyber domain tends to be volatile and fast changing, creating a competitive environment in which role players tend not to share information. This is partly because the domain is not clearly understood and roleplayers do not want to share their own personal information, but also because they do not want to give competitors an advantage in terms of work already done. Other countries experienced similar difficulties and this resulted in the development of cybersecurity innovation centres elsewhere.

An urgent need for international agreement on the definition of cybersecurity, as well as the definition of cybersecurity standards. Some efforts have been made by ISO/IEC 27032, but this standard is not commonly adopted by countries.



  Help to shape an open, vibrant and stable cyberspace which the United Kingdom public can use safely and that supports open societies (EPSRC (Engineering and Physical Sciences Research Council) 2012).

Fig. 1 .

 1 Fig. 1. Benefits of Business, Academia and Research Collaboration This CCOI must be the central point of collaboration for cybersecurity activities in South Africa. It must serve the South African cyber community by focusing on:  Cybersecurity related information sharing.  Cybersecurity education and awareness.  Cybersecurity research, development and innovation.

Fig. 2 .

 2 Fig. 2. Proposed Cybersecurity Centre of Innovation Management and Staffing

Fig. 3 .

 3 Fig. 3. Proposed Cybersecurity Centre of Innovation Relationships

  South African businesses and industry consisting mainly of South African Banking Risk Information Centre (SABRIC), Security Operations Centres and Internet Ser-Enabling cybersecurity-related early warning systems.  A less vulnerable South Africa due to an increased and thorough understanding and operational response to cybersecurity threats.  Protecting critical infrastructures based on a national information security strategy as well as local and international collaboration.  Utilising the local ICT industry and expertise in a joint effort towards the investigation and combating of cybercrimes.  Enabling the flow of innovation and knowledge from research to industrial and economic activities.  Collaborating efforts in terms of cybersecurity research, development and innovation should result in a less fragmented national cybersecurity effort, with fewer overlaps and duplications of research, development and innovation efforts.

	 Contributing to building a new generation of cybersecurity specialists.
	South African  Linking and strengthening cybersecurity pockets of excellence, both locally and
	businesses and industry  Entrepreneurial activity through research-industry partnerships and the transfer of internationally. Knowledge of new market Business opportunities development is important for education point to new research research results to the CCOI partners. avenues  Developing mechanisms for stakeholders to articulate needs and influence research
	and human capital development agendas.	Academia and
	Cyber-security Centre of  Enabling the community to utilise the implementation of South African ICT legis-higher education institutions Cybersecurity Hub lation and related standardisation.
	Innovation Some of the identified benefits of establishing a CCOI include: Skills are a key input to innova-New knowledge is the source tion
	of innovation  National recognition regarding collaboration with the South African Cybersecurity
	Hub.	Local and
		South African government	international research institutions
	vice Providers.
	 Academia and higher education institutions.
	 Local and international research institutions.
	 South African government departments.
	 International Collaboration
	-	The International Multilateral Partnership Against Cyber Threats
		(IMPACT) is the cybersecurity executing arm of the United Nations' spe-
		cialised agency -(ITU). As the world's first UN-backed comprehensive al-
		liance against cyber threats, IMPACT brings together governments, aca-
		demia and industry experts to enhance the global community's capabilities
		in dealing with cyber threats.
	-	International Centres of Cybersecurity Innovation.
	4.4	Opportunities and benefits
	Some of the opportunities that the CCOI can pursue are:
	 Collaborative development of technological competencies, as well as research,
	development and innovation leading to commercialisation or transfer of research,
	development and innovation industrialisation in the cybersecurity field.
	 Establishing a recognisable hub for coordinated cybersecurity research, develop-
	ment and innovation.


Sisse Finken
email: finken@ifi.uio.no

Christina Mörtberg
email: christina.mortberg@lnu.se

Performing Elderlinessintra-actions with digital domestic care technologies

Keywords: Performativity, intra-action, elderliness, digital care technology, smart house, participatory design

We discuss the process of meeting digital technology when entering a senior age, by taking a closer look at how different modes of independence and elderliness are (co-)constituted in relation to digital domestic care technologies. Specifically, we suggest reading independence and elderliness as shaped by both the discursive and the material. Our starting point is the notion of intraaction as introduced in Feminist Technoscience. Thinking through use and design of digital technology from a standpoint of Feminism prompts us to widen the perspective on living with such technologies and, thusly, to raise questions about the process of coming of age as an independent person with such care technologies.

Introduction

The upcoming change in demography, the so-called tidal-wave-of-elderly, is expected to bring about socio-economic challenges in Scandinavia as well as in other countries.

In meeting such changes health care services have turned to digital technology and moved from public institutions to private homes. With such move senior citizens are provided an opportunity to live independently in their own homes, rather than living in public eldercare facilities or nursing homes. Such new technology-equipped homes bring about possibilities for senior citizens to continue their daily life with all the good that living and being at home can bring. In an effort to meet today's socioeconomic challenges, the design and implementation of digital care technologies are increasing and becoming part of public welfare programs aiming to offer good care and services to societies' older population [START_REF] Jansson | Old Dreams, New Means: an exploration of visions and situated knowledge in information technology[END_REF][START_REF] Genty | Smart homes for people with neurological disability: State of the art[END_REF]. Remmers [START_REF] Remmers | Environments for Ageing, Assistive Technology and Self-Determination: ethical perspectives[END_REF], for example, argues that information and communication technology (ICT) is necessary to support older people in need of care, their relatives, and care workers.

In addition to an increased focus on ICT offered in support of aging and wellbeing, new understandings about prevailing norms and values relating to older people have emerged. In a co-design project (the Senior Interaction project [START_REF] Brandt | Communities of everyday practice and situated elderliness as an approach to co-design for senior interaction[END_REF]) concerning social network and interaction among senior citizens, the researchers became aware that the seniors studied in the project did not identify as elderly but that they talked about other people as elderly and in need of digital technologies. In drawing on the experiences gained during that project Brandt et al. [START_REF] Brandt | Communities of everyday practice and situated elderliness as an approach to co-design for senior interaction[END_REF] suggest using the notion of situated elderliness. They propose this as a way of honoring seniors' experiences, in illustrating how elderliness is situated in a practice, and how it is something that comes into existence when people and technology meet.

Barad's [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF] notion of intra-action forms a starting point for our discussion on independence, performativity, and care technology. We contribute new empirical material generated in Norway and Sweden, some of which derives from a study of lived experiences in a smart home care unit, the other of which derives from a workshop with seniors that elicited views about a possible future living with digital domestic care technologies. We have chosen to bring in these two different examples together in an effort to show how care technologies create realities through the inclusions and exclusions inherent in their designs, and how elderliness and independence evolve in unison with both discourses and materiality.

The paper is structured as follows. First we introduce the concepts of intra-action and performativity and explain how we have found them useful. We then situate digital domestic care technologies in relation to those concepts. Next we delineate the two empirical studies, their respective methods, and their respective analyses. We then enter the two empirical grounds. We conclude with specific findings from our research and some implications for design.

Intra-action and Performativity

We use the notion intra-action [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF] as an entrance to discussing how elderliness and independence are constituted in performance when senior citizens meet digital domestic care technologies. As a concept intra-action raises methodological questions that are relevant both when studying practices and when designing for everyday use of technology, for it maintains that both subjects and objects should be taken into account and accounted for as bringing about agency. Karen Barad's notion of intraaction differs from the notion of 'interaction' that is more commonly used in design studies. Interaction implies a relation between pre-existing humans (subjects) and technologies (objects) in which agency is a human or a technological attribute [5, p. 139]. The notion of intra-action, in contrast, suggests that subjects and objects come into existence only when and as they encounter each other. Lucy Suchman [START_REF] Suchman | Human-Machine Reconfigurations. Plans and Situated Actions[END_REF] captures the distinction: "Whereas the construct of interaction suggests two entities, given in advance, that come together and engage in some kind of exchange, intra-action underscores the sense in which subjects and objects emerge through their encounters with each other." [6, p. 267, original italics]. Thus, with the notion of intra-action, "Nothing is delimited as a separate entity. Everything is always engaging something else, in specific ways designated by the concepts: intra-activity, i.e. matter and meaning, object and subject, nature and culture are all mutually articulated and mutually entangled." [7, p. 68].

Within the notion of intra-action we get an understanding of Barad's [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF] grasp of 'performativity', which specifies by considering matter on par with discourse. This is captured by Heckman [START_REF] Hekman | The Material of Knowledge[END_REF]: "Barad's goal here is to formulate a materialist theory of performativity that, while not denying the role of discourse that Butler emphasizes, also does not deny the role of the material. In contrast to Butler's concept, Barad's agential realist elaboration of performativity allows matter its due as an active participant in the world's becoming (2007:136)." [p. 76, original italic].

Integrating the concept of intra-action with a feminist methodology for studying design and use is helpful as we also seek to following Bardzell & Bardzell [9] who ask: "who are involved, and in what ways?" [p. 682]. Bringing into view an understanding of the becoming of objects and subjects, and how in orchestration they bring about particular re-configurations, also emphasizes the significance of who and what is included/excluded in the practices and activities [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF] of design and use. There are no neutral positions [START_REF] Markussen | Politics of Intervention in Design: Feminist Reflections on the Scandinavian Tradition[END_REF], choices, involvements, or exclusions. That is, boundary making has "ontological implications" [8, p. 73].

Such insights are important for the analytical aim of this paper in terms of understanding how digital domestic care technologies blurs heterogeneity in a social group of people, who, with reference to [START_REF] Brandt | Communities of everyday practice and situated elderliness as an approach to co-design for senior interaction[END_REF], do not identify as elderly and in need of technologies.

In positioning ourselves at the crossroad of informatics and feminist science and technology studies we propose to understand interactions between humans and technology as material-discursive practices, in which materiality and meaning come into being when humans and technology intra-act [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF]. We use intra-action as a starting point in our discussion of meetings between subjects and objects and the reconfigurings that come into being through them (intra-actions). We hope to understand how 'elderliness' and 'independence' come about through such intra-actions (performativity); how the design of care technologies create realities through inclusion and exclusion; and how these realities are enacted and acted upon by mundane artifacts, senior citizens, care workers, researchers, and their research methods.

Digital Domestic Care Technologies

Due to asymmetrical power relations in society feminist scholars have generated knowledge about the gendering of (information) technology and the co-construction of gender and technology, e.g. [START_REF] Jansson | Old Dreams, New Means: an exploration of visions and situated knowledge in information technology[END_REF]. In doing so feminist scholars have developed a pluralistic understanding of gender-technology relations [START_REF] Jansson | Old Dreams, New Means: an exploration of visions and situated knowledge in information technology[END_REF]. Although we build on this knowledge in the present paper, we keep our main focus on performativity and intra-action.

In our previous work [START_REF] Finken | The Thinking House: on configurings of an infrastructure of care[END_REF][START_REF] Finken | HomeWork. Public care in private homes[END_REF] we have described how smart home technology is designed and implemented in homes of and for older people in Scandinavia. The implementation takes place in an effort to meet socio-economic challenges that follow from the so-called tidal-wave-of-elderly [START_REF] Thygesen | Technology and good dementia care. A study of technology and ethics in everyday care practice[END_REF]. These challenges are met by way of reorganizing health care services, moving them from public institutions into homes [START_REF] Jansson | Old Dreams, New Means: an exploration of visions and situated knowledge in information technology[END_REF], [START_REF] Roberts | Reshaping what counts as care: Older people, work and new technologies[END_REF]. Besides meeting socio-economic challenges, smart homes bring about possibili-ties for living independently at home: "Smart homes offer the promise of increased independence and reduced need for caregiver support in the home." [2, p. 210]. In order to live at home for as long as possible, older people come to live with digital devices such as alarms, detectors, and sensors that monitor bodily movements and/or (unwanted) phenomena such as smoke, water, and/or heat. These digital technologies communicate via Internet or mobile connections, and give feedback on computer screens, mobile phones, or other mobile devices according to predefined actions and/or the very absence of them [START_REF] Aldrich | Smart Homes: Past, Present and Future[END_REF][START_REF] Bjørneby | Evaluering av BESTA-installasjon i Tønsberg[END_REF][START_REF] Spingel | Designing the Smart House: Posthuman Domesticity and Conspicuous Production[END_REF]. According to Lopez et al., "Caring depends on some form of security. […]. It is a process of becoming, but one never quite gets there, as the safety provided by the home telecare service is always emerging, but never reached. That is to say, it depends on practices, technologies and bodies that follow different logicssecurity and careat the same time, in a delicate balance." [18, p. 87].

In smart home seniors come to live independently with the aid of inbuilt care technologies. Simultaneously, these care technologies introduce an economy of normativity by which residents come to perform a specific caring self in order for the technology to remain a caring aid [START_REF] Finken | HomeWork. Public care in private homes[END_REF]. That is (in pointing to an example with bed alarms, which we previously have used [START_REF] Finken | The Thinking House: on configurings of an infrastructure of care[END_REF][START_REF] Finken | HomeWork. Public care in private homes[END_REF]): the act of leaving the bed during night and not returning within the programmed time frame prompts the triggering of an alarm. Such triggering is productive when the person needs help, but rather counter-productive if the person just wants to sleep somewhere else in the house [START_REF] Fitzpatrick | Keynote at the 3rd International workshop on Infrastructures for healthcare: Global Healthcare[END_REF]. In this case, the person living at home materializes an object that can be measured by technology (see also [START_REF] Rapoport | Being a body or having one: automated domestic technologies and corporeality[END_REF]). In such measuring the heterogeneity of elderliness and independence is blurred. In other words, "Multiple positions exist at the same time, which means that identities are shaped in tensions between various positions; thereby, identities are neither uniform nor fixed but fragmented ( [START_REF] Hollway | Subjectivity and Method[END_REF]; [START_REF] Lather | Postmodernism and the Human Science[END_REF])." [23, p. 163]. One such position comes about through intra-action with the care technology in the smart home. Thus, even though senior citizens use technology in their homes to support wellbeing and autonomy, it is also important to remember that they are not a uniform group; rather, they are a heterogeneous group with various wishes, demands, and expectations [START_REF] Gunnarsson | I think I have had a good life" -The everyday lives of older women and men in a life course perspective[END_REF], who are situated in different spaces and time of different materialdiscursive entanglements [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF].

In the next section we introduce our current fieldwork settings and our methods for generating and analyzing our material.

Empirical settings -generating material

The workshop was held in December 2011 as part of the research project Sustainable Ways of Living with Technologiesdesigning with and for senior citizens and caregivers. The intention of the project was to design services with and for senior citizens in order to facilitate their day-to-day life and support wellbeing. The theme in the workshop was A Good Day, and included activities and technologies used during a good day. Three seniors, Alma, August, and Beathe, and two facilitators participated in the workshop. At the time of the workshop, the seniors were between 68-79 years old. The seniors all lived in their own homes without help (neither manual nor digital domestic care services). The facilitators asked the participants to clarify some images (brought along by the researchers from magazines, newspapers, etc.) and their daily activities. The workshop was recorded after receiving permission to do so. The participative methods used were cartographic mappings, which consist of sharing the created visual narratives by telling the other participants about mappings and future scenarios. The empirical material used in this paper is from the last activity -"imagining the future." However, the scenarios have to be considered in relation to the other activities and methods used during the entire process, that is, the doings and actions taking place in the workshop or in material-discursive practice [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF]. The cartographic mapping method, developed by [START_REF] Elovaara | Cartographic Mappings: Participative Methods[END_REF], see also [START_REF] Elovaara | Whose Participation? Whose Knowledge? Exploring PD in Tanzania-Zanzibar and Sweden[END_REF], was the first activity held after the participants and the project were introduced. In the mappings the participants illustrated a Good Day from the morning to the evening, activities they participate in, who they meet, what kind of technologies they use to facilitate their daily lives, etc. The method is inspired by both ethnographic studies and participatory methods used and developed in Participatory Design, see Fig. 1.

The events from the smart house were generated as part of a larger research-project Autonomy and Automation in an Information Society for All. The smart house is a new build care unit consisting of 91 flats. It opened in the early fall of 2012, and is certified as a 'care plus' unit, which means that safety, security, wellbeing, quality of life, and independency are central issues. According to the local municipality, senior citizens aged 67+ having impairments (e.g. rheumatism) and/or disabilities (e.g. difficulties with seeing) can rent their own flat in care plus units. In this way, a care plus home is something halfway between a private home and a nursing home [START_REF]Field material collected from the local municipality concerning care plus[END_REF][START_REF] Finken | Case Description -When Technologies Move to the Home. Chapter to appear in a book based on the A3-project "Autonomy and Automation in an IT Society for all[END_REF].

Interviews, observations, and photography were carried out with and among residents, technologies, and employees of the smart house in different situations (e.g. at home, touring the house, during work) and at different events (e.g. bingo, craft work, literature circle, and exercising in the smart gym). With a particular interest in understanding negotiations, translations, and displacements that follow when care technologies move in and are to find their place among caregivers and residents.

When analyzing our material we have engaged in readings of meetings between subjects and objects and their re-configurings. In such meetings we have especially focused on how 'elderliness' and 'independence' come about in intra-actions and we have tried to understand how the design of care technologies creates realities in virtue of what they include and exclude. Within this, 'independence' and 'elderliness' are themselves instantiations of the present that are enacted and acted upon by us. In this way, we have been sensitized to specific readings of events and situations encountered in the field. Indeed, in line with [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF], we could say that our mere presence (as ethnographer in the smart house and designer of a participative work shop) is part of the current focus on care politics, care work, and living, doing, care technology. As also noted by [29], "we want to emphasize that the "choice" of phenomenon and the "choice" of entities to be selected and foregrounded as enacted and enacting forces in the analysis (whether papers, architecture, technology, subjectivity, emotionally, socio-cultural categories, normativities, or something entirely different) depends on the researcher, on the research ambition, and ultimately on how the phenomenon in focus is demarcate and defined." [p. 351].

Smart Houselived experiences

In this section we offer three examples from our fieldwork in an attempt to demonstrate how the concept of intra-action informed our readings of events in the field.

(Example 1) When we first entered the smart house in the early fall of 2012 our attention was drawn to the entrance door of the house, Fig. 2.

Fig. 2 The door with Post-it notes and tinted foil. Photos: Finken When taking photos, 'interacting' with the door, thinking about displacements in design, talking with a care worker on a later occasion, and in analyzing our material from a standpoint of in-and exclusions, we learned about how new configurations of design and care work come about in encounters between subjects and objects.

On the large, glass, transparent entrance door, three Post-it notes were glued up. This entrance door opens automatically when one walks from outside and in; but when leaving the building, the door does not open automatically. One needs to push a button, placed to the right, at a lower position than can be reached by wheelchair. When pushing the button, the door slides open, and stays open until you are outside. Unfortunately, rather than stopping in front of the door and pushing the button, resi-dents had been walking straight into the glass. Luckily nobody was hurt in such encounters with the too transparent and not visible glass door. To prevent accidents from occurring, the care workers had glued the Post-it notes up on the glass door (interview with care worker, October 2012). The door was later 're-designed' by adding tinted foil.

We read this as an example of how in-and exclusions in the design of technology have consequences for what becomes. The transparency of the door's can be said to be hindrance to enter into the free. The very design of the sensor/manually-controlled door, in this way, is displaced to the Post-it notes and the messages and drawings they carry. The Post-it notes, as such, come to work as markers of visibility (the door become visible), and as makers of an opening (push the button down there). In addition, the care workers come to partake in designing and re-configuring the house, while the Post-it notes come to partake in performing care work by way of sustaining a safe environment and independent living for the residents.

In a report by The Norwegian Directorate of Health we also find notions about independent living. It states that use of (health and care) welfare technologies within municipalities should regard the law of municipal health and care services as a baseline. This law, among other aims, seeks to: "[…] secure that the individual gets the possibility to live and reside independently and have an active and meaningful existence jointly with others" [30, p. 21. Translated from Norwegian].

(Example 2) Another example of in-and exclusion in design of technology concerns a light sensor in a flat. According to the resident, this sensor is too sensitive to movements and sounds, in that it automatically turns on the light in unwanted situations [START_REF] Jørmeland | Displacement in Care Technology Design[END_REF]. In order to avoid such experience of interference, the resident wraps silver foil around the sensor to block its workings "at inconvenient times." [31, p. 57]. See Fig. 3. We read this situation as another example of how residents and employees of the house intervene in the design of technology to make it work. It matters what is inand excluded for independence to be in place. Within we could further add that a heterogeneity of independence and elderliness surfaces through our reading of this situation as intra-actions, that came about in a flat on a winter day in 2013 between a resident, care technology, mundane kitchen artifacts, and two field workers (the first author and a master student) who were asking questions, observing, and taking photos (field dairy, February 2013).

(Example 3) Another example also illustrates how independence and elderliness are not fixed but rather vary according to the in-and exclusions in the design of the smart house with its digital care technologies, care workers, and residents. It was the spring of 2013 while introducing new master students to the house and its workings.

Here we got to know that one of the residents spends most of the time in bedonly making a few visits to the bathroom and the kitchen (in the flat)and cannot make the light turn on by moving the arms sufficiently enough to activate the sensor in the flat (field dairy, April 2013). Bringing in intra-action to analyze such situation also passes on understandings about independence and elderliness and how they come about in multiple relations between help from care workers, care technologies, and the residents him or her self. Thus, independency and elderliness are material-discursive phenomena enacted and acted on in different locations and times [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF], [29].

With these examples from the smart house we want draw a parallel to design. Digital domestic care technologies feed on an idea of a homogenous group of citizens, through which the heterogeneity of older people also gets blurred. Callén et al. [START_REF] Callén | Telecare research: (Cosmo)politizing methodology[END_REF] make a similar point, stating that: "care technologies are generally used by people who have been considered to be vulnerable and in need of support." [p. 117]. Along these lines of thinking, there might as well be a blurring of the heterogeneity of users as described by Mort et al. [START_REF] Mort | Making and Unmaking Telepatients: Identity and Governance in New Health[END_REF] in their account of telecare. In the smart home, these users could be care personnel, residents, and relatives [START_REF] Finken | HomeWork. Public care in private homes[END_REF]. With respect to this we could say that the design of digital domestic care technologies, as many other technologies, builds on an ideal user, which, in practice, is a mere image [START_REF] Jansson | Old Dreams, New Means: an exploration of visions and situated knowledge in information technology[END_REF]. A "user", or an old person or a care worker, in our case, is someone who becomes vis-à-vis technologya someone who comes to perform as a specific "user" in order for the technology to do its caring job. With this we could say that independence is performed and intertwined with the discourses of society; thus, we find it fruitful to include performativity in design efforts, also when it concerns digital domestic care technologies.

Through the inclusion of normativity (e.g. what is expected of people of a certain age) and heterogeneity (e.g. various agencies) we learn that elderliness and independence is situated, coming into existence in various practices where discourses and materiality intra-act [START_REF] Genty | Smart homes for people with neurological disability: State of the art[END_REF][START_REF] Remmers | Environments for Ageing, Assistive Technology and Self-Determination: ethical perspectives[END_REF]. In the following we meet three senior citizens who imagine living with digital domestic care technologies.

Imagining Digital Domestic Care Technologies

The participatory design workshop was held in December 2011 with three seniors and two facilitators. At the workshop everyone introduced themselves to each other and the facilitators presented the aim of the workshop. The seniors were then asked to illustrate what a good day is like, what they are doing, and what kind of technologies they use. Following this activity, the next concerned sharing their illustrations. After the seniors had shared their stories about a good day, Maria, one of the facilitators, continued the workshop saying, "now, you have described your present day-to-day life, but can you imagine the future and how do you want life to be in the future and how do you expect things to work, then".

Here we listen to Alma, August, and Beathe's imaginations of their futures. August starts the creation of future scenarios, he says with a laugh, "a walker that moves easily". Timers are also discussed. Beathe highlights the difficulties of installing a timer to a modern kitchen stove with knobs. To this, Alma points out: "no one has thought of that one wants a modern kitchen stove". They conclude that there is a gap between the development of domestic digital technologies and the timers at disposal.

All three explain their desire to stay in their homes, if possible, but they were also aware that they probably would be dependent on some kind of help in the future. August says: "at some point, the time appears when you become dependent on others but you do not want to think so far but you are aware it will appear."

Digital domestic care technologies such as alarms and sensors are designed and implemented in smart homes to facilitate seniors' daily life and independent living and autonomy. Alma, August and Beathe discuss also these kinds of technologies when Beathe insists that it is not only elderly people that are in need of reminders; younger people also use mobiles to remember activities. But they also touch upon more intimate aspects of their daily life, Beathe says: The lively conversation continues around issues that are important for making their desire to stay in their homes as long as possiblealarms and timers, but also more intimate issues were in focus.

do
Seniors' expertise of their day-to-day life with all that it entails was in focus both in the narratives and also in the scenario building [START_REF] Brandt | Communities of everyday practice and situated elderliness as an approach to co-design for senior interaction[END_REF]. However, they located themselves in relation to today´s situation but were also able to imagine a higher degree of dependence on various kinds of digital domestic care technologies. Alarms, timers and sensors were technologies the seniors had relationships to although they were not dependent on them at the time when the workshop was held. In the imaginations, the participants situate themselves differently in relation to digital domestic care technologies. With a reading of their performances or intra-actions we identified both in-and exclusion and how both independency and dependency unfolds [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF]. Digital technologies' support and facilitation of remembering is not only a question of old or young. Both elderly and younger people are dependent on and use digital technologies. With the inclusion of mobiles and younger people remembering became not only a question for the workshop participants but also for other users. The participantsthe usersbecame subjects by identifying themselves with younger people [START_REF] Hekman | The Material of Knowledge[END_REF]. The body's presence, its lesser degree of mobility, and an increased dependence were also brought up in the participants' imaginations of their futures. When mobility, dependence, and embarrassment were included in the performances the importance of intimacy appeared. The necessity to design digital domestic care technologies to assist older people (bodies that lack both motor and cognitive abilities) in the bathroom, was important to them. Being sensitive to the more intimate aspects of everyday life is a question of in-or exclusion or where the boundaries are drawn in design of digital domestic care technologies [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF], [START_REF] Finken | The Thinking House: on configurings of an infrastructure of care[END_REF]. An awareness of elderliness (as heterogeneous), of expertise (that of the old people with respect to their own life), and of normativity (which is inherent in design choices), will help designers to better appreciate that and how elderliness and independence are situated. This might help contest the image of an ideal user and to draw boundaries in design that include all aspects of old people´s daily life.

Discussion

We have presented an alternative approach to understanding and examining 'interactions' between humans and technology [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF]. We have been interested in understanding how 'elderliness' and 'independence' come about through intra-actions in which matter and discourse are accorded symmetrical analytical importance. In bringing [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF] to serve as an analytical lens we have illustrated how the performance of independence is a process of becoming with digital care technology. Through such a reading there is no discrimination between subject/object. In other words, when performing elderliness in the smart home the person becomes an object to be sensed through its measureable presence or absence; independence becomes a specific, prescribed agency. Simultaneously, the technology becomes a subject with agency that acts (or not) on behalf of the object (the human). Subjects and objects, as such, are not prefixed from a standpoint of intra-action; rather, it is in their encounter with each other that they become and obtain their properties and boundaries [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF]. The performativity of elderliness and independence is two-fold in the reading of the smart house and the workshop participants' imaginations, in that both subjects and objects are put to work in order for a more mutual relationship to unfold. The ideal user was also contestedelderliness is situated and unstable; it comes into existence in intra-actions dependent on what is included or excluded in design. For example, when mobile phones were included remembering emerged as a question of old and young. Dependency on other subjects and objectshumans or technologiesmay also have implications for design, especially as a consequence of the human body's lack of abilities in particular contexts. Thus, it is a fruitful act to include more intimate aspects of day-to-day life when designing digital domestic care technologies. Older as well as younger people are subjects who become vis-à-vis digital technologies. Their being varies vary due to where they are located and what is included in the intra-actions.

In closing, we find it fruitful to recap the ways in which the concept of intra-action can serve as an active ingredient within the design of digital technologies or digital domestic care technologies. First of all, in moving the view of use and design from 'interaction' to 'intra-action' the awareness is steered towards an understanding of being as contingent and constituted through ongoing practices and activities, rather than as a prevailing attribute that is stable and located within a specific entity. Thus, we ask for 'changing the gender of design' [START_REF] Finken | Changing the Gender of Design[END_REF] in line with a Feminist Technoscience methodology that does not separate the discursive from the material, and, which accounts for a heterogeneity of agencies [START_REF] Barad | Meeting the universe halfway: quantum physics and the entanglement of matter and meaning[END_REF]. Within this we want to re-emphasize that there are no innocent positions. This also goes for care technologies; they are situated in use practices and are themselves practices of design. Thus questions about the inand exclusions inherent in designs have a bearing on the potentials for that which can or might become.

Fig. 1

 1 Fig. 1 Cartographic mapping. Photo: Mörtberg.

Fig. 3 A

 3 Fig. 3 A light sensor 'hacked' with foil. Photo: Finken

  I manage to keep time, to ensure that, to cook food, what kind of help do I need to facilitate this, and … last but not least do I manage to go to the bathroom, and take a shower, do we have toilets that work so I can … the most embarrassing, I think, is being dependent on someone else to help me in the bathroom. It is absolutely the worst thing I know or are you forced to use diapers depending on that care workers cannot help you frequently enoughthe most basic need, I think this is really important, one should start here [on basic needs] -other issues will also appear. Certainly one can focus on other issues but just to start, what do you need, you need food for the day and you need to go to the bathroom and you need ... here I think it is the absolute first and most important [demands], because many [services/technologies] do not exist and they [designers] don´t care enough.

Acknowledgements

Special thanks goes to care workers and participating senior citizensthis research would not have been possible without you letting us in to your world. Finken thanks The Norwegian Research Council for funding Autonomy and Automation in an IT society for All, grant # 193172. Mörtberg thanks the Faculty of Technology, Linneaus University, for funding Sustainable Ways of Living with Technologiesdesigning with and for senior citizens and caregivers. Many thanks also to three anonymous HCC11 reviewers for constructive feedback and directions on how to sharpen our paper. We also owe thanks to Katie Vann for correcting our English. Preliminary results from the study in this paper have previously been presented orally at The First Nordic STS Conference, Norway, 2013; EASST, Denmark, 2012, and CHI 2012, USA.