Private Companies in Digital Security: How Private Control over Information and Knowledge Shapes Regulatory Challenges

Abstract Private companies are increasingly central to contemporary digital security practices. Their significant control of security-relevant information and critical knowledge about big data tools and artificial intelligence in security creates challenges for regulators. This paper brings insights from the literature on tech company power to critical security studies, and develops a novel analytical framework based on companies’ epistemic security position—their control over information and knowledge. It shows three distinct regulatory challenges that emerge from these positions: First, companies with control over information pose challenges due to their structural power. Second, those with technological knowledge engage in epistemic arbitrage, strategically combining different knowledge pools to position their products as indispensable security solutions. Third, companies that self-generate their information through technology tools present complex challenges due to their unique information assets and technical knowledge. By applying this framework to three key domains—electronic evidence, spyware, and facial recognition databases in law enforcement—it sheds light on current and emerging regulatory challenges at the intersection of tech and security.