## 3 Methodology
### Interviews  
Primary data were collected through 42 in-depth semi-structured interviews lasting 60-90 min with experts in security, law, policy, maritime security, and cybersecurity from academia, government, and NGOs in two sets from Southeast Asia and Europe/UK. Interviewees were based in multiple relevant countries including the following: Indonesia, Singapore, Malaysia, UK, Netherlands, and US. Participants were identified using a purposive sampling strategy based on a combination of key factors: the individuals' employing organisation, the relevance of their role/remit, their career history and experience in respect of engaging with law, policy, and regulation in cybersecurity, technology, shipping, and maritime security, to ensure informed responses to the research questions. A semi-structured approach including a variety of mainly open-ended questions meant the line of questioning was consistent while allowing for elaboration in response to a participant's particular area of expertise. Participants came from a cross-section of government and regulators, including representatives from national government agencies and NGOs in the littoral states of Indonesia, Singapore and Malaysia, including the National Maritime Institute (NAMARIN Indonesia), the Indonesian Coast Guard agency (Badan Keamanan Laut, BAKAMLA), Indonesian National Police (POLRI), Indonesian Navy (TNI AL), the Maritime Institute of Malaysia (MIMA), the S. Rajaratnam School of International Studies (RSIS) Singapore, as well as other representatives from industry, academia, and independent researchers and authors, in the UK, Europe, and Southeast Asia.  
All interviews were conducted either face to face at the interviewees' workplace, or by videoconference using Microsoft Teams Version 24033.811.2738.2546. Potential interviewees were provided with a standardised project information sheet and inclusion was contingent on prior informed consent. Interviews were anonymised using 'broad role descriptors' (except where subjects elected to be identified) and transcribed for data analysis. Transcripts were thematically coded. Iterative interview transcribing and coding ran in parallel with conducting interviews.  
Questions were reactive to the information provided by the interviewee so could not be fully prescribed in advance, but addressed relevant key themes of emerging technologies, security challenges arising from such technologies, threats to maritime security, cybersecurity law, regulation and policy, and recommendations to improve security outcomes in the field. An indicative outline interview schedule was prepared in advance and used as a guide for individually tailored interviews. While the research included examination of the threat from terrorist groups in the countries of South East Asia (SEA) bordering the Malacca Strait, i.e., Indonesia, Malaysia, and Singapore, it focussed solely on the legal, policy, judicial, and regulatory aspects of these criminal phenomena and did not involve directly interviewing vulnerable subjects such as convicted criminals or suspects.  
Interviews were audio recorded and notes were taken during each interview as a backup. Transcripts were thematically analysed using Nvivo 14 (see below). Relevant interview insights are incorporated across discussion sections below and key quotations provided.