The future of cybersecurity

With digitalisation creating a wave of change across society, governments need to respond with good policy. Policies protecting encryption, investing in education and research, and creating better systems to store data are crucial, but they don’t seem to be forthcoming, Lesley Seebeck writes.

It is wise to be wary of predictions, they’re easy to make and frequently wrong. People often over-estimate the effect of small things while neglecting slow-changing aspects of our environment, forgetting how sticky culture and everyday practice become.

Generally, we’re not good at estimating risk or understanding non-linear patterns. In the realm of technology, matters are even worse. Consider three inter-related trends, or structural issues, that tend to work together.

First, there’s digitalisation. The process of converting the world, everything people do, and even what we are, into data has made our reality liable to rapid change. This is because data, at a systems level, behaves in strange ways.

There’s nothing sanctified about data. It can be as messy, incomplete, corrupt, and misinterpreted as humans themselves. Data should be thought of as fluid, not restricted to a spreadsheet or a box in the corner of an office. It changes people, their perceptions of the world, their ability to act on the world, their business models, and their relationships, including with government.

Second, there’s deepening complexity. This is the idea that over time, systems will tend to generate subsystems, including niches that are able to be exploited.

More on this: Israel’s cyber ecosystem

Deepening complexity is everywhere in technology. Consider how much more complex a modern car is compared to its counterpart only thirty years ago. Modern cars need specialist technicians, armed with diagnostic computers, just to be maintained and repaired. There’s a convergence of technologies at play, combining software, mechanics, hydraulics, materials, and sensors.

Third, technologies need an ecosystem that surrounds them to be fully realised. Take the iPhone for example. Mariana Mazzucato identifies 12 distinct technologies underpinning the iPhone, all of which were developed in publicly funded universities or research institutions.

Beyond that, the manufacturing prowess, distribution and network capabilities, and a suite of technical standards enabling the promise of the iPhone to be realised have to come together. Then there are the apps, developers and testers, and a suite of associated products and services.

What does this kind of complexity mean for cybersecurity? Each of these trends increases the prospect of vulnerability. They create opportunities for exploitation and the chance of attack or subversion increases.

It’s easy to imagine, five years from now, a much more precarious world, one in which people cannot trust their devices, communications, or the information coming from sources they should — repeat, should — be able to trust. It’s a world that may easily be dominated by those more adept at technology than everyone else.

Classic power relations would likely prevail in that world, where the strong rule over the weak. Individuals would be given little choice but to hand over their information, lives, and identities to more dominant players.

More on this: Up from below: tackling cyber threats

Government services and interactions with citizens would become more digitalised, and commercial and foreign entities would continue to use people’s data for their own purposes. This is what could happen if our systems remain unchanged.

That’s a grim possibility, but all is not lost. It requires a major shift in mindset and a different approach to the relationship between citizen and the state and between citizens and their data. With a new approach, new technologies can help as much as they may hinder progress.

The current approach of adding ever more regulations exacerbates, rather than resolves, the current sorry state of affairs, while also ignoring those fundamental human drivers, creativity and freedom.

In a digital democracy, for citizens to be fully enfranchised they have to own their own data, as, for example, in Estonia. People are becoming digital beings, and in such circumstances, owning our own data gives us agency.

Owning data opens up the option of gaining a return for someone else’s use of it—a consideration, even if minor so that the relationship becomes a true contract, and individuals become recognised autonomous entities, rather than merely a resource to be exploited. That provides a basis, even if an incomplete one, for dealing with the growing complexity of a digitalised world.

A deeper discussion about data and data ownership will enable a clearer debate about its collection. Importantly for democracy, it can reveal how data can be used to hold government to account, rather than simply doing things for or to people with little transparency.

Given the centrality of the Internet to human lives, economies, and societies, trust in it must be rebuilt. Alternatively, policymakers must find ways to work around the mistrust inherent in Internet use and its associated technologies. The easiest, most immediate approach would be to support, absolutely, encryption.

Undermining encryption in democracies erodes trust in the Internet and affects our trust in our own societies, economies, and governments. It is especially crucial to government, considering that there are few explicit provisions around openness, transparency, and protection of individual freedoms and liberties, and few options in place for recourse in the event of broken faith.

That said, the view that everything is broken is a completely rational one given the current state of the Internet. Deepening complexity and lack of accountability in protecting data are causing problems that may lead us to a grim reality in the near future.

There must be serious thinking about alternatives. The urgency for research, for discussion, for reasoned debate and for rethinking what it means to be human in such an environment is pressing.

Policymakers must find ways to empower humans, the weaker players, through law and, perhaps, even by redressing those tilting power balances with technology. It is worth considering new and adjacent technologies and how they may reshape our world.

Frankly, that reshaping is happening already, but in the name of authoritarianism, not privacy and security. In a world of ideological, technology-fuelled competition, that illiberal regimes can now claim the scientific, technological and standards-shaping ground is, to put it bluntly, frightening.

Actions by Western governments, including the undermining of encryption, a failure to invest in education, research, and scientific endeavours, will amount to a failure to protect strong liberal values. This is not even to mention that the more prosaic failure to manage economies and finances wisely has ignored if not hastened their weakness and decline.

The future is still up for grabs, but the current plan isn’t working.