Cybersecurity

Security is the one domain in which the kind of institutional machinery we advocate already largely exists and largely works. Threat modelling before deployment, adversarial review by people trying to break the system, coordinated disclosure with established norms, incident reporting, independent penetration testing, and review as a gate in the release process rather than as advice: all of this is routine, expected and resourced. Nobody argues that a security review stifles innovation.

None of it was true thirty years ago, and how it changed is more useful to us than its present state. Security matured when failures became visible, discrete and attributable to a named organisation; when some of the cost of failure landed on the party that had chosen the risk; when a profession formed with credentials, literature and a labour market, so that 'we could not find anyone' stopped being an answer; and when review became a gate an engineer could not route around rather than a committee that could be noted and overruled. Ethical governance currently has none of those four properties, which explains its weakness better than any claim about the difficulty of the underlying questions.

We work on two things here. The distributional question — who bears the cost when security fails, which is very rarely the party who chose the risk, and what would change if that were less true. And the transferable lesson: security did not win its argument by being more persuasive. It changed who paid for losing, and it made scrutiny a condition of shipping. Those are institutional projects rather than philosophical ones, and they are available to us.