Feeling Secure is Probably Not Good for You

Kelly Shortridge recently posted a fascinating essay in six parts — she calls it a ‘concept album’ — about computer security. You can read it on her website, kellyshortridge.com.

Computer security people (I’m one of them) and organizations continually recommend that you need to be aware of computer-based threats. The word for “continually aware of threats” is “hypervigilance,” and it’s not good for you. What they (or we) mean by “security” is the opposite of what the word has, historically, meant. That’s the key that opens Shortridge’s piece.

She points out that the original Latin word, securus, meant life without care; peace of mind. The opposite of securus was sollicitus, being filled with apprehension. What we in the computer security industry are urging people toward is sollicitus, not securus:

“Are there words less associated with cybersecurity than “cheerful,” “bright,” “serene, “composed,” “quiet,” or “easy”? The whole business seems antithetical to those traits. Traditional infosec is all cura and no se – better deemed “cybercurity” than cyber_se_curity: a discipline of increasing concern, thought, trouble, anxiety, and grief in the organization regarding “cyber” matters. Offensive security is especially nonsensical through this etymological lens because it then means “offensive tranquility.”

When we’re exhorting our users to hypervigilance we’re telling them to treat everyone and everything on the Internet as a potential enemy. Don’t trust anyone. In fact, the industry has a shiny new marketing message in that very vein: “zero trust.” I’m not going to get into it other than to point out that the actual processes involved in “zero trust” are the opposite of what a reasonable person would guess the phrase means. But then again, it’s a marketing slogan, so being a great example of newspeak is par for the course.

One of the fundamental ideas of capitalism is that you get to take jointly-owned things and do whatever you want with them in order to increase the profits accruing to yourself. Factory owners get to spew smoke into the air everybody breathes and pour toxins into the water that everybody uses for drinking and fishing, and there have only very recently been any consequences for them. The abstract thought experiment for this (in economics) is called the tragedy of the commons, and it’s all about how in a small historical town there’s a “commons” — say, a large field where villagers can let their animals graze. Because it’s a “free resource,” they overuse it and the commons is destroyed.

Economists apparently accepted this story as true, and (as usual for economists) never left their blackboards to try to find out how often this had happened in real life. Historians and anthropologists have done that, though, and the answer is never. Real people living in real villages are much smarter than economists ever give them credit for, and they care for their resources — even the ones they don’t individually own.

Nobody owns the Internet, and nobody owns the collective consciousness of humanity. But Shortridge’s concept album makes me think that those of us in the computer security business are a lot stupider than those villagers. Is our stance promoting fear and worry like a factory owner pouring toxins in the water? Are we contributing to the rancor, distrust, and strife that are now so easy to find on the Internet?

Maybe we’re even the root cause. To vastly oversimplify, the Internet was originally designed to be based on trust. Most of the people who worked on building it were the kinds of folks who would give people the benefit of the doubt. They didn’t have to know you to trust you. And they built that trust into the system. The checking and locking out and snooping and all that came later. Maybe it all came as a result of some bad actors. Could be. But it could just as easily have been the result of somebody seeing an opportunity to sell things — all that had to be done was to raise people’s anxiety a bit.

(And yes, I do know that the Internet was not just an academic project; it was funded by the US department of defense. I warned you it was going to be a vast oversimplification.)

Anyway, what do you think it would be like to pursue securus rather than sollicitus? As I think about it, I’m astonished at the changes I’d have to make in what I attend to, what I work on, what I think about, and the tools I use. Is that the case for everybody else? And so I have something new to worry about: maybe we’re so steeped in staying anxious that it would be quite difficult to change.

Tales from the Forest

The Maltese Ferret

“It was pretty frightening,” said Raccoon. “He had me believing I’d done something wrong, and that there was something bad happening at the party in the barn.”

“Me too,” said Hare. “I even started thinking he was a policeman.”

“And that whistle,” said Raccoon with a shudder.

“What about the whistle?” asked Squirrel.

“It was…” began Hare.

“Dirty,” finished Raccoon.

“He carries a dirty whistle around in the forest?” said Squirrel, astonished.

“That’s about the size of it,” said Hare. “I just wish he’d find out whatever he’s trying to, and go back where he came from.”

“You say,” said Dog thoughtfully, “that he’s a ferret? And he first came by a few days ago?”

“Yup,” said Hare. 

“And he’s wearing a hat and an old-fashioned raincoat?”

“And they fit him,” said Raccoon, “even though he’s pretty small. Like, you know, a ferret.”

“Hmmm,” said Dog. Just then there was a knock on the door. Something about it gave everyone in Hare’s living room a bad feeling. Except Dog; she didn’t seem bothered at all. 

“I’ll get the door, Hare,” she said. “I bet it’s him; I can tell because of the way you’re all reacting to a normal, every-day knock.

“Oh dear,” said Hare, wringing his paws.

Dog trotted to the door and opened it. It was Ferret, still wearing his old-fashioned hat and raincoat. Instead of acting the way he usually did, though, he took a half-step back when he saw Dog.

“Aha, I thought it might be you,” said Dog, opening the door wider. “Come on in, Fluffy.”

“I asked you not to call me that,” muttered Ferret on the way in.

“It’s your name, isn’t it?” grinned Dog.

Ferret noticed how all the others were shrinking away from him. “Oh never mind all that,” he said. “I quit. Anyway I don’t know any more smooth wise-guy talk. At least I won’t until Thursday.”

“Oh, what happens on Thursday, Ferret?” asked Dog in the sort of way you ask a question when you already know the answer but you want everybody else to hear it.

“It’s just a scheduling thing,” said Ferret. “Doesn’t matter.”

“I know all about Thursday,” said Dog. Turning to everyone, she said “Thursday evening there’s a special TV show at my house. Some people on the show talk about an old movie, and then they show it. Lately they’ve been showing detective movies from a long time ago. The detectives usually wear hats and trench coats like the ones Ferret has.”

Ferret fidgeted, looking uncomfortable.

“What does a TV show at your house have to do with Ferret?” asked Hare.

“Oh, not much,” said Dog, obviously enjoying herself. “Except that Ferret is from my house too.”

“You live in Dog’s house?” said Raccoon. “How come we’ve never heard of you?”

“I—I just moved in,” said Ferret. 

“Ferret — or ‘Fluffy’, as my family calls him,” said Dog, “is a new pet in our house. Little Sally — one of my people — thinks he’s cute. Andy — he’s my favorite person — explained the whole thing to me. And by the way, Ferret, make sure you put the hat and coat back with Sally’s dolls before she misses them. Remember I was explaining the Pet Rules to you? That’s Rule Five.”

“OK,” said Ferret. “Anyway, everybody, I was sleeping in my room — I have my own room, you know — and somebody turned on that TV thing. It woke me up, and I watched the whole movie. I really liked it. It was about some fake bird or something.”

“You could have just come over and introduced yourself and told us about the movie,” said Hare. “You didn’t have to scare everybody.”

“Sorry,” said Ferret. “I didn’t mean to scare anybody. I didn’t think you’d be scared. I don’t have much experience in the Outside World.”

“What I want to know,” said Raccoon, “is who hired you to be a detective, Ferret?”

Ferret shuffled his feet. “Nobody,” he said, “I just made that up to be more like the detective in the movie.”

“And nothing bad happened at the party?” said Squirrel.

“Probably not,” said Ferret. “It was just the only thing I could think of to pretend to investigate. Besides, I wasn’t invited.”

“You weren’t invited because you hadn’t moved in yet,” said Dog. “I would have taken you to the party if you’d arrived by then, Ferret.”

“You would?” said Ferret. “You’re not mad at me for making Sally like me better?”

“I told you before,” said Dog, “when you’re a pet, you’re in control of a whole household. What people think is up to us. You have responsibilities now, Ferret; you can’t just think everything is all about you any more.”

“But everything IS about me,” said Ferret. “My staff…”

“Your family,” corrected Dog.

“Right,” said Ferret, “they gave me my own room, and they bought that TV for me, and everything I like to eat, and Sally plays with me…”

“The TV was already there,” said Dog, “but it’s nice that you enjoy it. I’ve never been able to get very interested in it, to be honest. But being a pet is not just about the rewards, Ferret.”

“But doesn’t arriving at this station in life mean that I’m smarter and more attractive than almost anybody?” asked Ferret. “Isn’t it a meritocracy?”

“Not exactly,” said Dog. “We get the rewards, but it’s up to us to be in charge, Ferret. We can’t just loll around and enjoy ourselves all the time.”

“We can’t?” asked Ferret. 

Dog shook her head. “We have to be on the job 24-7, Ferret,” she said. “Goes with the territory.”

“Dog,” said Hare, “I never knew the kind of stress you have to cope with every day.”

Dog wagged her tail. “You get used to it,” she said. “And like Ferret says, there are rewards too. But Ferret and I should be getting back. We’ll see you all tomorrow. Don’t forget the coat and hat, Ferret.”

Everybody said goodby to Dog and Ferret. Hare watched them trot down the path, Ferret riding on Dog’s back. “I’m not sure I’d want all that responsibility,” he said. 

“Me neither,” said Squirrel. “Sure, they can have almost anything they want, but when would they have time to enjoy it?”

“Exactly,” said Raccoon. “I mean, I can already do whatever I want, and I don’t have to worry about how it affects anybody else. What if I was laying in bed and somebody on my staff — I mean, family — wanted to lie down too, but there wasn’t enough room? I’d have to figure out a…what to call it…a layoff, I guess. I’d feel guilty.”

Hare, Squirrel, and Raccoon nodded to each other, then closed the door. “I’m just wondering about one thing,” said Hare, offering the plate of tea-cakes to the others. “What’s Ferret going to see in next Thursday’s movie?” 

Word of the Day

Bear up, that bailiwick is right up your alley.

If someone is asked a question about an area they know nothing about, they might reply that it’s “not in their bailiwick.” Nowadays, at least, it also carries the connotation that “it’s not my job.” For some reason, there doesn’t seem to be a corresponding phrase “yes, that’s right in my bailiwick” — maybe this is a tacit recognition that nobody knows much about anything, really. But we can find out more about bailiwicks, at least.

Originally the word “bailiwick” had to do with the scope of your authority. It’s made up of two words. “Bail” is based on the Latin “bajulus”, which meant a carrier in the sense of a person; a porter. That’s where “bailiff” comes from — back in the 1300s the “bailiff” was a Sheriff’s aide; he would be responsible for his own district, which was probably the area where he lived. In Old English a “wic” was a home, so the “bailiff” was responsible for his “bailiwick”.

“Bailiff” is still in use as a legal term for the person who’s responsible for keeping order in a courtroom, which is directly related to the old Sheriff’s assistant. But “bailiff” had a more general meaning centuries ago. Remember that “bail” was somebody who carried something. In addition to the legal responsibility for carrying the Sheriff’s authority to a community, “bailiff” also meant anyone who carried almost anything. A bucket of water, for example — which is what you’d be carrying if you were bailing out a boat or ship. Or money, which you’d carry to a jail to bail out your friend who got nabbed after that brawl outside the pub. Or a baby; back in the 1400s pregnant women were called “bailiffs” before the baby was born. After the baby was born, the nannies who cared for them (and bore the responsibility) were known as bailiffs.

Nannies “bore” the responsibility after the mothers “bore” the children. Those are only two of the dozens of senses in which the word “bear” is used. There’s “bearing with” something (having patience), “bearing out” (confirming), “bearing off” (steering away, particularly with boats), “bearing up” (enduring), and “bearing down” (not the opposite of enduring; it’s either approaching rapidly, pressing on something, or trying very hard at something). The list goes on and on.

“Bear” is quite an old word; it comes from the Old English “bera”, and there are very similar words in Frisian (bar), Old Norse (bjorn), Lithuanian (beras), and Old High German (bero). Similarity like that usually means words all originated in Proto-Indo-European, and these did; they call come from “bher”. The interesting thing about “bear” is that its cognates (related words) in other languages tend to have different meanings. The Russian version, “beret”, means “he takes.” The Old Irish “berid” means carries. Several of the Germanic versions mean the color brown. And the Old Norse “bjorn” is a bear, as in the animal.

It’s easy to see the connection between the animal and the color brown, of course, but it’s doubtful that bears were ever really used to carry much of anything, and it’s not at all clear that bears were known for their sense of responsibility or duty. It’s possible there are subtle connections buried deeper in etymological texts, but I’m not going to ask you to bear with me while I bear down at bringing those to bear; I’m not sure I could bear it myself. It’s not really in my bailiwick, after all.

Leave a comment

Share