Thread by @m_older

The pull quote from this piece on cybersecurity "it really comes down to individuals being prepared and being secure in their practices" reminded me about how the burden of civil defense during the Cold War was shifted to individuals. news.harvard.edu/gazette/story/…

The full context is even more telling: "But the government is not responsible for private-sector networks. And since most of the critical infrastructure in this country is operated within the private sector, it really comes down to individuals being prepared..."

#InformationIsAPublicGood and a national security issue. #Infomocracy

and it's not that individuals shouldn't be involved or prepared; that part is important. but 1/ if you compare the way governments teased at nuclear first strikes in the Cold War with someone building a "shelter" in their backyard, you get a sense for assymmetry of responsibility

and resources, which I think is roughly mirrored in this cybersecurity context. Government, eager to fuck around-> lets other governments fuck around-> people find out ->are told it's their fault for not having 2-step verification on the required account for kids' soccer team.

or something. 2/This "the government can't do it, individuals need to do their part (which is the whole part)" misses a couple of critical layers. One is community, which is usually the best approach. It was used somewhat during Civil Defense and we see those remnants to this day

And, in practice, community is important in cyberdefense too, as slacks decide on settings or people warn each other across networks about the need to update or avoid certain practices/apps. but it could be more. And a big part of the reason it's not is the OTHER missing actor,

the private sector, which controls so much of the infrastructure AND is the main conduit for most people's knowledge of available security practices AND designs the UIs that make it easier or harder to deploy those security practices. xkcd.com/936/

I'm not a cybersecurity expert (those who are, please feel free to correct/expand), but if occasionally your friend starts sending you phishing emails and has to change their password, it feels more common+devastating to hear a company has lost millions of personal data files.