What happens when the traditional "analog" alternative is no longer commonly used? Digital, network dependent "upgrades" to traditional protocols and infrastructure are obviously convenient, but what happens when the network fails? When carrying "old style" ID becomes inconvenient and "unnecessary", do entire classes of services simply shut down if the network fails, suffers some sort of DOS attack (or overloaded OCSP server), or a terrorist (or unlucky backhoe) cuts an important fiber optic cable?<p>Are services like a "digital wallet" useful? How are they harmful? These questions are, of course, very important and need to be carefully investigated. However, whenever this type of technological convenience is introduced that might <i>de facto</i> replace existing protocols or infrastructure people currently rely upon, I rarely see any discussion of the ramifications of introducing technological <i>interdependence</i> and the resulting <i>transitive risk</i>.<p>Dan Geer, on this topic[1]:<p>>> The root source of risk is dependence, especially dependence on the expectation of stable system state. Dependence is not only individual but mutual, not only am I dependent or not but rather a continuous scale asking whether we are dependent or not; we are, and it is called interdependence. Interdependence is transitive, hence the risk that flows from interdependence is transitive, i.e., if you depend on the digital world and I depend on you, then I, too, am at risk from failures in the digital world. If individual dependencies were only static, they would be eventually evaluable, but we regularly and quickly expand our dependence on new things, and that added dependence matters because we each and severally add risk to our portfolio by way of dependence on things for which their very newness confounds risk estimation and thus risk management. [...] Remember, something becomes "a critical
infrastructure" as soon as it is widely enough adopted; adoption is the gateway drug to criticality.<p>>> The most telling fork in the road of them all is whether we retain an ability to operate our world, or at least the parts we would call critical, by analog means. Analog means, and only analog means, do not share a common mode failure with the digital world at large. But to preserve analog means requires that they be used, not left to gather dust on some societal shelf in the hope than when they are needed they will work. This requires a base load, a body of use and users that keep the analog working. [...]<p>>> What we have here is an historic anomaly, an anomaly where the most readily available counter to an otherwise inexorable drift into a vortex of singleton technology risk and the preservation of a spectrum of non-trivial civil rights is one and the same counter: the guarantee, by force of law where necessary, that those who choose to not participate in the digital melange can nevertheless fully enjoy life, liberty, and the pursuit of happiness, that to opt out of the digital vortex does not thereby require that they live in medieval conditions, and, by doing so, we reap a national security benefit in the bargain as those opting out are the base load for the analog alternative. [...]<p>>> And that is what I am here to tell you, that the future of humanity and cybersecurity are conjoined, so that as we prepare to make some decisions that are of the fork-in-the-road sort, we need to think it through because in making decisions about cybersecurity we are choosing amongst possible futures for humanity. Those decisions will be expensive to later reverse in either dollars or clock-ticks.<p>>> The onrushing world of full personalization means the rational decision for the individual or the small entity does not and will not aggregate into the rational decision for society at large. Perhaps that is the core effect from a rate of change up with which we cannot keep. [...]<p>>> You, we, are the masters of the universe now. What will we do with that power, which we have but a short while more?<p>[1] video: <a href="https://www.youtube.com/watch?v=gbDEbfijxNY" rel="nofollow">https://www.youtube.com/watch?v=gbDEbfijxNY</a> text: <a href="http://geer.tinho.net/geer.ncc.8x18.txt" rel="nofollow">http://geer.tinho.net/geer.ncc.8x18.txt</a>