Blog

Alec Muffett and why cybersecurity is "rubbish"

Is the use of the word "cyberspace" a badly chosen metaphor that is leading us down the wrong path? Alec Muffett (Twitter: @alecmuffett) asked this question tonight at Defcon London (Twitter: @dc4420) as part of a talk on how to think about cybersecurity.

His argument goes something like this. Consider the prefixes in common use with respect to the Internet.

Virtual is good (virtual reality); e is dull (email, ecommerce…); i is Apple; cyber is bad or profane: cybercrime, cybersex, cyberwar, cyberbullhying, cyberterrorists…

Pause to review some of the figures that have been bandied about that are supposed to quantify the amount of cybernastiness out there.

The security consultancy firm Detica (now part of BAe Systems) estimated in February that cybercrime cost the UK £27 billion annually. Earlier this month, Symantec put that number at $114 billion – and then added another $274 billion in lost time. $388 billion, globally. In 2009, McAfee estimated the global cost at $1 trillion

Would it be simpler just to say, "We don't really know how much it costs, but we think it's a lot"? Do politicians even understand why these reports are questioned? Or why there's no such measurable thing as "British cyberspace"?

"Metaphor drives perception," he said, If cyberspace is a place where dangerous things happen, then it's a new three-dimensional theater to add to land, sea, and sky, where governments can take charge and military can seek to command and control.

Instead, substitute "telephoneworld" for "cyberspace" in some of our politicians' latest pronouncements. Try, for example, "Telephoneworld is at the heart of modern society." (Or, as Muffett did not say, try Declaration of the Independence of Telephoneworld.)

My own feeling is that "cyberspace" is largely falling out of use other than by governments (lagging behind the times), old Net curmudgeons, and journalists, for whom "cyberspace" and "cyber"-anything is a handy and efficient shorthand. When you had to dial a modem to go to a particular online location – the WELL, or CIX – you had a much greater sense of going to a particular place where your friends congregated. When you logged onto the WELL and read the news conference, you had the sense of being in the WELL kooking out at the world. When the WELL developed a Web interface, reading the same (or any other) conference felt more like being outside the WELL looking in. Facebook, for all its walled garden approach, doesn't feel like a where at all; it has no sense of place. Twitter is even more clearly just an application on my desktop or mobile phone; it feels like what it is: fast-paced multi-platform messaging.

But either way, for Muffett the damage is done, and the "space" metaphor was a bad mistake.

You can argue with him about this in person when he delivers a fuller version of this talk at the Oxford BCS meeting on Thursday September 22nd, or October 13 at Portsmouth Skeptics in the Pub (Twitter: @sitpportsmouth).

wg