The Internet allows humans anywhere around the globe to acquire the best available technical education and to use that education to pursue a wide variety of objectives on digital networks. One objective can be to build a great repository of human knowledge. Another objective can be to attack an organization and do great harm. The brain-power economics on the Internet make achieving cybersecurity a much different problem than achieving traditional military security.
Consider, for example, the traditional military security of Norway. Invading Norway by traditional military means requires equipping and training soldiers and securing expensive transport via land, water, or air. A high degree of centralized organization is necessary for traditional military action. Groups of persons that might present a traditional military threat to Norway are particular nation-states. Those possibilities are quite limited.
Cybersecurity of Norway and organizations in Norway depends on a much different configuration of possible threats. The total population of Norway is roughly 850 times smaller than the world population in countries whose average income is less than one-tenth that of Norwegians.[1] Lower income implies a lower opportunity cost of brain time. The upper end of the distribution of natural ability and interest in technical programming among Norwegians surely differs relatively little from that among others. Norwegian technical brain-power could hence easily be overwhelmed by the brain-power of a small share of other persons elsewhere in the world.[2] No cybersecurity technology can protect against greater brain-power, because cybersecurity fundamentally depends on brain-power. Trying to buy cybersecurity tools or expertise is fundamentally futile. With the aggregation of enough brain-power, any cybersecurity Maginot Line can be breached.
A civilized, forward-leading approach to cybersecurity would depend on widely dispersed technical skills and capabilities and open projects that do good. Based on the evidence of the world and faith, doing good seems to be more attractive to most humans than doing harm. Most persons will participate in, support, and defend, in ways feasible for them, projects that do good. For any small subset of brains in the world, seeking to deprive persons of technical skills and capabilities and strictly guarding project boundaries ultimately lessens cybersecurity.
* * * * *
Notes:
[1] Figures calculated from World Bank’s International Comparison Program data for 2005 (the most recently available year). Average income (equivalent to expenditure in national income accounting) is in purchasing-power-parity terms. Brain-power, scaled by opportunity cost, is overall more than 10,000 times greater outside Norway than within Norway.
[2] The population of Norway was 4.6 million in 2005. The brain-power imbalance problem is orders of magnitude greater for an organization of about 500 persons. Of course, some pooling of expertise is possible. On the other hand, considerable heterogeneity and customization exists in information systems across organizations. Providing cybersecurity requires considerable organization-specific brain-power utilization.