February 21, 2022

The Cyber Social Contract

In the spring of 2021, a Russia-based cybercrime group launched a ransomware attack against the largest fuel pipeline in the United States. According to the cybersecurity firm Mandiant, the subsequent shutdown and gas shortage across the East Coast likely originated from a single compromised password. That an individual misstep might disrupt critical services for millions illustrates just how vulnerable the United States’ digital ecosystem is in the twenty-first century.

Although most participants in the cyber-ecosystem are aware of these growing risks, the responsibility for mitigating systemic hazards is poorly distributed. Cyber-professionals and policymakers are too often motivated more by a fear of risk than by an aspiration to realize cyberspace’s full potential. Exacerbating this dynamic is a decades-old tendency among the large and sophisticated actors who design, construct, and operate digital systems to devolve the cost and difficulty of risk mitigation onto users who often lack the resources and expertise to address them.

Cyberthreats represent a betrayal of what advocates promised at the dawn of the digital revolution.

Too often, this state of affairs produces digital ecosystems where private information is easily accessible, predatory technology is inexpensive, and momentary lapses in vigilance can snowball into a continent-wide catastrophe. Although individually oriented tools like multifactor authentication and password managers are critical to solving elements of this problem, they are inadequate on their own. A durable solution must involve moving away from the tendency to charge isolated individuals, small businesses, and local governments with shouldering absurd levels of risk. Those more capable of carrying the load—such as governments and large firms—must take on some of the burden, and collective, collaborative defense needs to replace atomized and divided efforts. Until then, the problem will always look like someone else’s to solve.

Read the full article from Foreign Affairs.

  • Reports
    • February 13, 2025
    Averting AI Armageddon

    In recent years, the previous bipolar nuclear order led by the United States and Russia has given way to a more volatile tripolar one, as China has quantitatively and qualitat...

    By Jacob Stokes, Colin H. Kahl, Andrea Kendall-Taylor & Nicholas Lokker

  • Commentary
    • CEPA
    • February 13, 2025
    France Pursues an AI “Third Way”

    This AI third way is not AI sovereignty in a traditional sense, which at a high level is a nation’s policy of placing the development, deployment, and control of AI models, in...

    By Pablo Chavez

  • Podcast
    • February 4, 2025
    The Just Security Podcast: Diving Deeper into DeepSeek

    The DeepSeek saga raises urgent questions about China’s AI ambitions, the future of U.S. technological leadership, and the strategic implications of open-source AI models. How...

    By Keegan McBride

  • Podcast
    • February 3, 2025
    The Implications of DeepSeek

    When the Chinese artificial intelligence company DeepSeek unveiled its AI chatbot just weeks ago, it shook up the U.S. tech industry and set off an AI competition. DeepSeek sa...

    By Jordan Schneider

View All Reports View All Articles & Multimedia