WE ARE ALL TARGETS

For some time now, I have been planning to post some ideas concerning cybersecurity. Specifically, I am interested in the security of private computer systems, especially those of large corporations. Of course, the related situation initiated by Joseph Snowden, formerly of the NSA, attracted much concern as it became known that his former employer, a public intelligence agency, has been gathering information about our private communications. This incident caused an uproar as many were accusing the federal government of going overboard in its attempts to tap into any communication by Americans with foreign terrorist groups. I was not going to write about public agencies and their security concerns, but about private firms and their computer operations: how secure are they? This is important to all of us since much of our private information is recorded by these businesses especially in relation to our attaining credit and other financial matters.

My plans were disrupted by the recent breach of security that affected Target's system – that's Target as in the chain of merchandising stores. This breach jeopardized the credit and debit accounts of millions of consumers who used one of these payment options at the chain of over 1,700 outlets across the nation. If you used a credit or debit card at a Target store from November 27 to December 15, there is a possibility that unauthorized use of your account could have been used to acquire merchandise from Target outlets. The news reports covering the breach have pointed out that the problem could have been avoided if Target, in this case, and American corporations, in general, would have put in place security measures that have long been used in Europe. Mainly, the use of security chips which are imbedded into the cards would increase the security of this mode of payment many times over. Yet US corporations have shied away from implementing this and other measures due to the costs of initiating their use.

I became aware of this lack of action on the part of US businesses by reading an article by Amitai Etzioni.¹ In this article, the sociologist points out several deficiencies associated with cybersecurity. His goal was to highlight how private and public entities are intertwined and that a pattern of speech that treats these domains as separate and distinct, as much of the propaganda from the Tea Party and other conservative voices assumes, is really passe and counter to what is real. A more accurate understanding includes many points of intersection in terms of interests, structures, processes, and uses of products that bind more closely the activities of government and business operations. The Target incident just illustrates how acting as if there exists clear lines of demarcation opened the retailer to this monumental vulnerability to undetermined costs in terms of loss and potential lawsuits.

A look at Etzioni's argument is still useful. For example, one area in which the two realms, the public and the private, interact extensively concerns the military. There, both private and military entities share the cybersecurity technology. This includes software and hardware. The security products are produced by private companies and much of it in overseas production facilities such as in China. The security of these components is highly reliant on the efforts of private corporations. And this includes the components in those systems used by our military.

Security is not limited to the concerns of the military or other government departments and agencies (think Social Security, publicly run or supported health facilities, education records, and the like), but also private business concerns as well. Etzioni reports, for example, that the level of crime in areas of finance via the use of computers has grown significantly. One would think that private concerns would be highly worried over such crime and be highly motivated to address it in order to at least ameliorate its effects if not eliminate it altogether. Despite the crime, the fact is that computer systems are not so structured as to lend themselves to security enhancing options. That is, fixing the problem or even lessening it would be very costly. To date, the costs due to crimes such as bank thefts and spying between businesses are not high enough to match the costs involved in installing appropriate security technologies and protocols. Also, incidences of thefts or other fraudulent behaviors often do not come to light so quickly. It usually takes years before knowledge of such crimes becomes evident. This lag delays any acknowledgment that security investments are paying off. And any time payoffs are not recognized in the short term, they are not registered as gains on the quarterly bottom line report, whereas the costs associated with security investments are reported. All this negatively affects stock prices. In other words, taking on costs to meet problems that are hidden is not a recipe for a CEO's job security.

But doesn't all this mean that costs, be they recognized or not, go up and, therefore, in concentrated markets – ones in which there is little competition – are simply added to the prices of whatever products are affected? Or, put another way, doesn't this mean the consumers of any affected product have to pay more for those related goods and services? Yes, it does and that further means consumers have an interest in seeing that affected businesses become more efficient and less wasteful of funds that are going to crooks. If private entities can't or won't do what's necessary, then government has a role in addressing the concern – and adding to the existing interaction between both realms.

I don't need to reproduce Etzioni's report. You get the gist of his concern. The point here is that we are talking about national and even global entities. A lot of our present debate is how big a government we need, how big it can be and still be constitutional, and how big it can be without undermining the democratic quality of our governance. These are legitimate questions posed by conservatives. Traditional federalists have all along been sounding the alarm about the centralization of power due to the growth of our central government. Yet one needs to be realistic about the actual conditions that are out there. Bigness in the private sector is not imaginary. We no longer just have national businesses; we have transnational corporations. By necessity, our national government has to come to terms with that bigness. It has to regulate those entities to fulfill our need for safety and security. These technological advances that have opened us up to these security problems are just one of many areas in which our interests as private citizens are exposed to the potential threats represented by what happened to Target. I am sure that retailers and other types of businesses are reviewing their security policies and rethinking their opposition to regulation by government over these matters. Liberated federalism, if it is to be viable, has to amend its insistence on small government; yes, be reluctant to handing over more power to Washington and be protective of local governmental prerogatives, but be sensible when the issues become national and even global, and understand the potential dangers to our safety, security, health, education, and morals by large scale predators. Bad guys no longer need to wear hoods and brandish guns to do their harm. Their damage can be quite effectively accomplished by clicking on a machine.

1Etzioni, A. (2013). The bankruptcy of liberalism and conservatism. Political Science Quarterly, 128 (1), pp. 39-65.