Looking at the world in the early 21st Century, it's possible to see things in two different ways: on the one hand, you have the vertically-delineated world of nations.  Indeed, many of the recent developments in politics can be seen as the reinforcement of the age-old relevance of the nation-state - Brexit, Trump, Chinese sabre-rattling etc.  On the other hand, however, there are plenty of things that seem to work horizontally, cutting across national boundaries: environmental measures, pandemics, financial markets and technology.

The issue comes when you try to square the vertical with the horizontal.  And it's an issue that gets ever bigger, as the horizontal forces grow stronger.  I wrote in an earlier blog about the risks that populism pose for the cloud architecture, depending as it does on borderless access.  The risk flows the other way too, as the supranational challenges of the environment, financial stability, the pandemic and the internet could render a national government superfluous, save for the assiduous execution of multilateral accords.  Wriggle as it might, the UK government's efforts to "take back control" have simply highlighted how little room for manoeuvre there is to plough its own furrow - its trade, welfare, and fiscal policies all look remarkably similar to its neighbours'.  The danger is that governments try to camouflage their limited power by popinjay politics, picking fights with those aspects of the multilateral norms that suit domestic opinion polls.

It is interesting that, as horizontal influences strengthen, so do our powers of denial.  I have written before about the extraordinary sniffiness many in the UK have towards technology and numbers:  it's a badge of honour to be pap with machines.  We also call this horizontal march "globalisation", as if conveniently to label it as a conscious (and deliciously reversible) policy.  Our talking shop parliaments, filled with talkers, wish for a world controllable by talk.  Sadly, the logic of global capital markets and technology do not listen to talk, and certainly not national talk.  Much as we would like to define our own versions of these things, it is doomed and as parochial as those in English regions and cities who fought to keep local time in the face of the march of the railways in the Nineteenth century.

How are the horizontal influences strengthening?  In addition to culture, the existence of the nation state owed much to its necessity: To do something, you needed to be somewhere.  That is rapidly becoming unnecessary.  Even internet access, hitherto dependent on local infrastructure (and so local control) will increasingly be available anywhere you can see the sky, which is frightening the heebiegeebies out of the Russian and the Chinese governments.  Travelling?  The infrastructure needed to do so internationally inevitably invokes a border trigger (bar the odd smuggler).  What happens when a VTOL drone can move you 300 miles? Ordinary (if wealthy) people can then make their travel arrangements free of government purview, in the same way as the advent of the eurobond market created "moneyland" for people's financial arrangements.  My point is not that these developments are good or bad (and, in the case of money, it has definitely caused issues), but that they will come, and will necessitate a reaction better than denial. 

How do hyper-vertical organisations react?  The history of national tax agencies in the teeth of moneyland shows how hard it can be.  Even the Americans now see the benefits of international cooperation on tax, which perhaps shows the way for other agencies.  The UK's first attempt at carbon pricing will mean nothing until it builds the links to the European equivalent, for instance.  Perhaps the most interesting challenge lies with those vertical institutions whose role is at least in part, the opposite of cooperation: national armed forces.  Possessing an ancient hammer, there is a danger that everything continues to look like a nail - cyberspace becomes just another vector of battle, they might say.  Except that it isn't: warfare in this space is like a competition to chuck the most powerful brew down a communal well - everyone ends up poisoned.  Almost all the most damaging cyber incidents that we know about that have affected the West - Notpetya, Wannacry - contained major elements actually first built by Western Cyber Agencies.  They are on the horns of a particularly difficult dilemma.  They are paid to be the State's ultimate insurance, standing up to threats and possessing the nation's monopoly of violence.  In that context, they are pushing back against authoritarian regimes like Russia and China.  But in so doing, they unwittingly become those nations' accomplices in the strengthening of national boundaries that cut across the global technology commons, a commons profoundly dangerous to authoritarianism.  And in so doing, they might find themselves more at home with their adversaries' social and patriotic values than those of the people they are paid to defend.

Oh no, I hear you say.  Another exhortation from someone in IT about how I should not write passwords down/have unique ones/not click on dubious emails.  Not so fast!  It's actually to make the point that the risk picture for information is much more nuanced than IT would have you believe.

Notice that I use the word information, not the acronym IT: they are two different things.  For a start, most security policies start and stop at the frontiers of the technology: how many businesses properly have controls on what papers can be carried out of the office?  In many ways, more dangerous - they can be read without a password and cannot be remote-wiped.  Secondly, mistaking IT for information means that businesses have outsourced the management of their information to computer people, who (typically) prefer the binary of the motherboard to the ambiguities of real life.  Thus they have built networks of technology into The Network, centered around the needs of those who manage that Network, not those for whom technology is supposed to serve.  Everything becomes deliciously un-nuanced: things are either On the Network or Off It, trusted or not.  The only risk becomes one of penetration.  Simples.

Except it's not in the real world.  Even before this COVID emergency, being in a different place from The Network was not exactly unheard-of: salespeople on the road, and the awkward presence of business partners in a value chain that did not sit inside a Network.  Still, configure a VPN and offer people the chance to get their emails on their phone should do the trick.  Er no.  A Network makes the mundane internal communication easy, the valuable inter-company connection really difficult. 

The point I am trying to make is that there are more risks to information than just penetration.  If you put the word information in front of the word security you typically mean the challenge of preventing unauthorised access to that information: if you put the word energy in front instead you are often talking about the challenge of maintaining supply.  And it is this risk of non-supply of information that is the one suddenly confronting businesses as they realise that, for all their trumpeting about twenty-first digitisation, they are really no less dependent on the analogue infrastructure of the office than their nineteenth century counterparts, whizzing internal memos about through compressed air tubes. 

Ironically it is those businesses most obsessed with the first risk of penetration that have made themselves most vulnerable to the second: IT bods have obsessed themselves with the "risk" of putting stuff in the cloud.  It is now obvious that it has been hugely risky not to.  The risks of confidentiality in the cloud can be managed: the absence of a proper network (with a small n) of information outside the office cannot be fixed with the sticking plasters of a VPN and a hurried subscription to Zoom.

When (I hope) things return to a more normal footing, and after thanking the IT department for their heroics in working all hours to apply emergency measures, perhaps a question or two needs to be addressed to the IT headshed as to why the business was so vulnerable in the first place to risks that were obvious (and mitigatable) way back in the SARS emergency of 2003.