There were two take-away messages. One is the astounding degree to which Europeans take privacy more seriously than people in the US. Coming into an environment heavily laden with law enforcement agencies, spam fighters and government identification bureaus, I expected to be in a hostile climate. I wasn't. The people in this community are, by a large majority, overhwelmingly in favor of strong privacy and consider data protection to be as important as -- indeed an extension of -- internet security. Which is as it should be. To illustrate, at a plenary session we had a public debate on whether the European Union is doing enough to protect privacy." Electronic votes were taken of the audience before and after the debate. Before we began discussing it, the breakdown was 25% yes, 75% no. After our debating exchanges, the vote was 16% yes, 84% no.
The other takeaway was the degree to which CERTs constitute an informal "network form" of global governance, which melds academic, governmental, industry and advocacy stakeholders. There was much discussion of the future of CERTs, most of which I missed due to attending other sessions. The role of this international community in coming to the aid of Estonia was particularly instructive. There is a recognition from both the (largely but not entirely) private sector CERTs and the traditional hierarchical governments of their limits and their need to cooperate.
