Day two at the IGF. Day two focuses on cybersecurity, meaning the main sessions are devoted to it.

After the first session, I heard a participant say: “I know nothing about Internet security, but I didn’t hear anything new.”
That about sums it up.
It was depressing, frankly. All presentations, from people related to different CSIRTs, ITU and Cisco, were rehashed arguments that we have been hearing for years. Their slides could have been made in 2005 and no one would have noticed.

The storyline is all too familiar: cybercrime is exploding and therefore we need more collaboration, more CSRITs, more education, more international cooperation among law enforcement, more sharing of information, et cetera.
I’m sure you’ve heard it all before.

This type of story marries an alarmist diagnosis to a set of answers that do nothing to remedy the alarmist diagnosis. There is nothing wrong with the answers per se, but they have been pursued for years now and at the same time the problem has gotten much worse. The most positive evaluation one could give would be to say that they have been only partially effective.
The only reason people present such ineffective proposals is because they themselves have a vested interest in it. Solutions hunting for problems, policy analysts call this.
The only reason people get away with presenting such ineffective proposals is that nobody is against them. The proposals don’t harm anyone, at least not in an obvious way, and some else is picking up the tab.

So where does this leave us?

It seems to me that this can mean one of two things: Either the presenters accept that we don’t have better answers currently, no new ideas worth pursuing. That is entirely plausible. Many of the proposals out there are controversial and it is unclear if they would do more harm than good. It does mean, however, that for now we have to live with the status quo, which is: rising crime. We would then have to address the question of who is going to bear the costs of this.

The alternative is that there are better answers that the session presenters did not talk about – or any other presenter at the IGF, for that matter. There are. In the past years, research has moved to concepts like assigning (intermediate) liabilities and re-aligning market incentives (see for example this report [PDF] recently produced for the EU). In short: Innovations have occurred where we have started treating security issues as economic problems.

The people in this field are nowhere on the program of the security sessions at the IGF. Those security experts that are present, have no reason to go beyond their self-serving answers that offend no one, but solve little. You see a lot of that here at the IGF. They call it multistakeholderism.