Crowdsourcing Cybersecurity: Decentralized Responses to Decentralized Threats

Dr. Gary Shiffman, Professor at the Center for Security Studies at Georgetown University, and Ravi Gupta, co-founder and CTO of data analysis and behavior modeling firm Eniku7, recently published an article in the International Journal of the Commons on crowdsourcing cybersecuirty. Shiffman and Gupta use the concept of “the commons” to illustrate the problems with identity-dependent cybersecurity strategies, and propose an alternative model with roots in social science research on shared public resources. They propose that, since the internet functions as a commons, securing equitable and consistent access to the resources it provides requires a bottom-up, voluntary system in which invested community members actively protect their shared assets. If decentralized, voluntary input can help resolve a variety of challenges in fields like finance and public decision-making, there are surely lessons for security. 

Shiffman and Gupta illustrate that research has shown that such privatization of the commons “fails to secure and enhance the commons” and that “privatization of a commons often diminishes the value of the commons.” Their particular concerns are related to how the Internet functions differently than most resources considered as commons. Since the information on the Internet is non-rival, grows with more users, and can be sub-divided into smaller commons, traditional private property mechanisms are not required for the internet’s resources to be equitably distributed. Therefore, Shiffman and Gupta contend, a model for improving secure and continual access to the internet’s information should come from successful shared commons models – not from privatization.
As evidence to support this concept, Gupta and Shiffman review the work of the Conficker Working Group‘s voluntary action to stem the outbreak of the virulent malware between 2008 and 2010. They state the strength of the CWG came from its organic, decentralized roots:

“…volunteers who were not associated with the proper authorities were the most successful in combating the virus. Like when the shopkeepers and residents of Jacob’s neighborhood spontaneously protected the girl against an unknown attacker, a small group of experts from around the world saw the threat, and chose to come together with the help of some major organizations and voluntarily organized into a cyber enforcement squad. Many members of the CWG believe that government law enforcement agencies were slow to respond to the virus [New York Times March 18, 2009 (Markoff 2009)]. Experts from various organizations can organically organize and respond to future cyber attacks.”

While Gupta and Shiffman recognize that this model may not translate to security threats facing more centralized targets (like national critical infrastructure), this model provides a responsive, invested, and incentivized participatory framework for responding to security threats. Outside of these exceptions, Shiffman and Gupta suggest that the government and centralized organizations’ roles may be in providing “remote interaction and provide the space where security experts and others can build trust relationships that foster coordination and communication.” While this paper’s analysis does not address preventative security measures, groups like Shadowserver, which has been voluntarily active for over a decade, provides a large amount of cybersecurity research and analysis to the public, for free. Between models like those presented in this paper, and recent government efforts to improve information sharing between the private and public sectors, the future of governments’ role in cybersecuirty may have more to do with conversation facilitation than provision.