I am writing this on the evening of Thursday 13 September 2001. The events in the United States two days ago do not need restating. The grief and shock of the past 48 hours are large enough that the technical preoccupations of this notebook feel small by comparison.
I want to acknowledge this rather than ignore it, and then say a few things briefly about how it does and does not affect what I write here.
What is appropriate to say
My condolences to the families and colleagues of the people who were killed. Several of the people I correspond with through this notebook are based in Lower Manhattan. The accounts I have read from people closer to the events than I am have stopped me in my reading several times.
The scale of the human loss is the only fact that matters this week. Everything else is downstream.
What this does to the work
Three small observations, written cautiously.
The conversation about cyber-attack-as-warfare is going to accelerate. The attacks of Tuesday were physical. The political and policy response will, however, include a significant cyber component. The framing of the security profession's work — defensive, civilian, mostly commercial — is going to be re-examined against a national-security framing. This is not necessarily good for the field.
Operational priorities at many organisations will shift. Resources that were going into ordinary security improvements will be redirected to physical-security responses, business-continuity work, and disaster-recovery planning. The structural improvements I have been writing about may slow.
The international cooperation conversation may strengthen or weaken. It could go either way. Counter-terrorism cooperation may produce better cyber-cooperation infrastructure as a side effect; or it may produce nationalistic responses that fragment what little international cyber-cooperation exists.
None of this is the most important thing this week. All of it is, eventually, going to shape the field.
What I am going to do
For this week and next: not much writing. The next regular post will be when there is something useful to say.
For the longer term: continue the discipline. The work continues; the framing may shift.
For anyone reading this who has been more directly affected: take care of yourself first. Everything else can wait.
More in time.