A security expert on why we MUST vote on paper | Bruce Schneier (2019)

Public Interest Technologists are essential

• The field requires a bridge between technologists (who build tools without societal context) and policymakers (who propose solutions without technical understanding).
• A "public interest technologist" is defined as a practitioner focusing on social justice, the common good, and the public interest, either within government, NGOs, or corporations.
• There is a critical shortage of supply (few people want to do this work) and demand (few funded positions exist) for these professionals.
• Philanthropists are urged to fund specific interventions: university programs, public interest tech jobs, sabbaticals for corporate employees, and tech-driven journalism.
• Unlike public interest law, where 20% of Harvard Law graduates now work in the sector, the percentage of computer science graduates entering public interest work is currently near zero.

Cybersecurity risks are shifting from software to physical infrastructure

• Computers fail differently than physical objects: they work perfectly until a single vulnerability renders millions of devices insecure simultaneously.
• A vulnerability in Amity hotel door locks remains unfixed in many locations years after discovery because manual firmware updates are logistically difficult.
• As the Internet of Things (IoT) expands to include vehicles, medical devices, and power grids, the cost of failure rises from data loss to loss of life.
• Nation-state cyber capabilities are destabilizing because they are difficult to verify, leading to arms races where "everything is a cyber weapon."
• Non-state actors often possess capabilities rivaling nation-states, making attribution of attacks (e.g., Sony, Russia) difficult and increasing the risk of accidental escalation.

Information operations and democracy face new challenges

• Election interference often relies on legal system uses (e.g., Facebook ad targeting) rather than technical hacking; the issue is design, not security failure.
• Active defense (e.g., the US hacking Russian troll farms to shut them down) has proven effective and is becoming a standard counter-measure.
• Deepfakes pose a lower immediate risk than feared, as public familiarity and generational tech-savviness may inoculate users against them.
• Voting security requires voter-verified paper ballots and risk-limiting audits to prevent compromise and ensure legitimacy.
• The US election system lacks a federal bureaucracy or "do-over" mechanism, creating potential for constitutional crises if results in key states are disputed.

Cryptocurrency and blockchain face fundamental governance flaws

• The concept of replacing governance with mathematical consensus is flawed; when disputes arise regarding code interpretation, governance is still required.
• Smart contracts cannot replace legal contracts because humans will always disagree on the intent or interpretation of the code.
• Current blockchain implementations (like Bitcoin) are environmentally inefficient and offer no practical benefits over existing payment systems like credit cards.

Biology and software are diverging in risk profiles

• Software development relies on "trial and error" because failure is low-cost; biology is moving toward this model via CRISPR, where failure (e.g., creating a superbug) is catastrophic.
• Synthetic biology risks include accidental creation of dangerous pathogens by well-intentioned researchers, not just malicious actors.
• Secrecy is an ineffective security strategy (security by obscurity); risks in both fields must be made public so defensive measures can be developed by the "good guys."

Career and Economic Incentives in Security

• Computer security is infrastructure; it enables all other technologies (AI, autonomy, medicine) to function safely.
• Security is rarely binary; the goal is to make attacks too costly or difficult for adversaries to pursue, rather than achieving perfect invulnerability.
• Economic incentives drive security; companies often fail to patch systems because the cost of fixing the flaw exceeds the cost of the potential loss.
• There is a massive global skills gap with hundreds of thousands of unfilled cybersecurity jobs, yet many talented individuals are drawn to building rather than breaking.
• AI can assist in security by automating vulnerability detection at machine speeds, potentially leading to a future where software vulnerabilities are rare.

Surveillance vs. Security trade-offs

• The debate is not "security vs. privacy" but "security vs. security"; securing critical infrastructure is more vital than eavesdropping capabilities.
• Mass surveillance is a temporary solution that cannot prevent catastrophic risks once technology becomes accessible to individuals (the "gun massacre" analogy).
• Corporate surveillance is a greater threat to privacy than government surveillance, as governments often leverage the data collected by private companies.
• "Turnkey tyranny" is a risk where existing surveillance infrastructure can be misused by future authoritarian leaders without new legislation.
• Policy must shift from wholesale surveillance to suspect-based surveillance with strict warrants, and technological solutions should be designed to be surveillance-proof.

Practical Personal Security Recommendations

• Use two-factor authentication (2FA) for all critical accounts, preferring hardware keys (U2F) or authenticator apps over SMS.
• Use a password manager to generate and store unique, random passwords for every service to prevent credential stuffing attacks.
• Enable automatic software updates for operating systems and applications to patch vulnerabilities immediately.
• Maintain offline backups of data to protect against ransomware.
• Be vigilant against phishing attempts, which can bypass 2FA if not using hardware keys.