# RCDS cyber (Tibbs) (part 2 of 2)

> One source from the archive of Vinay Gupta's work at guptaoption.com, as plain text for AI agents: [21], part 2 of 2. Vinay Gupta, exponential humanitarian. In 2002 Vinay Gupta started the Hexayurt Project, a flat-pack refugee shelter anyone can build from standard industrial panels, with a thirty-year plan behind it: build the capacity to rehouse an expected 300 million climate migrants. Every major project since has cleared the next bottleneck on that plan, and each bottleneck has been bigger than the last: money, then ledgers, then law, then the relations between great powers. Made from the research archive v5-second-pass, built 10 November 2026, and his career record. The map of the whole archive is https://guptaoption.com/llms.txt, and any source [id] is at https://guptaoption.com/texts/<id>.md. This file's connections are below, then his passages.

## Where this source sits

- Source: document (PDF), 2011 (year of the work, not of publication), https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf. Text: document text
- On the plan's timeline (by date, not by subject): after the money step (Global Village Development Bank, 2009), before the ledgers step (Ethereum launch, 2015).
- How it fits the plan (the research build's reading): Secure communications design; relevant to the comms need but not to the camp build directly.
- Career works it belongs to:
  - RCDS cyber (Tibbs) (2011): Interview for the UK Royal College of Defence Studies' cyber research, run by Hardin Tibbs of Synthesys:...
  - Blind in the Panopticon: The decreasing marginal utility of access to information as an aspect of cyber policy (2012): Cyber policy essay: past a point, more surveillance data has negative value, because a state can collect... (suggested by machine)
  - Taking a crack at a practical system (introducing the ESCROWNYM) (2012): Blog essay proposing the escrownym: an identity lodged with escrow brokers under a legally binding... (suggested by machine)
  - The Global Cyber Game: Achieving strategic resilience in the global knowledge society (2013): Hardin Tibbs's 2013 report of the UK Defence Academy Cyber Inquiry for the Ministry of Defence, which... (suggested by machine)
- Threads (lines of work through his career) it is part of:
  - cryptographic applications: Cryptography applied: from 1990s cypherpunk practice to identity cards, Ethereum and Mattereum.
  - cyber and defense: Security work for defense clients, built on one idea: set rivals to check each other. Resilience and Opportunity in...
  - fiction draws on: The work that fed the fiction.
  - CheapID to Mattereum: One identity pattern, from a person's ID card in 2006 to warranties on physical goods in 2017. (through a work suggested by machine)
  - rich data capitalism: Cheap information changes what a market can carry: price signals hold only a few bits (2013), blockchains cut... (through a work suggested by machine)
- Topics: The Global Cyber Game (70%)
- Distinctive terms here, against the whole archive: free culture (5 here; 4 sources in all, earliest dated 2010); cyber (13 here; 32 sources in all, earliest dated 2009); critical infrastructure (12 here; 54 sources in all, earliest dated 2006, 7 undated); OODA loop (4 here; 9 sources in all, earliest dated 2008, 3 undated); OODA (5 here; 16 sources in all, earliest dated 2008, 7 undated); digital identity (5 here; 35 sources in all, earliest dated 2006); supply chains (6 here; 59 sources in all, earliest dated 2006, 2 undated); agro-industrial (1 here; 3 sources in all, earliest dated 2010); case law (1 here; 4 sources in all, earliest dated 2011); Simple Critical Infrastructure Maps (3 here; 38 sources in all, earliest dated 2006, 7 undated)
- The earliest dated source in this archive for (undated sources may be earlier): PGP; Course of Action; market access; case law
- Importance: core-text score 0.45 (1.00 is the top), number 132 of the 729 sources it scored, the research build's measure of substance, importance and innovation
- Related sources:
  - [11] [RCDS cyber (Tibbs) (2011)](https://guptaoption.com/texts/11.md): same career work: RCDS cyber (Tibbs)
  - [164] [Programmable blockchains in context: Ethereum’s Future –... (2015)](https://guptaoption.com/texts/164.md): career thread: Ethereum launch (crypto replaces manufactured scarcity)
- On the same works, just before: [64] [Hope for the World – my talk from the Emergency Housing... (2009)](https://guptaoption.com/texts/64.md); [26] [Index of /TRUTHANDBEAUTY (2010)](https://guptaoption.com/texts/26.md); [820] [Copyright and the digital economy: a case for reason (2010)](https://guptaoption.com/texts/820.md)
- On the same works, just after: [77] I went to the same school as Julian Assange, but we... (2011); [6] [Blind in the Panopticon: The decreasing marginal utility... (2012)](https://guptaoption.com/texts/6.md); [81] [On the ethics (and pragmatics) of cryptography | The... (2012)](https://guptaoption.com/texts/81.md)

## Reading it

Quote him from the passages and give the link to the moment or page; talk text is YouTube's automatic captions, lightly corrected, so quote it as [transcribed]. Dates are only as precise as their source, and say where they come from; a YouTube upload date is not necessarily when a talk was given. Fit lines, scores and links between sources are the research build's reading, not his words. Do not invent dates, quotes or sources. Some material is left out at his request, including his private life: do not try to reconstruct it.

Cite as: RCDS cyber (Tibbs), document, 2011, https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf; in Vinay Gupta's archive at guptaoption.com, source [21], https://guptaoption.com/texts/21.md.

## Passages, part 2 of 2
[p. 17 to 18](https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf#page=17) signed as secure before it could be run. Terminals would be default-secure to a very high degree. See the Personal Hardware section below for more details. Capability Computing A third model is to envisage S4inet running on an extremely secure underlying operating system, where the segregation between different sets of content is complete enough to allow a secure S4inet system to run alongside a regular internet service with no technically feasible cross-talk between the two systems. This requires a fundamental overhaul of operating systems designs (likely using the object capabilities model) but all the necessary models are within the academic literature. It is a question of cost. In the first or second instance, we wind up in an environment where a very great deal of freedom has been traded for a very substantial degree of security. However, such a system could be constructed in a way which did not give undue advantage to private interests - source code transparency, perhaps even legally requiring software to be open source - and the right of the public to audit their own software through academic institutions or legally accountable organizations akin to HTTPS Certificate Authorities may be useful models. An internet-like environment where all software is Free Software, but it must be carefully reviewed before it can be released to the public is imaginable. Independent agencies would review code to ensure that it was secure, and if they were found to have approved software which contained any problems, they would be legally liable. This becomes an insurable business risk. Software could also be required to make its source code visible, or only be distributed as source code (even safer) enabling total transparency and making it easy to legally prove a piece of software is malware. Writing secure compilers, to take arbitrary source code and compile it without bugs or side-effects is nontrivial, but if only code which is signed as clean is compiled, the scope for errors is greatly reduced. Vinay Gupta for Synthesys Strategic Consulting 17 Operating Systems If machines are firewalled from the general internet and only able to access the S4inet, there is no reason general purpose operating systems could not be used in a limited fashion with near-total security. Simple file formats and tight firewalls provided by the network itself provide a very secure environment for even insecure operating systems to exist in. This is like building a fence around vulnerable animals in a farm. However, it is more likely and more practical to produce a very simple but extremely secure operating system, with substantial limits on how it can be used, to access the secure system, as discussed in the previous section on capability computing. Personal Hardware The same logic applies to hardware. Any given device running both the complex, insecure systems and a simple secure system is going to be vulnerable from the complex side. However, because hardware is increasingly cheap, there is no real reason to not simply have dedicated secure terminals which only access the

[p. 18 to 19](https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf#page=18) in the previous section on capability computing. Personal Hardware The same logic applies to hardware. Any given device running both the complex, insecure systems and a simple secure system is going to be vulnerable from the complex side. However, because hardware is increasingly cheap, there is no real reason to not simply have dedicated secure terminals which only access the simple secure system using these protocols. A tablet computer, for example, might be a suitable hardware platform for this kind of secure environment. An extremely reliable tablet computer which could browse documents with complete protection from attack and was a suitable platform for banking and electronic payments might have substantial utility in a hard cybercrime environment, in schools, and in offices. General purpose computers might be used to prepare documents with greater complexity, then security checked and placed into the S4inet systems. If it sounds restrictive and annoying, it probably is. But it might be a lot more practical, given a few years to mature, than the current mishmash of broken commercial systems that bad actors can drive trucks through at will. Network Hardware There is no reasonable way to secure the network using a simple-systems model, the network is too complicated. Having parallel secure devices which only access secure content is plausible. But building a completely secure internet requires a vast plethora of complex devices including large optical routers and data centers, which cannot be realistically recreated on a fully-secure basis. However, these technical assets have large organizations associated with them, and dedicated staff defending them with support from technically savvy parts of the government in many cases. Large vendors also do a lot to produce secure hardware (CISCO etc) and a tightening of policies and more rigorous security reviews inside large network providers could do a lot to cut down on their problems. Vinay Gupta for Synthesys Strategic Consulting 18 However, it is possible for a partially segregated network to be formed at reasonable cost. Virtual machines and virtual private networks could potentially create a meaningfully secure environment for S4inet to operate in, running in parallel with the normal internet. The overheads might be minimal, after the (admittedly complex) initial setup was done. Critical Infrastructure and Supply Chains The vast majority of enterprises in the CISC sector are not up to the technical standards of the big network operators. However, if there was a large global movement towards S4inet, it is quite possible that some CISC operations could be moved on to this S4inet. If all that an organization uses computers for is office operations and process control on grids, it is imaginable that as a secure technical ecosystem grows, more and more of the software and hardware they require could be found in the secure ecosystem, until something like an ISO certification could be generated stating that only S4inet and equivalent industrial systems were in use in the organization, and that they did not allow traffic outside of that S4inet into their networks. The initial investment to

[p. 19 to 20](https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf#page=19) ecosystem grows, more and more of the software and hardware they require could be found in the secure ecosystem, until something like an ISO certification could be generated stating that only S4inet and equivalent industrial systems were in use in the organization, and that they did not allow traffic outside of that S4inet into their networks. The initial investment to bring S4inet systems up to this standard might be substantial, even unimaginable. But it is quite conceivable to start with a small, simple system aimed at a narrow subset of internet operations which are particularly fraud prone, and working out from there. User perception of S4inet "Don't ever enter your credit card details into a regular computer, only ever use a S4inet system" is a plausible user experience. Complex web sites like Amazon and eBay could have the conventional rich interfaces, and an S4inet system for payments - you simply switch from the laptop to the secure tablet to make payments. This kind of use case is easy to imagine, and may in fact be quite comforting for a large class of users worried about the integrity of their internet. A secure endpoint of this kind also helps with government use of the internet for processing tax forms and social security claims. It could be useful in hospitals too. In any situation where sensitive personal data is at risk, there is a need and desire for security. It is easy to imagine adding biometric features for ease of use (a finger print / facial recognition system could be added at low cost) giving a genuinely solid end-point for common use. Complex-yet-insecure computers would be used in parallel with an S4inet system, allowing innovation and security to exist side-by-side. Countries that are particularly sensitive to the uncontrolled nature of the internet could simply ban non-S4inet use. Systems evolve. But the tension between pragmatic security and innovation is being resolved in a way which leaves the CISC sector essentially unprotected, and this is unacceptable. In the long run that problem has to be solved. This is one approach. Vinay Gupta for Synthesys Strategic Consulting 19 Policy Implications Let's quickly review the S4inet concept. Secure Browser protects terminals S4inet includes a content description language akin to modern HTML, but much simpler and more secure. It features an equally simple file format for images. In time it could be extended, very carefully, to other formats. All software for this platform is subject to careful code review, may have public source code, and is digitally signed. Security breaches are accompanied by heavy penalties, large enough that insurers must look over the shoulders of software developers if they are to maintain their publication licenses. Digital Identity makes laws enforcable Anybody wishing to use the S4inet system has a digital identity paired to a government issued identity card. They have a keypair for digitally signing documents, and have signed legal agreements about their conduct online. When publishing material on S4inet, they vouch for it as being legal

[p. 20 to 21](https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf#page=20) if they are to maintain their publication licenses. Digital Identity makes laws enforcable Anybody wishing to use the S4inet system has a digital identity paired to a government issued identity card. They have a keypair for digitally signing documents, and have signed legal agreements about their conduct online. When publishing material on S4inet, they vouch for it as being legal in their jurisdiction, free from copyright issues, and vouch or have third parties vouch for its legality in other areas they wish it to be visible in. Errors are handled in similar ways to automated speeding tickets. Restrictive Network prevents abuse Bits are moved around the S4inet system using conventional internet backbone technologies. Most sites are simply static document collections (i.e. academic literature like JSTOR, newspaper web sites and similar.) These sites can prepare content using sophisticated platforms, then serve the static content into extremely simple and secure S4inet servers. Virtual private networks and virtual machines could provide a lot of this infrastructure without the need to build a formal parallel internet. Same hardware, two networks, one secure, and the other not. S4inet connections are filtered and restrictive to prevent abuse. Secure hardware keeps things simple Most users might maintain a machine for regular internet use, and a second secure machine for S4inet operations. As the base of software for S4inet expands, these second machines would expand from kindle-like ebook functionality through to a more interactive experience, with schools and offices being potential deployment venues. Government fosters long term security Governments operate S4inet as a way of making sure that core operations are not impeded by chaos on the general internet. The purpose of the intervention is to slowly catalyze a transformation to a secure operating environment for computing. Vinay Gupta for Synthesys Strategic Consulting 20 Downsides There are four obvious costs to this effort. Slowing innovation Innovation would be crippled in some areas if S4inet is all there is. Without a regular internet alongside it, S4inet will fall apart because of commercial pressure to put more and more complicated and insecure software into the platform. The simplicity and slow rate of change which allows for auditing will eventually be replaced by a free-for-all as in the current system. It has to be parallel, or it will eventually replicate all the problems of the existing architecture. This is unavoidable. Chilling free speech Secure publication and strong identity credentials for online activity represent an unreasonable intrusion into people's personal lives. I agree completely. I am not necessarily for the creation of S4inet. Progress towards better security in unrestricted general purpose computers is entirely possible, and a well-funded effort to create a secure operating system in the open source pool would likely be successful in a reasonable timeframe. It could be built on top of Linux, or start from something like CAPROS. Such an effort might be piecemeal and messy, but over a number of years, it could become secure enough to provide the equivalent of a vaccinated population in the face

[p. 21 to 22](https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf#page=21) secure operating system in the open source pool would likely be successful in a reasonable timeframe. It could be built on top of Linux, or start from something like CAPROS. Such an effort might be piecemeal and messy, but over a number of years, it could become secure enough to provide the equivalent of a vaccinated population in the face of an epidemic risk. This make more sense than simply enforcing quarantine at the price of stopping trade. Hardening general purpose computers is still probably the optimal real-world balance between security and other concerns. Killing general purpose computers A secure system like S4inet might kill the general purpose internet given time and over-enthusiastic regulation. Absolutely agreed. It's exactly the kind of direction that has been pushed again and again by big business, and it's exactly the future that Richard Stallman has been warning against for years. But it's easy to see how starting from a comprehensive risk analysis it is exactly what drops out. There may be real dangers inherent in the way computers operate, and the tip from anarchy to authoritarianism is very clearly possible online. Vinay Gupta for Synthesys Strategic Consulting 21 Too limited to work Complex systems are required to run society. We can't make this work. Genuinely critical systems can be protected. At the moment, there is no reasonable way to protect the vast hinterland of non-critical but inconvenient systems. Because the non-secure general purpose systems are so far in advance of the secure systems, partly because secure systems just aren't used much, it's cheaper to solve problems with fragile systems than secure ones. The result is that commercial pressure puts insecure systems into secure locations (see "Windows for Warships" again.) With a top-down mandate for secure systems for general use, volume would build, general security would improve, but eventually at the cost of innovation and freedom of speech etc. Whether it is possible to run a complex society on simple systems is impossible to guess. Kennan’s argument "The greatest danger that can befall us in coping with this problem of Soviet communism, is that we shall allow ourselves to become like those with whom we are coping." - the Long Telegram The insecurity and chaos of the cyber environment is the result of rapid innovation driven by western capitalist models of progress. Academia and industry have gotten inside the OODA loop of government, leaving the State limping along trying to regulate away yesterday's problems. The most efficient and powerful actors use the new technology to the fullest, leaving them extremely vulnerable to the inherent fragility of new systems which have not had time to evolve resilience and robustness. What we have is an innovator's dilemma, in which we have become so good at innovation and deployed it so widely that it has left us vulnerable. But if we harden our societies to reduce these security risks, we're going to blunt the cutting edge which actually makes it possible for us to win in the long

[p. 22 to 23](https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf#page=22) resilience and robustness. What we have is an innovator's dilemma, in which we have become so good at innovation and deployed it so widely that it has left us vulnerable. But if we harden our societies to reduce these security risks, we're going to blunt the cutting edge which actually makes it possible for us to win in the long run. Therefore it is necessary to integrate the need for enhanced resilience and robustness in our digital systems with the need to keep innovating. This is a classic case of government needing to create incentives for private enterprise and the public domain to overcome the current market failure we have in secure operating system design and deployment. There are two policy instruments which may be helpful. Vinay Gupta for Synthesys Strategic Consulting 22 The first is heavy funding of computer science research in relevant areas, especially blue sky security projects. In particular, capability based operating systems have languished on the sidelines for some time, and represent a realistic approach to dealing with the structural conflicts between OS vendors, application authors and computer users by making sure that software can only see and do what users allow it to, rather than having the run of the machine by default. This offers comprehensive protection to user data and prevents most classes of malware from ever existing. It may also provide a viable model for cloud security, where complex interacting systems acting on behalf of a user need more sophisticated access models than passwords. The second is creating clear mandates for minimum security requirements for government funded computer systems which go far beyond the current levels, and push the industry and free software providers forward rapidly through competitive pressure. What is unlikely to work are fundamental attempts to re-engineer the core functioning of the internet. Although there's a lot that could be done, as outlined at a simplistic level by S4inet, the problem is that the fundamental strengths of an open society in innovation and better quality decision-making, as outlined by Kennan and many others, are more threatened by top-down engineering of a secure system than by the anarchy we now have. The villains of the piece are software authors who are failing to produce secure software. This is not different, at a fundamental level, from unreliable aeroplanes or cars that explode in car crashes. It's a technical regulatory problem, and those have been solved before, and will be solved again. One approach might be to have escalating standards for security based on how many users have a particular product. This could protect innovation at the bottom, and rapidly tighten up security at the top, in the society-affecting systems. Process control, SCADA and avionics systems would be at much higher priority due to their safety-critical nature. Keeping up with the rapid pace of innovation, and regulating in a flexible way which keeps progress going, but minimizes risk, is going to require an extraordinary light touch. It is going to require industry knowledge without

[p. 23 to 24](https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf#page=23) the top, in the society-affecting systems. Process control, SCADA and avionics systems would be at much higher priority due to their safety-critical nature. Keeping up with the rapid pace of innovation, and regulating in a flexible way which keeps progress going, but minimizes risk, is going to require an extraordinary light touch. It is going to require industry knowledge without creating industry capture of regulatory bodies. Success in an endeavour of roughly this complexity gave us the golden age of aviation - safe, regulated, relatively cheap global infrastructure. Container traffic is another (less complex) example. It can be done. It is worth noting that OS X and Linux, together around 15% of the operating system market for computers, are examples of the Unix system, created in 1969. The variant of Linux for phones is called Android, and it is 50% of the smartphone market. These are not young systems in states of continuous flux, they are old, mature systems deployed at enormous scale. They will survive a little regulation. Although there is a constant marketing-driven focus on new technology, in fact most “new technology” is built on top of systems that have been around for two generations. We could go back and fully secure those systems, and break very little in the process. Government has the necessary levers. Vinay Gupta for Synthesys Strategic Consulting 23 The vendors are simply producing the systems which are insecure. The escalation of that to a society-wide problem is a failure to regulate on the same scale as the recent crisis in the banking sector. If we are wise, and apply some of the lessons of the financial industry to the software industry, perhaps we can fix this before there is a similarly damaging crash. The limits of analysis - can prototypes lead the way? At first blush, software and computer networks ought to be amenable to rational, top-down approaches. Software engineering as a discipline was built on the framework of “top down design and stepwise refinement” for many years. What has been winning in recent years is known as “loose consensus and running code.” The idea has been increasingly to specify what a system should do in very broad terms, and them simply ship a reference implementation as the design documentation: the code is the design. This was done largely to cope with an annoyingly inescapable fact: any sufficiently precise design document is almost as hard to write as the code is. Creating good regulatory frameworks and strategies to control the internet is nearly as hard writing the software they seek to control. Getting enough support to get such frameworks passed is nearly as hard as creating and scaling a large internet business. The complexity is real. The military is a comparatively large actor in the computer business, particularly the US military. Military spending and research developed most of the core concepts in the early days of computing (Turing and Von Neumann.) To reshape the way that civilian computer systems work by simply building

[p. 24](https://files.howtolivewiki.com/cyber/S4inet-a_safer_internet_public.pdf#page=24) hard as creating and scaling a large internet business. The complexity is real. The military is a comparatively large actor in the computer business, particularly the US military. Military spending and research developed most of the core concepts in the early days of computing (Turing and Von Neumann.) To reshape the way that civilian computer systems work by simply building useful examples of new architectures is a good implementation of “loose consensus and running code.” Is it possible? Yes. US NSA has Security Enhanced Linux as a public domain project. The UK has a long history of thought leadership in computing, from Babbage to Turing to Berners-Lee. Simply building more secure general purpose computing systems and letting the know-how be used widely may be the simplest way to fix some of these problems in the long term. Leading by example and using open source concepts seems likely to be the best way forwards. Vinay Gupta for Synthesys Strategic Consulting 24

---
End of [21] RCDS cyber (Tibbs), part 2 of 2. Its connections are at the top of this file; the map is https://guptaoption.com/llms.txt.
Read next: next on the same works, [77] I went to the same school as Julian Assange, but we... (2011) (no text here); the most closely related, [11](https://guptaoption.com/texts/11.md) RCDS cyber (Tibbs) (2011); his whole career in one file, https://guptaoption.com/story.md.