US senator blasts Microsoft for “negligent cybersecurity practices”

I think you'll find I'm a little closer to your view than it seems. Although I'd been in IT before then, I first got into the surveillance game at a government level in the mid 1990s—no it wasn't the NSA, CIA or such but it involved me having to sign secrecy agreements which is a nuisance because I can't talk about instances. I can say however my main work was to protect assets—not tracking down attackers.

The reason for my acerbic comments is that I'm annoyed the situation has gotten as bad has it has because it was obvious years ago we could have done much more to make cyber security better but we failed to act early on.

It's worth reviewing why things have degenerated so far, and for that we have to examine history. Before the 1990s most of those in computers were professionals or keen hobbyists and everything was more low-key, there wasn't much for attackers to attack. That changed and the rot set in when Microsoft popularized the internet with Windows 95, suddenly there were millions of new users who had never previously used computers let alone had access to the internet.

As Microsoft's principal motive was (and is) profit, making computers very easy to use was a key objective from the outset, everything had to work with a click and do so without complicated intermediate procedures. Security was given a backseat even though it was obvious to security processional that (a) security was already inadequate and (b) that both commercial operations like Microsoft and government were not considering security with necessary diligence.

So by about 2000 we have a whole world of new users who—because of deliberate ease-of-use policies by the commercial operators, MS etc.—had never developed any cyber security habits of note. And because good cybersecurity habits required extra work which these new users had never gotten used to doing it was essentially impossible to retrofit them in any meaningful way. The opportunity had escaped.

The other fly in the ointment were governments, for various reasons too complex to discuss here, they took a hands-off approach and let security matters get out of hand. When social media took off a few years later, governments were faced with another dilemma. By then 9/11 had happened and the world was a different place. So governments were faced with having to learn much more about their citizens. They could strengthen information associated with ID cards and such, or in countries where there were none, they'd introduce them. As previous efforts to do this by governments had always been very unpopular (calls of authoritarian government etc.), governments didn't want to go down this route unless strictly necessary.

Then the god-gift of social media arrived, what people were very reluctant to give government they freely gave to the likes of Google, Facebook etc. in return for a few glistening baubles, governments couldn't be happier as they could go down this route to get the data and it wouldn't even cost them anything! Just wonderful.

Thus, governments weren't concerned about corporations stripping citizens of personal data because they could then get access to it whenever necessary. If laws were introduced to make access to personal data much harder it would also be harder for governments to gain access. Forcing tighter security on these large corporates could and would bite governments as they too would find access to data harder (hence the current debate over encryption).

Because, early on, like Pontius Pilate, governments washed their hands of security matters, and later on relied on weakened security through social media, we ended up with a broken weakened system and yet governments still like and want it this way. For instance the FBI's call to have Section 702 renewed despite its dubious usage/legality: https://www.theregister.com/2023/07/28/fbi_section_702/ similarly, the UK's Investigatory Powers Act, which, as almost everyone knows, has many other uses in addition to its stated purpose.

In short, it has been very obvious from the early 1990s that we should have build up security in a much more structured and disciplined manner yet it failed to happen for both commercial and political reasons. If the warnings from 30 or so years ago had been adopted then we'd not only have a much better security but also we'd have a user culture attuned to adopting and applying security as a matter of course. Systems would be much harder to break into and break-ins would be detected more quickly.

I am not saying security would be perfect, it certainty would not. But there's little doubt that it would still be harder for trained state actors such as the Chinese to break in as security would be coming from a much higher base.

We missed an opportunity to improve security, and you're right, we've handed access to it to the Chinese by default.