Soon my colleagues and I will be enrolled in yet-another protocol meant to establish yet-another security barrier for our organization and its assets. Notwithstanding the fairly ordinary nature of B2B communications and marketing, which is what we do, the group is vulnerable and needs to beef up its defenses. The internal communications system endures a rising volume of “phishing” attacks – fraudulent attempts to gain access to the network and to gather sensitive information or data (usernames, passwords, account numbers, etc.) by digitally misrepresenting the source of a message. A simple question from a reader or contributor may in fact be an effort at theft or blackmail, or who knows what.
So, going forward, when I open the corporate mail account on the laptop assigned to me for my professional use, I will have to clear a Multi-Factor Authentication (MFA) sequence. The mail server will issue a code to my phone – which I will use to confirm to the mail server that I am a trusted user of my account.
I’m not unfamiliar with this. Who has not been forced by a bank or insurance provider to reconfirm his or her access to financial or other records? It’s not much of an inconvenience to me either, but my suspicions are unavoidable. Or, perhaps they’re unavoidable to someone who continues to see the infinite network of virtual channels connecting everything and everyone as an artificial structure that has been erected around the real world. The real world, in this explanation, was a place where people were assumed to be who we claim to be – not espionage characters slipping through enemy lines or villains setting up the perfect crime – and who were authenticated by the familiarity and trust we earned from colleagues and friends. It’s not gone, but the virtual world is choking it to death.
The suspicions, to be clearer, have to do with the doubt that must be cast over everyone simply because previously we agreed to be employed by an organization that’s now under threat from the outside. We readily contribute time and energy to this organized effort, and mutually we have acknowledged its goals and the standards set for us. Some years have passed since our affiliation, of course, which in the “real world” would have been considered a type of equity we had earned.
Now, of course, the events that lead up to my Multi-Factor Authentication have no weight at all in determining the threat I may present to the organization. And, when I’m MFA’d again next month the current verification will again mean nothing. In this virtual structure we live in an eternal present, no past or future, no credit earned, and none given. If we cannot be authenticated we will be locked out, but if we are authenticated then we are allowed continued access.
Yes, I know my doubts do not matter to the particular case because I recognize that combating phishing attacks is a real problem for organizations. No, I do not suspect the IT managers have any hidden agenda by demanding access to my own phone in order to protect their network. The privilege they are claiming to my property and identity is not specifically prohibited by the terms of association I agreed to accept, so I can easily see the cost of any resistance I might raise. That too is a reminder of the real world, where rights not specifically assigned to a government remain the privilege of the individual.
The virtual world assigns rights to those with authority, and the power to make that authority effective is the guarantor of those rights. If I don’t agree with that, I’m free to go ... somewhere.
This relationship between authority and access was not unimagined in the real world I described. Science-fiction legend Robert Heinlein introduced the phrase “New Normal” in 1966 to describe the social compromises imposed on individuals in order to solidify authority – and through 60 years it has floated into our vernacular, now offering a shorthand explanation to the fact that we must compromise one principle after another in order to simplify the process of governing us.