*Fly in the soup - a Dutch phrase meaning the fly in the ointment

In September 2020, our article, Global Risks – Is Software The Vlieg In De Soep*? postulated that the effect of outages of IT systems could start to threaten the economy and society in the same ways as better studied risks such as super-volcanoes and nuclear war. Since then, the threat from IT outages has become more apparent. One hurdle to improving the reliability of IT systems is lack of a language for non-technical people to approach the issue. We suggest a metaphor – of Backbones - that can frame discussions leading to better reliability of IT systems.

Why are IT systems failing?

Over the last few years there has been a sea change in the vulnerability of IT systems. Prominent failures have multiple sources, although cyberattack is often highlighted. Many have substantial consequences for users and their data.

Now, the UK Government has written to CEOs of FTSE50 companies “urging them to look beyond cyber-security controls toward a strategy known as "resilience engineering", which focuses on building systems that can anticipate, absorb, recover, and adapt, in the event of an attack.” And there are frequent outages of IT systems which disrupt whole industries and/or whole regions. It is a problem for our age. Why is this? What are we missing?

IT systems today are complex tightly coupled, interdependent systems. Organisations combine legacy IT software with components sourced from a multitude of software and IT infrastructure providers.

This combination makes it difficult for organisations to control the availability of the services they offer to the public.

A well-documented body of knowledge defines how to build resilient systems, able to withstand disruption. Why is this not enough for our IT systems to be resilient? We suggest the metaphor of Backbones might help to answer this question and suggest ways forward.

What are Backbones?

Backbones (first introduced in The Possibility Wheel: making better choices in a fractured world) are metaphors for rules that make cooperation possible. They shape how we resolve conflict, trade, share information and ‘get things done.’ Examples of Backbones are:

• International Institutions (UN; WTO; IMF; World Bank; Asian Development Bank; NATO etc) which were established to sustain and enforce adherence to a common vision of a “better” world after WWII;
• Rules and standards (Rule of Law; ISO standards; Montreal Protocol);
• Platforms and norms: currency exchange platforms; social media; cultures – national, group, art; ‘How we do things around here’; Reinsurance; IT systems both within and also across organisations.

Like bridges, buildings and roads, Backbones need maintenance and renewal if they are to remain fit for purpose as the world changes. Not all Backbones do continue: we identify four categories: successful, evolving, fractured, and some needed that are missing.

• Successful Backbones – these work well. An example is the Montreal Protocol to protect the ozone layer. It has been adapted and renewed over the years so that it evolved to stay fit for purpose.
• Evolving Backbones - people recognise that they are a useful beginning but need further development to become successful. Breakdowns or shortcoming in this development process may result in these becoming Fractured Backbones. An example is NATO which has evolved while facing growing challenges from an increasingly unstable geo-political environment. The 2022 UN Biodiversity Conference saw close to 200 countries subscribe to conserve or protect 30% of the land and ocean by 2030.
• Fractured Backbones are those that no longer work. An example is Copyright Law which was designed to prevent reproduction of copyrighted work without payment. It is being challenged by AI’s Large Language Models – when they “read” documents for their training without paying royalties, are they violating copyright?
• Missing Backbones – needed but not (yet) there. Backbones are often missing as a result of a lack of converging interests. An example is a Global AI Governance Framework to set rules and enforcement mechanisms for safety, ethics or misuse of AI systems. AI is not governed because both actors and their regulators feel that governance might be an impediment to innovation and ultimately to national advantage. Another example is missing ISO standards for server construction, covering water use and heat output.

What do Backbones add to thinking about IT reliability?

Successful Backbones: the Montreal Protocol was based on the dominance of few major nation states. It was possible to get agreement on self-regulation as the hazard was clear and its impact widespread, conformance was seen as a competitive advantage.

Is there evidence that any of the nation states hosting cloud providers have differentiated priorities, particularly in relation to resilience? Is resilience seen as a source of competitive advantage?

Evolving Backbones: NATO’s purpose is to safeguard the freedom and security of its member countries and their people. It survived the collapse of the Soviet Union and the post-Cold War era by adjusting to the environment and the systems around it. It is now facing the new challenges of the USA’s dwindling support, a multipolar world, the invasion of Ukraine and the USA’s conflict with Iran. We are watching what it will do and how it will evolve with interest.

Are cyber-attacks on data and infrastructure reframing the consensus on vulnerability of IT systems? Leading to new perceptions of reinsurance?

Fractured Backbones: Copyright Law is threatened by definitions of publishing: it was designed to prevent free reproduction of copyrighted work. In the digital age, it is not just Copyright Law that is a fracturing backbone, the internet is also in danger.

The internet’s basic structure was designed for users who were identifiable, and largely trusted, members of the research community. They operated under social norms of responsible behaviour and they were accountable for their behaviour. Users today are much more diverse, and include both naïve and malign actors. The internet backbone is in danger of no longer working.

Missing Backbones: the nearest analogy we can find for an industry like AI is the pharmaceutical industry. The industry consists of a number of global players, providing services with large commonality to all parts of the world. Both AI and the pharmaceutical have an expensive innovation cycle and a large impact on peoples’ lives. Regulation and enforcement are local and patchy.

Can AI regulation improve on what has been developed for the pharmaceutical industry? Could a cyber security version of NATO work - built on the basis of an international agreement by a coalition of the willing – which could also cover AI threats?

Conclusion

The resilience of IT systems is becoming a national and global issue. These complex, interdependent systems are difficult to imagine. An attempt to discuss the issue of resilience can descend into techno-babble. A shared language will be a positive step.

In this note, we have explored how using the metaphor of Backbones – successful, evolving, fractured, missing - could provide this shared language for improving the reliability of IT systems.

The authors acknowledge many helpful comments from Professor Ed Steinmueller as the ideas above evolved.

Gill Ringland & Patricia Lustig