Jon, Very little research has been published to date on the history of computer security. Given the lack of literature on this important topic (and quality resources to study it), the Charles Babbage Institute proposed and was funded for a three year National Science Foundation-supported study to build infrastructure for computer security history. We are just getting underway with this project and will be conducting more than 30 in-depth career-spanning oral history interviews with first generation computer security pioneers (these will be transcribed, edited, and freely available--our standard practice with CBI's oral history program). We will also be actively engaging in archival collection development efforts for computer security documentation (we already have some strong holding such as the Willis Ware Papers and the Donn Parker Papers), and will publish scholarship from this research project. An advisory committee of leading computer security pioneers is providing guidance to us on this project. Historian and Sociologist of Science Donald McKenzie did a few important articles and book chapters--see his book Mechanizing Proof and an article (co-authored w/ G. Pottinger) on high assurance work w/in the DoD (primarily work by the Air Force and Air Force contractors that helped lead to TCSEC or the Orange Book) published in IEEE Annals of the History of Computing 19 (3) (1997): 41-59. Also, I did a survey book chapter on the history of computer security standards in de Leeuw and Bergstra's book The History of Information Security a few years ago. History of cryptography has been far more thoroughly studied and has a significant secondary literature (most of the chapters in the de Leeuw and Bergstra volume are on this topic) and the NSA Cryptologic Museum sponsors a regular conference/symposium on the history of cryptography. Cheers, Jeff On Sun, Mar 11, 2012 at 1:14 PM, Jon Lindsay <jrlindsay@ucsd.edu> wrote:

Hello all, I have the feeling that the history of computer security, from hacking techniques to the evolution of the information security industry to fearmongering over cybersecurity, is a somewhat understudied area. I have seen some work on the development of government policy and threat framing (i.e., by Myriam Dunn Cavelty) but I'm less aware of anything on the evolution of the technical and industrial dark arts. If there is some good work out there, I would love to see it. Bonus points if you can tell me when the awful phrase "digital pearl harbor" first appeared! Cheers, Jon

_______________________________________________ This email is relayed from members@sigcis.org, the email discussion list of SHOT SIGCIS. The list archives are at http://sigcis.org/pipermail/members/ and you can change your subscription options at http://sigcis.org/mailman/listinfo/members

-- Jeffrey R. Yost, Ph.D. Associate Director, Charles Babbage Institute Faculty, Program in the History of Science, Technology, and Medicine 222 21st Avenue South University of Minnesota Minneapolis, MN 55455 612 624 5050 Phone 612 625 8054 Fax

Jon, et al. There might be some value in looking into the history of Multics, the IBM System/360, and DEC VAX/VMS. These were systems built from the ground up with security in mind, even at the hardware level for address-space protection. I'm sure there are other good cases, but these come to mind. I believe that Peter J. Denning's work on operating systems would also be related. We had a mainframe guy from Compuware come in recently to talk to students about current mainframes, which amount almost totally to the IBM z Systems, descendants of the 360/370. When someone asked about security, he said forget about it. No one's ever hacked a z System. There's this whole, heavy-duty, bullet-proof world of hyper-secure systems, and then the swamps and tangles most of us live in that evolved from Unix, MS-DOS, the 8086, the Mac OS and other jury-rigged OSs and hardware architectures. - Bill On 3/11/12, Jon Lindsay <jrlindsay@ucsd.edu> wrote:

Hello all, I have the feeling that the history of computer security, from hacking techniques to the evolution of the information security industry to fearmongering over cybersecurity, is a somewhat understudied area. I have seen some work on the development of government policy and threat framing (i.e., by Myriam Dunn Cavelty) but I'm less aware of anything on the evolution of the technical and industrial dark arts. If there is some good work out there, I would love to see it. Bonus points if you can tell me when the awful phrase "digital pearl harbor" first appeared! Cheers, Jon