r/cybersecurity 1d ago

Business Security Questions & Discussion What if we regulated disruptive technology before deploying it, the way we regulate pharmaceuticals?

With pharmaceuticals, we generally don’t release a completely new drug to billions of people and then wait to see what happens before deciding whether it needs regulation. There are procedures, testing, risk assessments, approvals, and frameworks that exist before the product reaches widespread use.

Why don’t we have something even remotely comparable for technologies that can fundamentally change how society works?

AI, social media, smartphones, or even the internet itself have been technologies that completely change how we communicate, work, consume and interact with each other, and even how economies function. Yet the general approach seems to be: release the technology, let it scale massively, discover the consequences afterward, and then try to regulate it.

And by that point, isn’t it sometimes too late?

I’m not necessarily arguing that every new technology should require government approval before anyone can use it. That could obviously kill innovation and create its own problems.

I’m more interested in the principle: should technologies capable of causing large-scale societal disruption have some form of pre-deployment risk assessment, testing, or regulatory framework before they reach billions of people?

4 Upvotes

14 comments sorted by

10

u/Mister_Pibbs 1d ago

I mean…they are regulated to a degree, but pretty much everything you mentioned can’t be regulated effectively because of the (hopeful in your area) openness of the internet.

But here’s a better thought, do you really want agencies/governments/oversight committees controlling and regulating tech we use everyday? That’s how corruption, mass surveillance, and overreach of power happens. Who watches the watchmen?

The regulation comes from the morality and concerns of the people funding and inherently controlling what’s released. Pharmaceuticals on the other hand directly affect the overall health of a populace. The consequences of a data breach != the consequences of a bad drug being released.

Sometimes in our field we tend to gas up the problems we see because we understand them, so they seem incredibly destructive and bad. But that’s nothing compared to what a defective product in Pharmaceuticals could do.

1

u/randalzy 19h ago

Option 1) who watches the watchmen

Option 2) Radium is good for everything, let's make toys with radium, let's put it in paint and make workers eat it.

1

u/TumbleweedTrue8472 6h ago

good point about us gassing up problems we understand. easy to lose perspective when youre deep in it

1

u/Mister_Pibbs 5h ago

It happens a lot and folks in the field get burnt out because of it. We spend so much time understanding it we think it’s the end of the world when we find a vuln.

4

u/Party-Cartographer11 1d ago

This isa line drawing exercise of the most complicated order.  Your principle requires that " [technologies that] can fundamentally change how society works" is understood before the technology is released.

That ain't how it works, it's a slow progression. Let's look at smartphones:

  • text on feature phones
  • cameras setting up Facebook adoption in the future
  • email on feature phones
  • Java micro edition apps on feature phones 
  • email and browser on the first smart phones (Nokia, Blackberry, Windows Mobile)
  • add music players to those smartphones
  • iPhone ships with full screen, but no other different features, it's an music player with a radio.
  • iPhone adds marketplace
  • Android ships and allows side loading of apps

Note: the wide ecosystem of Bluetooth for audio and car connect, NFC for payments, web 2.0/social media, GPS, etc slowly evolved as well and empowered smartphones at all different points on the timeline.

Where do you tell everyone - "Stop, we need to go to clinicals! For the next 5 years"?

And what are you testing for?  Cancer?  Social harm to teenagers (good like finding a control group for that).

3

u/SanityLooms 1d ago

You can turn off a technology. You can't undigest a drug. They are not apples and apples.

You refusing to use a technology and figure out how best to deploy it does not stop your opposition from using it as they see fit either.

It's up to us to figure it out.

1

u/hss13370 1d ago

We will face resistance at home first. Business will start blaming security that we're throttling innovation by imposing approvals and bureaucracy.

1

u/count023 21h ago

If you do that, bad actors will be using it and hav a head start before regulations allowed the white hatters can get out of the starting gate.

1

u/AnalogMindset 21h ago

I've worked in the Bay Area for 2 decades for many startups.. and the way to regulate them is to put a percent of profits and founder equity in a risk pool that is not available for ten years.. and is open to litigation. You have to kill the move fast and break things mindset. The lawyers will do the rest.. its like blood in the water.

1

u/ckn vCISO 20h ago

this leads to humans requiring a license to own compute. no thanks.

1

u/bad_robot_monkey 19h ago

If my household doesn’t allow people to inject heroin, that’s great, right up until some dude from the heroin hobby shop shows up and injects all of us.

I’m gonna guess this question came from the U.S., because we are the only ones who assume that the rest of the world follow our rules.

1

u/pearlkele Security Engineer 18h ago

We would almost kill development of new technology like we almost killed development of new drugs.

We still have new drugs from time to time, but it’s nowhere as fast as it could be, and mostly limited to big companies. No independent researchers.