Pre-Existing Condition

A shock develops the picture of a disease that was already there.

The 1918 influenza killed tens of millions of people, by some estimates as many as a hundred million, and infected about a third of everyone then alive. In the United States it took around 675,000, most of them inside thirteen weeks in the autumn of that year. Then the world set it down and walked away. We remember the war it came in under, and we have mostly forgotten the influenza, which killed more people than the fighting did. Alfred Crosby's standard American history of the pandemic keeps returning to that one fact: a country could lose this many people and then misplace the memory.

The age of the dead is stranger than their number. Influenza kills at the two ends of life, the infant and the very old, with everyone in between relatively safe. Plot the deaths by age and the curve is a U. In 1918 it was a W. A third peak rose in the middle, among healthy adults between twenty and forty, and it was enormous. Nearly half the dead were people in the prime of life, the very group a flu is expected to spare. For those between fifteen and thirty-four, the death rate ran more than twenty times a normal year. Youth and strength were supposed to mean safety. In 1918 they were no protection, and those who trusted them buried their own.

The name gives it away too. We call it the Spanish flu, though it did not begin in Spain. Spain was neutral, its newspapers uncensored, so the Spanish press reported the dying while the combatant nations kept theirs quiet. The disease took the name of the one country willing to count it out loud. The name marks who was looking, not where the thing began.

The virus did not invent the vulnerability of the young. It exposed something already there. Large shocks often work this way: they reveal more than they create, making visible what was in place all along and impossible to keep putting off. A pandemic works like a developer bath, bringing up the image already on the film.

In the first months of 2020, a shock of that kind was about to land on the business of hiring and staffing cybersecurity, and the picture it would develop had been on the film for years.

Consider the field as it stood at the start of that year. Security budgets had climbed for most of a decade, the one line on the slide that always went up and to the right. The talk was of a talent shortage, a vast one, sized by asking employers how many more people they said they needed, which made it a measure of perception rather than a count of work going undone. Underneath the budgets and the shortage talk sat the machinery the field used to decide who could do the job: a degree, a stack of certifications, the years on a resume, a referral, a handshake at the conference, and the oldest signal of all, a person in the building where they could be seen.

Every item on that list is a stand-in for the work, never the work itself. The field reached for proxies because the work, whether a given person can hold a network together under pressure, is hard to judge from outside and impossible to judge before a hire is made. The problem is older than cybersecurity. George Akerlof found it in a used-car lot: when the buyer cannot tell a sound car from a lemon, he will not pay full price for either, and the good cars drain out of the market. Michael Spence's work on education is the mirror image, a credential worth paying for as a signal of effort whatever the teaching was worth. The broadest version of the idea belongs to James Scott, and it asks to be borrowed with care. His legibility describes how a state forces a society too complex to see into a shape it can count and govern. Lift the word out of that setting and it still names the problem here: a profession has to make competence legible before it can trust it.

The licensed professions built that machinery, imperfectly, over a long time. A pilot has a logbook: every hour in the air, signed off and checkable against a standard nobody waives. A surgeon trains under logged supervision and answers to a board that can pull the license. Cybersecurity never built the equivalent. Little of knowledge work has, but few fields lean on their proxies as hard, or sell them as confidently, as the one that spent a decade announcing a shortage of millions. It treated the proxies as the thing because the proxies were there and the thing was not, and for a long stretch no one was forced to see the gap. A proxy under no pressure to stay honest does what such proxies do. It inflates. The entry-level posting sprouts a degree requirement. A job for a three-year-old technology starts asking for five years of it, and the certifications pile up beside it, each new tier sold as proof and priced to match. The market drifts from the thing it means to measure and calls the drift a standard.

This was the pre-existing condition: a competence-discovery problem the field had learned to call a talent shortage. Cybersecurity could not see capability, so it bought the proxies instead, and the proxies had drifted from the thing they stood for, year after year. The condition was survivable, and stayed survivable as long as nothing stressed the system hard enough to show what the proxies were and were not measuring. The offices were open, the conferences ran, and people sat where they could be seen. The seeing felt like knowing.

Then, in March 2020, the scaffolding came down. The offices closed, the conferences were called off, and the handshake went with them. So did the building, and so did the comfortable habit of watching a person be present and calling it watching them work. Budgets were about to spike on the scramble to secure a workforce that had gone home overnight, then to crater. The proxies were about to be asked to work with the props pulled away, which they had never had to do.

The disease was not new. The field carried it in. What the next two years did was develop the picture, frame by frame, until it lay on the table and could no longer be filed under later. The rest of this week watches that picture come up in the tray.

The candidate who did everything the proxies asked, the certification earned at night, the lab built on weekends, the boxes checked in the order they were handed over, and who still cannot get seen, is not the failure the silence implies. The failure is older, and it belongs to a system that never learned to measure. The next essay turns to what the fever did.

Skill:Signal:Trust is the daily newsletter of Aramis, which assesses cybersecurity candidates against the NIST NICE Framework. It is an attempt to build the evidence layer this essay says the field never had.

Source notes

Laura Spinney, Pale Rider: The Spanish Flu of 1918 and How It Changed the World (2017), for the global scale of the pandemic and its survival in memory as a footnote to the war.

Alfred W. Crosby, America's Forgotten Pandemic: The Influenza of 1918 (Cambridge, 1976; 2nd ed. 2003), for the loss of national memory and the US toll of roughly 675,000.

J. Taubenberger and D. Morens, "1918 Influenza: the Mother of All Pandemics," CDC Emerging Infectious Diseases (2006), for the W-shaped age-mortality curve, the concentration of deaths among adults aged 20 to 40, and the 15-to-34 death rate running more than twenty times above normal.

The "Spanish flu" misnomer reflects wartime censorship: neutral Spain reported the outbreak freely while combatant nations suppressed coverage.

Gartner, for the long rise in security spending through the 2010s and its acceleration during the pandemic.

George Akerlof, "The Market for 'Lemons'" (1970); Michael Spence, "Job Market Signaling" (1973); James C. Scott, Seeing Like a State (1998), for the economics of unobservable quality, signaling, and legibility, adapted here to the cyber labor market.