Future Tense

Why We Should Wash Our Hands of “Cyber-Hygiene”

Hygiene isn’t the right metaphor for cybersecurity

Photo Illustration by Sean Gallup/Getty Images

Apparently the Internet is a very dirty thing—one that requires you to wash up after using it. At least that’s the attitude of people calling for “cyber-hygiene.” For example, Ben Hammersley, the editor at large of Wired UK, recently wrote in the Guardian:

“The most important life skill we’ll be teaching our children over the coming decades will be cyber-hygiene. Fighting infections in the 21st century is less about washing your hands and more about not clicking on untrusted email attachments Those of us who don’t understand this will be shunned as digitally unclean.”

The Department of Defense has also adopted the term—which refers to having good cybersecurity habits to keep your computer free of malware—in its Strategy for Operating in Cyberspace report from 2011, which states, “Cyber hygiene must be practiced by everyone at all times. … People are the Department’s first line of defense in sustaining good cyber hygiene and reducing insider threats.” And early this year Homeland Security Secretary Janet Napolitano urged citizens to use “good cyber-hygiene” lest they open themselves up to the hidden dangers of the Internet.

The idea of cyber-hygiene can be traced back to Vint Cerf, an early architect of the Internet and Google’s current “chief Internet evangelist,” who says he came up with the idea when thinking about teeth brushing, but, you know, for your computer.

Sounds reasonable, right? But the idea of “cyber-hygiene” is embedded with underlying assumptions of individual responsibility and control. That is, if you don’t practice digital cleanliness, then you have failed to be a good citizen—and perhaps you should be shamed for it. This is a wrong and shallow way to think about the topic, one that puts an undue onus on the individual. But even people who should know better can fall for a sophisticated spearphishing attack. Instead of blaming people if their computers get infected, we should instead ask what caused people to become victims, if they are indeed victims, in the first place.

Hygiene is often corollated with moral goodness, which levies a heavy burden on people. Rather than being a sign of bad character, poor hygiene—personal, cyber, or otherwise—might be an indicator of an unprivileged status because the person lacks, say, access to a washer and a hot bath or to expensive anti-virus software.

What’s more, if you take the historical perspective—something that is all too often avoided in conversations about technology—you’ll see that hygiene as a metaphor is wrapped up in some nasty episodes of the past. Take, for instance, the social hygiene movements that were started in the late 19th and early 20th centuries. As Whitney Boesel and David Banks, both contributors to the blog Cyborgology, reminded me during a conversation about the topic, hygiene has been linked to a number of terrible methods of trying to clean up society. By latching onto the growth of public health science, hygiene served as the basis for marginalizing and locking away “dirty” women like prostitutes and those deemed “mentally deficient.”

Once you start making choices about who is unclean—in body or computer—then you’ve entered into troubled territory.