As a software developer who found myself elected to state level public office and had to spin-up my education around the legislative process and all of politics, I concur.
Their are only a couple of things I'd add.
As much knowledge as I brought in about technology and the idea of being aware of system thinking, I also brought in a great amount of ignorance about all the other areas that are legislated (healthcare, interplay between local, state, and fedearl issues, budgetary concerns, tax policy, banking, etc.). Good legislation is truly collaborative.
Sadly, for the second part, good legislation is rarer than it should be as much of legislation is about politics and perception of the voters. And voter perceptions are not necessarily logical or reasoned.
This makes it all the more important, IMHO, that everyone who is reasonable, logical, and educated spend their precious, valuable time involving themselves to advocate for elected officials who behave similar in what is essentially a zero-sum game.
p.s. Have faith. I saw enough during my time that gave me reason for that faith. (But that faith requires time and effort -- we don't get good government or democracy for free.) I'm glad to hear you're getting better.
In the referenced book, the author details how the aluminum cartel was dismantled under the threat of WWII needs because of their failure to promptly address the needs of the United States.
Depending upon how your brain works, i.e. if you're neurodivergent, you may find value in understanding how your brain processes with respect to neurotypicals.
The second half of this claim is a demonstrably weak generalization as to the source of power.
The counter example is Georgia, where the Board of Regents is beholden to the politics of the Governor. See recently the fiasco with the pandemic i.e., mandated vaccines and mandated masks.
Proof? The companies run by the members of the Board of Regents implemented different policies than the members themselves voted for the universities in the state of Georgia.
Heh, understanding apache configuration files just made me facepalm harder and wasn't really critical to seeing the impact on the cybersecurity industry if people aren't able to responsibly disclose.
The important thing was to take the time, speak to the bill's author, speak to my colleagues, build a coalition of lobbyists from industry (big companies, startups, etc.), and not stop fighting the bill even after it passed the legislature.
> In your opinion, is there a way to fix this sort of thing?
Yes, it requires patient, reasonable, intelligent people operating in good faith to sacrifice personal comfort, etc. and get involved in politics.
Politics is literally a zero-sum game when it comes to voting as it is currently structured in most of the United States.*
But when people with the above characteristics get involved, it literally moderates the extremism that we decry. No matter the level (local, state, or federal), whether you decide to run for office, helps others run for office, get involved with a party, or find a particular issue, being involved makes a difference. You may not be able to easily quantify, but it does make an impact. You may also be bringing a critical perspective in short supply to the political process too.
> On what rational grounds do you attempt to prosecute or make such things illegal?
I heard four reasons for the 2017-2018 SB 315 bill.
1. To ensure the next time someone shared a vulnerability that made the state look bad, that a D.A. would have the choice to bring a criminal case (which would obviously color perception of the story).
2. To bring the law into parity with Federal criminal statutes.
3. To give the Attorney General a "tough on cyber crime" campaign plank.
4. The banks were asking for help prosecuting criminals.
For further context, voter rolls were already public information and can be acquired via a request to the SoS office.
The larger red flags were the default usernames and passwords in the instructional pdfs for the election systems.
Both of these symptoms (and more) spoke to a woefully underfunded or poorly run office w/r/t to IT.
Getting more funds to have properly, well-secured systems takes political capital and there's not a lot of return of that type of political capital expenditure.
The current SoS has an engineering background and I've been seeing much better public facing systems put in place during their tenure.
*. Please, please, please can we get approval based voting?
I served in the Georgia legislature during a portion of a similar story. Without a doubt, the calculations throughout the story were political not technical.
In the Georgia version, the technical details of the exposed information in the Secretary of State's office were facepalmingly simple (misconfigured apache directives) yet the story dragged on politically for years.
Quickly, a hired security researcher for a corporate client found all registered voters info and instructional pdfs with credentials for the elections system publicly indexed by google. They responsibly disclosed. The apache configuration was updated to "use encryption" (moved from http to https) but still left the info indexed by google over https vs. http. Eventually, this information became public.
The state attempted to prosecute the security researcher but found no state statutes they could use. They then used this incident as a base to create a bill to criminalize the security researcher's actions.
As a state rep, I worked very hard to push back on a bad bill spawned by the incident that would've criminalized responsible disclosure.
Only due to bi-partisan efforts from technically versed people were we able to get the Governor at the time to veto the bill.
Twenty years ago, my wife came out of graduate school where they learned about differentiated instruction and inquiry based instruction.
The education field is well aware of how to teach better. However, there are obstacles to the implementation.
1. Resources. Inquiry based education (where the children drive the study) requires a different student to teacher ratio than 30:1.
2. Inertia. You need a systemic change otherwise those fresh new teachers with their fancy up to date pedagogy run into #1 and principals, teachers, and students who are not ready for it.
3. Parents. Parents are also not ready for it. You have parents who want to be certain their child is prepared and ranked.