VIEW 34
Speciation and the division of labor
Speciation is the process by which populations evolve to become distinct species. It was first observed by Darwin when examining the finches in the Galapagos Islands that were the inspiration for his theory of evolution. Darwin noticed that finches on different islands had differently shaped beaks. Each beak was adapted to a particular task, for example slim and long for pecking insects out of trees, or short and fat for cracking nuts and seeds.
Adam Smith, as much a founding father of economics as Darwin was of biology, observed something similar in his seminal book The Wealth of Nations. Visiting a pin factory, he noticed that different tasks in the process were done by different specialists, which made the factory far more efficient. He realized that this concept of the division of labor was the secret to greater productivity and the driver, therefore, of economic growth.
All wisdom ends in paradox. The more we learn, the more ignorant we realize we are. A murmuration of starlings is more coherent because it is fragmented. In a similar paradoxical vein, an increase in complexity requires simplification. Evolution looks like an increase in complexity from, say, an amoeba to a human. But at the cellular level, complexity is decreasing. A single-celled creature like an amoeba is far more complex than an individual, specialized liver cell in a human. An amoeba does everything, a liver cell does one thing. The whole becomes more complex as the parts become simpler. As with biology, so with economics. A complex modern economy requires a high degree of specialization at each different stage. The division of labor is all about simplification of tasks in order to increase complexity.
Many presentations on cyber risk use an image of a menacing figure with a hoodie crouching over a laptop to represent the cyber criminal. They may also be wearing a Guy Fawkes style “Anonymous” mask. This is very misleading. The cyber criminal ecosystem has speciated. As with all maturing economic systems, we have seen the division of labor. We can break a notional cyber incident into its component parts: the crafting of a tempting phishing email, the selection of an exploitable victim, the acquisition of credentials, the delivery of the malware to create a back door, the selection of data in the victim’s system, the ransom negotiation, and the laundering of the money. All of these different stages can be farmed out to subcontractors, each bringing their particular skills to that part of the value chain.
“Ransomware as a service” kits can be bought, zero-day exploits traded, bitcoin tumbling and washing services offered, and successful “high click rate” phishing scripts exchanged. Criminal gangs are even known to be offering IT help desks to facilitate decryption, or setting up HR departments to attract talent.
We are no longer in the world of a single malefactor but in a fully developed, sophisticated economic supply chain. Might Adam Smith be proud?
