INTRODUCTION

Imagine a data storage and retrieval system that stores millions of discrete files in such a way that they can be accessed, searched, and retrieved by millions of users who can access the system wherever they are connected to the Internet. Imagine that this system is under a multipronged attack. Its enemies have used a variety of techniques, ranging from shutting down the main search server under the threat of armed seizure, to inserting malicious files to corrupt the system, to capturing and threatening the operators of storage devices. Imagine that even through all these assaults, the system continues to operate and to provide high-quality storage, search, and retrieval functionality to millions of users worldwide. That would be a system worth studying as a model for cybersecurity, would it not?

That system has in fact been in existence for five years. It has indeed been under the kinds of attacks described over this entire period. It is the peer-to-peer music file–sharing system. It is the epitome of a survivable system. Its primary design characteristic is radically distributed redundant capacity. The primary economic puzzles in understanding whether it is a model that can be harnessed to design survivable systems more generally are these: Why there is so much excess capacity for its core components – storage, processing, and communications capacity, in the hands of many widely distributed users? And how one might replicate it for uses that are somewhat less controversial than sharing music files.