The burosaurus, that strange dinosaur that deals with cybersecurity in Italy

In 1962 a play by Silvano Ambrogi produced a neologism still in use: Il burosauro. That is one of the dinosaurs of the public administration that survive, act, speak and write in a complicated and self-referential way, hindering the transparent exchange between state and citizen. This is how the decree-law introducing urgent provisions on cybersecurity, the definition of the national cybersecurity architecture and the establishment of the National Cybersecurity Agency (ACN) Umberto Rapetto, former general of the Guardia di Finanza, in the his hearing in the House. The expert, who began dealing with computer crime in ’87 and cyber defense in ’95, declared: “The standard, perhaps due to a limited knowledge of the scenario, was drafted without taking into account the real objective to be pursued. The creation of a burosaurus is destined to produce conflicts between the already existing joints that it does not necessarily manage to harmonize, it triggers administrative dynamics in plaster, it generates a dangerous sense of false security. This approach to the cybernetic emergency conflicts with common sense and forgets the foreign experiences where governments have preferred a small handful of true connoisseurs of the subject to quickly make decisions and move the pieces already operational to face digital attacks, manage the counter-offensive, restore the current situation and, in periods of apparent calm, coordinate all initiatives to raise the level of preparation and reactive capacity of those who manage critical infrastructures and of public and private organizations that provide essential services “. Repetto continues: “If it is true that 95% of IT systems are not secure, as Minister Colao says, it is right to keep out of this game those in the PA or the Prime Minister who for years had, and continues to have, responsibility in the cyber area, because he probably does not have the necessary technical and organizational skills, or he has not been able to do his job. But don’t you want me to believe that you are convinced that the situation is better in industry, banks or businesses? Think of the humiliations suffered by Leonardo, Enel, Inps, Vodafone and Tim, Unicredit, Saipem, Cineca, Snai, Geox, Luxottica, Campari, Ania, the University of Tor Vergata, the San Raffaele Hospital and the thousands of other realities which, in certain contexts, the word should be removed ”. Difficult situations must be resolved with “slender structures, quick to intervene, surgical in action. We need close-knit teams, of a few people with extraordinary professional skills and able to play without protagonism. The hypothesized structure envisages the involvement of too many subjects whose inclusion must only be executive. The Cyber ​​Security Core, for example, evokes leatherheads and Swat ready to swoop into the field, to duel against the enemy on duty, to solve the problem. Instead it translates into a conclave of ministerial representatives, which meets periodically, with the slowness of the convocations and the uncertainty of the respective agendas “. : “All the authorities in our country have different statutes, different rules, different salaries and totally different professions. There are children and stepchildren there too. It is an absolutely unbearable situation. I am talking about the Authorities which are the last existing structures, including the last one of cyber security which will have another type of equipment and rules ”.