Included in Humphrey’s blueprint for a security reformation are new software development processes that change the governance and structure of software engineering to favor security. Called Team Software Process (TSP) and Personal Software Process (PSP), they entail a fundamental shift in software development practice from the regular army model?top-down command?to a special operations model wherein a small group is given objectives and let loose to fulfill them. "I want the technical community to become professionals," Humphrey says, "to say, This is how we do our job."

TSP and PSP have already been found to reduce coding errors by factors of up to 10 or more. Microsoft tried it and reduced bugs within a 24,000-line program from more than 350 to about 25.

Humphrey also has conceived of even more radical changes, including a software engineering curriculum modeled on medical school, complete with professional internships.

A full-blown security reformation would mark a triumph over the "tragedy of the commons," the dilemma that bedevils Internet security today. A principle in ecology, the tragedy of the commons states that individual short-term benefit trumps collective long-term benefit. That is, I will let my sheep graze on the commons to increase my personal wealth even if it contributes to the degradation of the commons as a whole.

In security, individual companies make, buy and deploy software to gain a competitive edge, even as the networking of that software degrades security for everyone. There’s no incentive for any single company to improve security for everyone, especially if doing so threatens the company’s competitive position and wealth.

"By 2010, there will be a growing general awareness, a link between what individual users do and how that affects the national interest," says Tom Longstaff, the manager of the CERT Analysis Center, which takes in data on the Internet’s swelling number of vulnerabilities and security incidents. "I think of World War II," he adds, "and rationing rubber and nylon. After a momentous event, there’s often a subjugation of the tragedy of the commons."

A security reformation will not take place overnight. Longstaff believes that even with a digital Pearl Harbor in 2008, we’ll be only 20 percent reformed by 2010. Whit Diffie, Sun Microsystems’ CSO, suggests a 10-year time frame before we should mandate zero tolerance for insecure software and enforce strict liability laws. Even Humphrey says, "I’m hopeful, but the issue is one of time."

This vision of security in 2010 is a rosy picture painted with cynical strokes.