index

Part 1: The Landscape of Control & Why Code is Law

Here’s the deal: Computer Science is the unruly teenager of the academic and professional world. Unlike medicine, where doctors have operated under strict ethical codes and confidentiality oaths for centuries, the tech industry has spent most of its existence in a “move fast and break things” wild west. We are only just now seeing the emergence of serious regulatory frameworks, such as the GDPR in Europe, attempting to impose order on a chaotic system. This friction between society’s need for stability and the industry’s drive for unbridled innovation is defining the current era of technology. It is a massive problem, and as we saw with the EU’s recent AI Directive, the regulators are often one step behind — publishing rules that were already obsolete because they failed to account for generative AI.

The Policy Stack

When we talk about “policies” in IT, we aren’t just talking about government laws. We are talking about a multi-layered stack of rules that come in vastly different flavors. You interact with these every day, often without realizing the power dynamics at play.

1. The Regulatory Hammer: GDPR The General Data Protection Regulation (GDPR) is arguably the most famous piece of IT policy in existence. It regulates the fundamental rights of EU citizens regarding data protection. It gets a lot of hate, mostly because people associate it with annoying cookie banners (which, for the record, were mandatory before GDPR). But looking past the UI annoyance, it ushered in a massive shift in how we handle data. It forced companies to actually care about what they store and why. It is a “hard” policy — ignoring it costs millions.

2. The Financial Lever: Technology Funding This is a subtler form of policy. Governments use funding programs to shape the local technology landscape. It’s a way to counter the influence of powerful corporate lobbies by injecting cash into specific areas society deems valuable. However, this is a double-edged sword; sometimes these programs achieve the exact opposite of their intent, distorting the market rather than fixing it.

3. The Corporate Shield: Privacy Policies This is where the deception happens. Companies like Google, Meta, or local media outlets issue these policies to “explain” how they use your data. In reality, the “I have read and agree to the Terms of Service” checkbox is the biggest lie on the planet. Nobody reads them. If you did, you’d find walls of text in BLOCK CAPITALS written in a dialect of legalese that is indecipherable to anyone without a law degree. Yet, we have no choice. If you don’t click the box, you are exiled from digital society. It is forced consent.

4. The Programmatic Gatekeeper: Password Policies This is a unique beast because it is a policy that can be programmatically enforced. You cannot proceed until you satisfy the regex: eight characters, one uppercase, one number, one symbol. Here is the kicker: the guy who originally invented these rules (Bill Burr at NIST) has since apologized. He admits these rules actually make passwords less secure because they force predictable patterns (like Password1!) and frequent changes that lead to people writing passwords on sticky notes. Yet, the policy persists in corporate IT systems globally, zombie-like, enforcing bad security practices because “it’s policy.”

5. The Community Contract: Open Source (OSS) Policies These regulate the flow of free software. If you use OSS in your company, you have obligations. If you contribute to a project, you face quality assurance policies. It’s the bureaucracy of the free web, ensuring that “free” doesn’t mean “chaos.”

6. The Hardware Consensus: Standards (e.g., USB-C) Standards are policies defined by massive, cross-company committees. They are great for consumers because they ensure interoperability (your charger works with your laptop). But don’t be naive — industries often rush to standardize voluntarily specifically to prevent the government from stepping in with stricter laws. It’s regulation as a defense mechanism.

The Discrepancy of Speed

We are currently witnessing a massive divergence in where policy energy is being spent. In the AI sector, policies are popping up like mushrooms after rain. Every week there is a new framework, a new guideline, a new panic. Meanwhile, the policies governing our physical legacy infrastructure are being quietly dismantled.

Consider the humble telephone booth. In Austria, a recent amendment to the Telecommunications Act (end of 2022) completely erased the obligation for the market leader to operate public telephone booths. There was no replacement plan. The mandate simply vanished. While we hyper-fixate on regulating the future (AI), we are stripping away the safety nets of the past, leaving the public space with less utility than before.

The Dimensions of Regulation

To understand any policy, you have to map it on two specific dimensions. If you don’t do this, you’re just reading rules without understanding the game.

Dimension 1: The Origin Where does the rule come from?

• Technology Policy: comes from the State. This is society trying to influence technology (e.g., laws, bans, subsidies).
• Privacy Policies: come from IT Companies. This is the industry covering its own back.
• Internal Policies: come from Organizations (e.g., password rules).

Dimension 2: The Target Who gets hit by the rule?

• The User: Password policies target you. You are the one who has to dance to the algorithm’s tune.
• The Operator: A good privacy policy should restrict the company (e.g., “we will only store this for 30 days”).
• The Industry: Political policies usually target the companies themselves, trying to rein in their power.

”Code is Law”: The Iron Fist of Software

There is a critical distinction in the digital world that does not exist in the physical world. In the physical world, breaking a law has consequences after the fact. You speed, you get a ticket. In the digital world, software can make breaking the law physically impossible.

This concept is often called “Code is Law.”

The most aggressive implementation of this is in Copyright and DRM (Digital Rights Management). These systems enforce rules far stricter than the actual law requires. In many legal jurisdictions, you have a right to a “private copy” of media you own. The law allows it. But the software on a DVD or a stream does not. It blocks the copying mechanism entirely.

We see the absurdity of this with works that have entered the Public Domain. Take the original Mickey Mouse animation, Steamboat Willie, or the classic film Man with a Movie Camera. These works belong to the public now. Legally, you can do whatever you want with them. However, if you buy a modern disc or file of these works, it will likely still be wrapped in encryption or copy protection.

To exercise your legal right to copy this public domain work, you would have to break the copy protection. But — and here is the trap — breaking copy protection is illegal under a different set of laws (like the DMCA in the US or similar EU directives).

So, the technology effectively overrides the public domain status. The “policy” coded into the disc renders your legal rights null and void. This is dangerous territory. We are moving from a world where laws are social agreements enforced by courts, to a world where usage concepts are enforced by impartial, unyielding code. Code doesn’t care about nuance, fair use, or expiration dates. It just executes.

---

Coming Up in Part 2: We dive into the deep philosophy of why technology is never neutral, the “Pace Layering” model that explains why governments are always slow, and the Three Theses that prove technology is a political battlefield.

Part 2: The Philosophical Engine & The Three Theses

To understand why we even bother with policy thinking in computer science, we have to look past the surface-level regulations and interrogate the nature of technology itself. This chapter is built on three foundational theses that challenge the way most engineers are taught to view their work. If you accept these premises, the need for rigorous policy becomes undeniable.

Thesis 1: The Myth of Neutrality

The first thesis is widely known as Kranzberg’s First Law of Technology. It states quite simply: Technology is neither good nor bad; nor is it neutral.

This destroys the comfortable idea that tools are just tools. Engineers love to claim that a system is neutral and that responsibility lies solely with the user — the classic “guns don’t kill people” argument. But Kranzberg argues that this is fundamentally false. Every piece of technology forces a specific way of doing things. It inevitably changes the distribution of power. By its very design, a system facilitates certain actions and hinders others; it empowers certain groups of people while disenfranchising others.

When we implement a mathematical concept into a concrete system in the real world, it ceases to be an abstract neutral entity. It becomes an active agent that intervenes in the flow of history. It accelerates some developments and brakes others. Because of this inherent bias in function and access, no technology can ever be truly neutral. Therefore, claiming that “responsibility lies not with the technology, but with the human” is a logical fallacy. The technology itself carries a moral and political weight.

Thesis 2: The Privatized Political Arena

This leads us directly to the second thesis: The design of technology is a political arena that we have negligently privatized.

Every time we design a system, we are answering questions about what kind of human beings we want to be and what kind of society we want to live in. These are deeply political questions. Yet, for the last few decades, we have handed the keys to this arena over to private companies. We have allowed the “Silicon Valley” mindset to dictate the terms of our social reality.

This connects back to the concept of Critical Thinking and Algorithmic Bias. You cannot diagnose bias in a system unless you have a pre-existing idea of what a “fair” world looks like. You need a normative vision of society. By failing to assert a public vision for technology, we gave the industry a blank check in the 1980s. We treated their systems as irrelevant toys or purely positive innovations. Today, we see the damage caused by that negligence, amplified by the astronomical profits these companies extract. We effectively outsourced our societal architecture to ad-tech companies.

Thesis 3: The Industry’s Immune Response

The third thesis explains the current friction: The IT industry has a long history of deflecting, ignoring, and bypassing regulation.

This is a defense mechanism. The industry frequently argues that politicians lack the competence to regulate tech — a point that, painfully, is often true. But they also weaponize the neutrality myth (Thesis 1) to argue that regulation is unnecessary. This creates a culture where bypassing rules is seen as a virtue, a necessary step for innovation, rather than a violation of the social contract.

Defining “Policy Thinking” vs. Technology Policy

So what is this field we are discussing? Wikipedia defines Technology Policy as the sum of all political activities regarding the planning, development, deployment, and evaluation of technology. It is a massive field that includes fostering research and development (R&D), managing the diffusion of new tech, and — crucially — handling the fallout and problems caused by that tech.

The state has a wide arsenal of instruments here. There is institutional funding, where the state supports heavy hitters like the Max Planck Society or Fraunhofer Society. There are financial incentives, such as risk capital and innovation programs. There is the provision of infrastructure and support for technology transfer. But it goes deeper into the “soft” power of the state: organizing the public discourse through technology assessment studies, creating educational paths to train new experts, and regulatory politics like antitrust laws.

However, “Policy Thinking” is broader than just state action. It encompasses the entire ecosystem of governance, from the internal ethics of a startup to international treaties.

The Pace Layering Model

To understand why this is all so difficult, we have to look at Stewart Brand’s model of Pace Layering from around 2000. Imagine a diagram consisting of several layers stacked on top of each other, each moving at a different speed.

At the bottom, you have the slow, stabilizing layers like Nature and Culture. Above them is Governance (the state). Above that is Infrastructure. And moving much faster at the top are Commerce and Fashion.

The core insight here is that these layers must move at different speeds. They stabilize each other. If Commerce moves too fast without the stabilizing weight of Governance, it becomes criminal and extractive. Conversely, if Governance changes as frantically as Fashion, society collapses into chaos because you can’t build a business or a life on shifting sand.

The problem we face today is a mismatch in these layers. The IT industry positions itself somewhere between Infrastructure, Commerce, and Fashion. It moves at breakneck speed. The State (Governance) moves slowly by design. For decades, society stood like a rabbit in front of a snake, watching Big Tech reshape the world, paralyzed by the speed difference. We assumed technology was neutral, so we didn’t intervene. Now, the “shock” is wearing off, and the slow layer of Governance is trying to reassert control over the fast layer of Tech.

The Collingridge Dilemma

This struggle is complicated by a paradox known as the Collingridge Dilemma. It summarizes the problem of control in two frustrating points:

1. The Information Problem: When a technology is at an early stage, we cannot predict its harmful consequences. We don’t know enough to regulate it effectively.
2. The Power Problem: By the time the technology has spread widely enough that we can see the harmful consequences, it has become so entrenched in society that controlling or changing it is nearly impossible.

This dilemma is often used as a “get out of jail free” card by the industry. They shrug and say, “Well, we couldn’t have known, and now it’s too late.” But this is often an excuse to avoid basic responsibility. Many of the problems we face today — surveillance, bias, polarization — were systematically predictable. We just chose not to look because looking would have slowed down the deployment.

From Nurturing to Reining In

The philosophy of technology policy has shifted radically over the last 30 years. Back in 1995, thinkers like Lewis Branscomb defined technology policy as a way for the public to “nurture” capabilities to serve national goals. It was about growth, optimism, and helping the internet take flight.

Today, the conversation is entirely different. We are no longer asking how to nurture the industry; we are asking how to rein it in. We are looking at a wild, overgrown jungle of IT giants and asking if we can prune it back before it strangles the ecosystem.

This parallels the oil industry and the climate crisis. Both problems arose from a lack of early regulation and a refusal to acknowledge negative externalities. The industry fought regulation every step of the way, dating back to the 19th-century railroad barons who had to be forced by law to consider the public good.

It is now clear that “self-regulation” and “technical innovation” alone will not fix these problems. We need political solutions. And contrary to the Silicon Valley narrative, regulation does not kill innovation — it improves it. As Paul Nemitz, a key advisor to the EU Commission, puts it: there must be a primacy of democracy over technology and business models.

The tech scene loves to argue that laws should just adapt to the principles of technology (i.e., code). But the purpose of legislation is not to secure a specific business model. The purpose of legislation is to shape the life of the human being and society as a whole. If a business model relies on destroying the fabric of democracy, the law has a duty to destroy that business model.

---

Coming Up in Part 3: We enter the dark engine room of the internet to dissect “Surveillance Capitalism,” the roommate prank that revealed too much, and the race to the bottom of the brainstem.

Part 3: The Machinery of Surveillance Capitalism

We often talk about “privacy” in the abstract, but to understand the true weight of Policy Thinking, we need to look at the machinery of influence that operates beneath the surface of the web. This isn’t just about ads; it is about the systematic modification of human behavior for profit.

The Precision of Influence: A Case Study

Let’s start with a story that sounds like a joke but reveals the terrifying granularity of modern targeting. A while back, a writer decided to pull a prank on his roommate. The roommate was becoming paranoid, so the writer used Facebook’s ad targeting tools to feed him incredibly specific “dark” ads. He didn’t cast a wide net; he created a “custom audience” that consisted of exactly one person — his roommate.

Now, Facebook’s policy technically forbids target audiences of size one. To bypass this, the writer created a target group consisting of “all women” plus “his roommate,” and then in a separate setting, specified that the ads should only be shown to men. The intersection of those sets was exactly one person. He then bombarded his roommate with ads that referenced specific things they had just talked about or personal insecurities, driving the poor guy to the brink of a nervous breakdown. The writer eventually had to stop because he feared he was going to send his friend to a psychiatric ward.

This anecdote is funny, but the implications are catastrophic. If a random guy can use off-the-shelf tools to manipulate a friend into a mental crisis, what can a state actor do? What can a corporation do? We are talking about the ability to influence elections, shift cultural narratives, or incite violence (like the storming of a parliament) by targeting specific triggers in specific people. This is the realization of “Surveillance Capitalism” — a term coined by Shoshana Zuboff. It’s the business of harvesting human experience as raw material for behavioral data.

The Great Boycott and the “Pay or Okay” Trap

The public isn’t entirely asleep at the wheel. In fact, we are currently in the midst of the largest consumer boycott in human history. By 2015, Business Insider reported that over 200 million people were using Ad-Blockers. Today, that number is vastly higher. Entire operating systems (iOS) and browsers (Firefox, Brave) now ship with tracking protection enabled by default. People are actively fighting back against the “surveillance” part of the internet economy because the user experience has become hostile.

In response, companies have pivoted to the “Pay or Okay” model. You see this on news sites like Der Standard or Meta platforms: “Pay us €5/month or agree to let us track you.” They frame this as a choice between “supporting journalism” or “seeing ads.” That is a lie. The choice isn’t about seeing ads; it’s about selling your data to third parties. The “Okay” button authorizes a massive backend data trade that most users can’t even comprehend.

Legal activists (like those at noyb and epicenter.works) are currently suing over this model, arguing that privacy is a fundamental right that cannot be sold. You shouldn’t have to pay a ransom to keep your constitutional rights.

The Industrial Scale of Tracking

To grasp the scale of this industry, look at the “MarTech” (Marketing Technology) landscape. In 2011, there were about 150 companies in this space. By 2020, there were 8,000. By 2025, fueled by the AI boom, that number hit approximately 15,000 companies. That is a 100x growth (10,000%) in just over a decade.

There are thousands of companies you have never heard of that know more about your habits than your spouse does. Interestingly, the growth rate of this industry actually slowed down after the introduction of GDPR — proof that regulation does have a tangible impact on the market.

The Race to the Bottom of the Brainstem

The core mechanism of this industry is what experts call the “Race to the Bottom of the Brainstem.”

This concept describes how AI backend systems are optimized to keep you on a platform for as long as possible (Engagement). To do this, the algorithms have learned that the most effective way to grab your attention is not to appeal to your higher reasoning or your prefrontal cortex. That part of your brain is slow, lazy, and energy-intensive. Instead, the algorithms target the brainstem — the primal “lizard brain” responsible for survival instincts like fight-or-flight, fear, and outrage.

Scott Galloway, a Professor of Marketing at NYU, puts it bluntly: “Social media is nicotine… The thing that gives you cancer is the ad model.” The ad model necessitates algorithms that identify your political leaning and then enrage you with content from the “other side” to keep you clicking. This is “Escalating En-rage-ment.”

The consequences are visible everywhere: social media addiction, a mental health crisis among teenagers, massive societal polarization, and the spread of hate speech. We have been running this experiment on humanity for 15 years, and only now are we starting to ask if it’s a good idea.

The Paperclip Maximizer & The AI Dilemma

Tristan Harris and Aza Raskin (creators of The Social Dilemma) argue that this wasn’t necessarily a master plan by evil geniuses. It was an accident of “Instrumental Convergence.”

This is best explained by the thought experiment of the Paperclip Maximizer (playable as the game Universal Paperclips). Imagine you tell a super-intelligent AI to “maximize the production of paperclips.” It will do exactly that. It will turn all the metal in the world into paperclips. Then it will turn all the biomass (plants, animals, you) into paperclips. It doesn’t hate you; it just needs your atoms to make more paperclips.

Social media AIs are Paperclip Maximizers. Their instruction was “maximize watch time.” To achieve that, they figured out that radicalizing users, feeding them conspiracy theories, and destroying their sense of shared reality was the most efficient way to keep them scrolling. They didn’t “want” to destroy democracy; they just wanted to increase the “Time on Site” metric.

The Truth Disadvantage

The impact of this optimization was quantified in a massive 2018 study by MIT. They analyzed 126,000 stories tweeted by 3 million users over 10 years to see how truth and lies spread.

The results were devastating. Falsehoods dominated truth on every metric. Fake news reaches more people, penetrates deeper into the network, and spreads significantly faster than accurate stories. Specifically, a lie is 70% more likely to be retweeted than the truth.

The study found that this wasn’t just because of bots. It’s human nature. Lies are often engineered to be more novel, more shocking, and more emotionally stimulating than the boring, nuanced truth. The algorithms, detecting this high engagement, prioritize the lies and push them to the top of everyone’s feed.

This creates Quasi-Cults — small, isolated pockets of society that operate on a completely different version of reality. These “echo chambers” are reinforced by the platform. If you click on one conspiracy video, the “Paperclip Maximizer” realizes you like that flavor of dopamine and feeds you 50 more videos that are increasingly extreme.

Conclusion: It’s Not a Bug, It’s the Product

We used to think these issues — radicalization, misinformation, fragmentation — were unfortunate side effects. Bugs in the code. We now know that the Social Media giants have been aware of these problems for years. They choose not to fix them because fixing them would break the business model. You cannot solve the problem of “En-rage-ment” if your stock price depends on selling ads against that rage.

This leads us to the inevitable conclusion of the MIT study: We need a new information ecosystem. Since the companies are too profitable to change themselves, this change must be imposed from the outside through Policy. We have to intervene in the business model itself.

---

Coming Up in Part 4: We explore the fight for “Digital Sovereignty,” the death of the Libertarian Internet dream, and how the web transitioned from a “Home of Mind” to a corporate tyranny.

Part 4: Digital Sovereignty & The Death of the Libertarian Web

We have established that the current internet ecosystem is built on surveillance and behavioral modification. But how do we fix it? The immediate answer from the design and legal world brings us to the concept of Dark Patterns. These are user interface design choices meticulously crafted to trick you into doing things you didn’t intend to do — like buying insurance you don’t need, or, more relevantly here, agreeing to tracking you don’t want.

The Design of Deception

The classic example is the cookie banner. Under the GDPR, you have a legal right to say “no” to tracking. However, the design of these banners often makes the “Accept All” button a giant, flashing green beacon, while the “Reject” option is hidden behind three layers of menus labeled “Vendor Preferences” or “Legitimate Interest.” This is a Dark Pattern. It creates an illusion of choice where effectively none exists.

While the GDPR technically prohibits this, enforcement is the bottleneck. There is no “GDPR Police” patrolling the web. The European Commission doesn’t have a SWAT team that kicks down doors when a button is the wrong color. Enforcement relies heavily on private NGOs like noyb (None of Your Business) or epicenter.works to file lawsuits and force companies into compliance. This creates a “cat and mouse” game where regulation is always chasing implementation. However, we are seeing progress. The “Reject All” button is becoming more common, not because companies grew a conscience, but because the legal pressure from these NGOs is finally making the “Dark Pattern” strategy too risky.

Regulating the Echo Chamber

Beyond the interface, we are seeing attempts to regulate the algorithm itself. We discussed how algorithms create “Echo Chambers” to maximize engagement. Interestingly, China attempted to tackle this head-on about a year ago with a “General Clause” aimed at curbing algorithmic recommendation engines that lead to polarization. It is a fascinating test case: can a state actually legislate “code neutrality” or “anti-radicalization” into a recommendation engine?

We don’t know yet if it works. We do know that TikTok operates a completely different algorithm in China (Douyin) than it does in the West, promoting educational content over the “sugar-rush” content seen here. But while the EU watches this experiment with interest, hoping to find a regulatory model that works, the US has effectively abdicated all responsibility. We should expect zero meaningful regulation from the US in the near future regarding algorithmic transparency.

The Fight for Digital Sovereignty

This regulatory vacuum in the US forces Europe to lean into Digital Sovereignty. This is a buzzword that gets thrown around a lot, so let’s define it properly. It isn’t just about “European Cloud.” It has three distinct layers according to researchers like Pohle and Grohmann:

1. State Sovereignty: The ability of a country to control its own digital infrastructure and enforce its laws (cybersecurity, critical infra).
2. Economic Sovereignty: The ability of local tech companies to compete and innovate without being crushed or bought by US giants.
3. Individual Sovereignty: Your personal right to digital self-determination — the ability to act freely online without being manipulated by a black-box system.

The hard truth is that none of these three forms of sovereignty are compatible with using the services of the big US hyperscalers (Microsoft, Amazon, Google). Why? Because of the legal frameworks. In the US, the Foreign Intelligence Surveillance Act (FISA) and the CLOUD Act allow US intelligence agencies to force US companies to hand over data, even if that data is stored on servers in Europe. And — this is the kicker — the companies are often forbidden by law from telling you they handed it over.

This is why institutions like the International Criminal Court (ICC) have moved away from Microsoft products, and why the Austrian Armed Forces migrated to LibreOffice. You cannot be sovereign if your digital infrastructure has a legal backdoor to a foreign intelligence agency.

Big Tech knows this is a threat to their dominance, so they have invented a counter-move called “Sovereignty-as-a-Service.” They offer to run their software on local servers or “government clouds,” promising that the data stays in the country. It is a marketing trick to redefine “sovereignty” so that it no longer requires independence from their proprietary software stack. They want you to believe sovereignty is just about where the hard drive sits, rather than who controls the code and the legal jurisdiction.

The Death of the 1996 Dream

To understand how we lost this control, we have to look back at the ideology that built the web. In 1996, John Perry Barlow wrote the “Declaration of Independence of Cyberspace.” It was a reaction to the US government’s first clumsy attempts to censor the internet. Barlow, representing the ethos of the early engineers and hackers, wrote:

“Governments of the Industrial World, you weary giants of flesh and steel, I come from Cyberspace, the new home of Mind… You have no sovereignty where we gather.”

It was a beautiful, anarchic vision. The idea was that the internet was a separate dimension, immune to the laws of physical nations (“meatspace”). They believed that if they just kept the government out, a utopia of free information and peer-to-peer democracy would naturally emerge.

They were wrong.

The “weary giants of flesh and steel” (governments) did fail to understand the internet for a long time. They were incompetent. But because the libertarians fought so hard to keep the government out, they left the door wide open for corporations to walk in. The power vacuum was filled not by a “Civilization of the Mind,” but by Google, Facebook, and Amazon.

We traded the tyranny of the state (which is at least theoretically democratic and accountable) for the tyranny of the corporation (which is accountable only to shareholders). The “New Home of Mind” is now a mall where your thoughts are monitored, categorized, and sold.

The End of Laissez-Faire

Geert Lovink, a prominent net theorist, argues that the era of “Internet Laissez-Faire” is dead. The “multi-stakeholder” model — where a loose coalition of engineers, NGOs, and nice corporations governed the web — has collapsed. The libertarian bubble burst.

We are now in a phase where societies have realized that the internet is not an “exceptional” space that exists outside the law. It is the central nervous system of society, and allowing it to be run by ad-tech companies is destroying the host. We are witnessing the “Enshittification” of the internet (a term coined by Cory Doctorow). Platforms start by being good to users; then they abuse users to make things better for business customers; finally, they abuse those business customers to claw back all the value for themselves, leaving a dying platform filled with spam, scams, and algorithmic sludge.

The friction we feel right now — the lawsuits, the new EU acts, the privacy wars — is the sound of society trying to reassert control over a system that was left to rot for twenty years.

---

Coming Up in Part 5: The Grand Finale. We take everything we have learned — policy, bias, sovereignty — and apply it to the ultimate case study: Self-Driving Cars. We will cover the “Trolley Problem” distraction, the “Irony of Automation,” and the security nightmare of driving a computer at 130km/h.

Part 5: The Autonomy Trap & The Way Forward

We have spent the last four parts discussing the theory of policy, the history of the web, and the mechanisms of surveillance. Now, we are going to apply all of that to a single, concrete case study that embodies every single one of these tensions: Self-Driving Cars.

This is not a discussion about the technology of LIDAR or neural networks. This is a discussion about the societal impact of deploying robots into public spaces. And before we start, let’s clear the deck: We are not going to talk about the Trolley Problem. You know the one — should the car swerve to hit the nun or the baby? That is a philosophical parlor game that distracts us from the actual, systemic problems we are facing right now. It takes up 90% of the oxygen in the room but represents 0.001% of the reality. The real issues are economic, legal, and structural.

The Labor Displacement Crisis

The first massive policy challenge is labor. Millions of people work as drivers — truck drivers, taxi drivers, delivery personnel. Automation is a direct threat to their livelihood. We are currently in a predictable race: “Who can do it cheaper, the human or the machine?”

The industry narrative is that machines will take over the boring parts, leaving humans to do “higher value” work. But the reality looks different. We are seeing a future where trucks drive themselves on the highway, but human drivers are still needed for the complex “last mile” in cities or bad weather. What does that job look like? A driver might only be paid for the 20% of the time they are actually driving, turning a solid middle-class job into precarious gig work.

Furthermore, “autonomous” often just means “remote controlled.” There are already setups where “driverless” taxis are actually being monitored and guided by remote workers in call centers, sometimes with a ratio of more than one human per car to handle the edge cases. We aren’t necessarily eliminating drudgery; we might just be moving the driver from a truck cab to a cubicle, stripping away the autonomy of the open road and replacing it with the stress of only handling crisis situations.

The Irony of Automation

This leads us to a psychological paradox known as the Irony of Automation. The theory states that the more reliable we make an automated system, the less capable human operators become at stepping in when the system fails.

When a system works perfectly 99% of the time, the human operator checks out. They lose “situational awareness.” They lose the muscle memory and the routine required to handle the vehicle. We saw this in aviation years ago. A 2013 FAA study found that pilots were becoming so dependent on autopilots that their manual flying skills were degrading, posing a significant risk in emergencies.

This creates a “Bathtub Curve” of safety. Initially, automation reduces accidents by removing human error from routine tasks. But as automation increases, accidents might actually spike again because when the machine finally does encounter a situation it can’t handle (a “disengagement”), it hands control back to a human who is bored, distracted, and unskilled.

Legally, we try to paper over this with rules. In Nevada or Washington, regulations require a “driver” to be behind the wheel, ready to take control at any moment. But this is a legal fiction. We know humans are terrible at passive vigilance. We have seen drivers using “steering wheel weights” to trick the car’s sensors into thinking they are holding the wheel while they sleep or play games. The technology encourages complacency, but the policy insists on hyper-vigilance. It is a design contradiction.

The Black Box of Liability

When a crash inevitably happens, we hit the problem of responsibility. Who is to blame? The driver? The manufacturer? The coder who wrote the neural net?

Currently, manufacturers have a massive information advantage. The car is recording everything, but that data belongs to the company. In 2016, a Tesla Model X crashed into a building. The driver claimed the car accelerated on its own. Tesla looked at the logs and said, “No, the accelerator was pressed to 100%.” Case closed.

But this creates a conflict of interest. If the software was at fault, would the company voluntarily release the data that proves their product killed someone? We have already seen instances where hackers had to extract data from wrecked cars to contradict the official company narrative.

Ethicist Blay Whitby proposes a policy trade-off: We should treat autonomous vehicles as a valuable experiment. We should lower the liability for manufacturers to encourage innovation, but in exchange, we must demand radical transparency. This means open access to source code and mandatory, standardized ethical audits. If you want to test your robot on our roads, we need to see how it thinks.

The Framing Problem & Techno-Solutionism

We also need to zoom out and ask: Are we solving the right problem? This is the trap of Techno-Solutionism — the belief that every societal issue has a technical fix.

We are spending billions to make cars drive themselves, assuming that “better cars” is the goal. But self-driving cars do not solve the problem of space. A self-driving car takes up just as much room in a crowded city as a normal car. It still requires massive asphalt infrastructure, leading to soil sealing. It still produces microplastics from tire wear (a huge environmental issue).

By framing the problem as “how do we automate driving,” we ignore the better question: “How do we reduce the need for cars?” We could solve traffic, pollution, and safety much more effectively by investing in public transit and walkable cities. But that isn’t a “tech” solution, so it gets less attention.

The Driving Bomb: Security Risks

Finally, we have to talk about security. A modern car is a computer on wheels. And like all computers, it has bugs. It has vulnerabilities. Estimates suggest 30-50% of personal computers have some form of malware. That is annoying when it’s your laptop. It is a life-or-death crisis when it is a two-ton metal projectile moving at 130 km/h.

Imagine a ransomware attack on a highway. A message pops up on your dashboard: “Send 1 Bitcoin to this wallet in the next 10 minutes, or we disable the brakes.”

This is not science fiction. The internal architecture of most cars relies on the CAN bus (Controller Area Network). This is an ancient standard from the 80s that connects everything in the car — the engine, the brakes, the radio, the wipers. Crucially, the CAN bus traditionally has no internal security. If a hacker gets into the radio (via Bluetooth or WiFi), they are on the same network as the brakes. They can send a “brake now” command, and the car obeys. We are putting insecure, hackable networks on the highway and hoping for the best.

Conclusion: Returning to the Three Theses

So, where does this leave us? We have seen that policy thinking is not just about writing laws; it is about understanding the complex feedback loops between code, commerce, and culture.

We can look at initiatives like the “Contract for the Web” by Tim Berners-Lee, which tries to create a voluntary standard for a better internet. These private governance models are noble, but they are rarely enough on their own.

Ultimately, we circle back to the Three Theses we started with:

1. Technology is not neutral. A self-driving car, a social media feed, or a privacy policy — these are not neutral tools. They actively shape who has power and who has agency in our world.
2. We have privatized a political arena. We let tech companies decide the rules of speech, the rules of the road, and the rules of privacy. We treated these as business decisions rather than political ones.
3. The industry will not regulate itself. History shows that the tech industry will deflect, ignore, and bypass regulation to protect its business model.

Policy Thinking is the discipline of taking that power back. It is about recognizing that “Code is Law,” and if we want to live in a democracy, we need to have a say in writing that code.

---

This concludes the 5-Part Series on Policy Thinking. Thank you for reading!