This paper raises important points, although its not well written and is patchy. Security "policy" is a disaster area, and is only getting worse. Why? Increas

This paper raises important points, although its not well written and is patchy. Security "policy" is a disaster area, and is only getting worse. Why? Increasingly, policy is being treated as separate and different from technical matters. Yet these are not legitimate specialisms. A fake, forced partition that aligns with hierarchical ideals of western "management culture" leads to parts being written, implemented and enforced by different groups of people. This crystalises into rigid divisions, obsessive attempts to document and "nail down" everything, and a mind-set of "compliance and audits". Schisms then arise that are worse than the outright failure of any individual part. The idea that policy relates to implementation as management does to production/execution is deadly in its stupidity and grave in its implications because it fails to apprehend security as a continuous dynamic process of reconnaissance and adaptation. Although I do not believe military metaphors are always appropriate to security, consider by analogy the staffing of senior generals and government advisors on defence. Years of crawling around in the jungle with a dagger in your teeth is pre-requisite to sitting in a leather chair in Whitehall deciding whose sons will go risk their lives. Nobody "comes in at a senior level" from a career in contemporary dance and a conversion masters degree in Peace Studies. By comparison the technological society has been caught with its pants down and we are desperate to fill cybersecurity roles. Anyone of sufficient seniority with a "policy background" is presently welcome to stick their oar in and make a sideways leap to CSO. Digital security however is a complex, nuanced and extremely demanding area. It can't be bolted-on or fixed with off-the-shelf products. You can't order people to do it. Almost every decision is an impossible gut-wrenching compromise. Put simply, you actually need to know what you're doing. You need to have seen and dealt with the consequences of shallow decisions and reactionary practice, and to have experienced real users, who are diverse and sometimes infuriating. This paper correctly identifies the need for a more mature and integrated ethos for research and practice, one that moves beyond "mere" software and hardware. But it fails to apprehend the symmetry of the problem. Those who claim to have something to teach about "policy" must be scrutinised to ensure their focus is not on power rather than polity, on hierarchy rather than effective structure, or on "grand plans" rather than skillful adaptation.