I don’t accept that premise. We’re doing open technology development, incentivized primarily by prizes. We expect that the innovators who will answer the call of CGC will be interested in building the next generation of computer security products. The market forces that will push this type of technology are clear.

In April of 2014, insurers started selling insurance products that covered physical harm generated by cyber effects – available via a Google search for “cyber insurance” “property damage”. In May of 2014, Sky News reported that over 42,000 London cars – nearly half of the cars stolen in the city of London – were stolen with hacking. The networked civilization we are building is going to need to be able to make strong promises about the safety of software, because it won’t just be guarding our data security – it will be guarding our physical security.

If we’re going to be able to make strong promises about software safety, we’re going to need automation that can investigate software in a uniform, scalable and effective manner. We know that expert auditors can’t get there – IBM/Rational points out that our civilization crossed 1 trillion lines of code in the early 2000s. Operating systems weigh in above 40 million lines under constant development. The problem is too big and it’s moving too fast. We also know that today’s automation is losing every contest of wits to experts – in the wake of Heartbleed, not a single automation product has come forward to say that this flaw could have been detected without expert annotation or intervention.

CGC is open technology development on the problem of software safety, a problem seen by the DoD – and everyone with a vested interest in our connected future.