In September, I published Governance Theater: Why the gTLD Expansion Program Is a Lose-Lose Proposition on CircleID. As of this writing, the article has attracted over 32,000 views in less than two months, making it my most-viewed CircleID article to date in a remarkably short period.

Apparently, the critique of ICANN’s toll booth attracted an audience without paying the toll. ;)

But the larger question remains: what happens when institutions collect the benefits of authority without accepting the corresponding responsibility?

That question extends far beyond internet governance. And nowhere is the accountability gap more consequential than in cybersecurity.

On the night of October 11, 2026, CircleID reported that attackers remotely triggered defrost cycles on refrigeration controllers at French supermarkets. Temperatures climbed. Food spoiled. The Paris prosecutor’s office opened a criminal investigation. Between 250 and 350 stores were affected across chains including Intermarché, Carrefour Market, Monoprix, and Leclerc.

The attack targeted Danfoss refrigeration controllers. CISA had issued advisories on two vulnerabilities in these systems in 2025—CVE-2025-41450 and CVE-2025-41451—months before the incident. Whether those specific vulnerabilities were the confirmed attack vector remains under investigation; what is documented is that following the attack, security researchers scanning internet-exposed systems found 2,752 Danfoss controllers directly reachable on the public internet, 1,590 of them in France. Researchers had separately warned of the exposure risk beforehand.

No advanced exploit confirmed. No superintelligent AI. Just known vulnerabilities, unpatched systems, and an open door nobody closed.

That is the cyber pandemic. Not the science fiction version. The real one, already unfolding in grocery stores, power grids and crypto exchanges while everyone debates hypothetical superintelligence.

Here is what that debate is missing. There is no public evidence that AI was the decisive factor in any of the incidents discussed here. The decisive factor was negligence. And negligence scales just fine without any AI at all.

The Evidence

Take Volt Typhoon. This is a Chinese state-sponsored campaign, documented in joint advisories by CISA, the NSA, the FBI, and Five Eyes partners. US agencies assess that its objective is not espionage but pre-positioning: being inside critical systems before a geopolitical crisis so they can be degraded or disabled when it matters. At Littleton Electric Light and Water Departments in Massachusetts, they were inside for approximately 300 days before anyone noticed, according to CISA and Dragos reporting. The initial access came through a vulnerable network device.

Three hundred days. Inside a utility that serves a small Massachusetts community. The attackers were not racing against a detection system. They were waiting, patiently, inside infrastructure that had not been secured well enough to notice them.

Take Bybit. In February 2025, North Korea’s TraderTraitor unit, part of the broader Lazarus Group, compromised a developer’s machine at Safe{Wallet}, a third-party signing platform used by Bybit. Through that one access point, they manipulated the signing interface and drained approximately $1.5 billion in Ethereum. The FBI attributed the theft publicly.

The operation was patient and well-resourced. But it began with one compromised machine at a vendor. The sophistication came after the door was opened.

Two different actors. Two different sectors. The same accountability gap: nobody owned the attack surface clearly enough to close it.

The Accountability Gap

When nobody clearly owns the problem across the supply chain, nobody solves it. The World Economic Forum’s Global Cybersecurity Outlook 2025 identifies the conditions that create this vulnerability: overlapping responsibilities, limited visibility into supplier security, and industries with weaker oversight becoming conduits for attacks on stronger ones.

In the governance world, we call it “ambiguous accountability.” It is not a theoretical risk. It is a documented operating condition.

When responsibility is spread across vendors, regulators, operators, and boards, it belongs to no one in practice. The gap stays open. Researchers had warned of the exposure risk in Danfoss systems before the attack. After it happened, the scan confirmed just how wide that exposure was. The warnings did not close the door.

This is not a technology failure. Technology can patch a device, harden a configuration, close a port. What technology cannot do is decide who is responsible for doing it. That is a governance problem. And governance problems do not get solved by better tools. They get solved by someone claiming ownership.

But this problem is not confined to cybersecurity. Institutional ambiguity can become a way of avoiding difficult decisions and obscuring responsibility. I encountered that dynamic firsthand in internet governance.

In the DCA Trust Independent Review Process against ICANN, which examined ICANN’s handling of our .africa application and its reliance on advice from the Governmental Advisory Committee (GAC), former GAC Chair Heather Dryden testified about a practice she called “creative ambiguity.” Her words, in the IRP record:

“In our business, we talk about creative ambiguity. We leave things unclear so we don’t have conflict.”

This was a massive admission. A former institutional leader was describing ambiguity not as an accidental failure of communication, but as a deliberate practice for avoiding conflict. The consequence is equally significant: when institutions leave their reasoning unclear, accountability becomes harder to establish.

The GAC provided no rationale for opposing our application. The IRP Panel found that the Board’s failure to inquire, combined with that lack of transparency, meant ICANN had violated its own Bylaws.

A decision that derailed years of work. Made without a stated reason. Protected by a working method designed to avoid accountability.

Different institutions. Different consequences. The same accountability gap.

Whether the failure concerns a contested governance decision or an exposed piece of critical infrastructure, ambiguity serves the same dangerous function: it allows responsibility to diffuse until nobody is clearly answerable.

And the gaps stay open.

What Comes Next

The cascade can begin with one exposed controller. One vendor machine nobody hardened. Two CVEs documented in CISA advisories for over a year, while thousands of devices remained exposed on the public internet.

That cascade is not theoretical. It happened in October 2026 in French grocery stores. It happened in February 2025 on a crypto exchange. It has been happening, in slow motion, inside American utilities for years, with adversaries measuring their dwell time in months rather than hours.

The same accountability gap can emerge in critical infrastructure. Leave responsibilities unclear, avoid the conflict of assigning ownership, and when something fails, accountability diffuses across enough parties that no one is left holding it.

That arrangement is not sustainable at the scale the threats have reached. A ransomware group does not need a zero-day to take a hospital offline. A state actor does not need to outmaneuver a sophisticated defense team when the vulnerable device has been sitting on the public internet since 2025.

The asymmetry is not technical. It is organizational. The attackers know exactly what they are doing and who is responsible for it. The defenders often do not.

The question is not whether this is coming. It is who owns the responsibility to prevent it, and whether they will claim it before it does.

The framework changes. The clearinghouse gets a new name. The gatekeepers remain. The accountability gap follows them.

The Global Forum on Cyber Expertise is a case in point. The EU Institute for Security Studies has documented that the GFCE, a The Hague-based body tasked with coordinating cyber capacity building globally, has “yet to fulfil its potential,” perceived as a Western initiative, limited in funding, and failing to deliver coordination at the country level where it is actually needed. The same institutional habits that allow accountability to diffuse in cybersecurity show up in the bodies meant to fix it.

The next failure may be somewhere that cannot afford to go offline. The answer to that is not a better firewall. It is a named owner, a clear line of accountability, and the institutional willingness to enforce it before the incident, not after.