# Social Secrecy Discipline Does Not Predict Technical Security Discipline ## Claim A group's discipline about keeping conversations off the record predicts nothing about whether it also disciplines its technical information security. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds when a group's threat model is framed socially (who's in the room, what gets attributed) rather than digitally (who can reach the server). - Breaks for organizations that staff dedicated security engineering — social and technical discipline can coexist, they just don't imply each other. - The two disciplines fail independently: a leak can happen from a source with airtight social norms and zero technical hardening, or the reverse. ## Evidence Dialog enforced strict in-room rules — assigned seating, no-attribution norms, moderator guides coaching hosts to stay "off the record" — for two decades. None of that discipline touched its own website: a member directory sat readable in plain page source, discoverable by anyone who viewed source on a near-empty page. The exposed data included political-leaning answers the organization had explicitly promised never to share, alongside private access tokens functioning as login credentials — the most sensitive fields were exactly the ones a basic security review would have caught. ## Links - [[Commons & Community Governance MOC]] — two kinds of discipline a group is routinely assumed to have together - [[3. Resources/Permanent Notes/Off-the-Record Convening on Personal Email Evades Public-Records Law]] — because contrasts: that note is the mechanism that made Dialog's secrecy effective against public-records law; this note is the mechanism that made it ineffective against a technical leak. - [[3. Resources/Permanent Notes/A Safety Control That Cannot See Severity Becomes a Hazard]] — because extends: a security posture calibrated to a social threat model can't see a technical threat coming, which is a specific instance of a control blind to the severity it should be scored on. ## Tests / falsifiers - Survey a sample of confidentiality-norm organizations (professional societies, private clubs, invitation-only retreats) and score them independently on social-discipline strength and technical-security posture — a near-zero correlation would confirm the claim. - If a future audit finds Dialog's post-leak response focused entirely on tightening in-room norms rather than commissioning a security review, that would itself be evidence the two disciplines remain unlinked in the group's own thinking. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society|Leak Exposes Members of Peter Thiel's Secretive 'Dialog' Society]] — the directory-in-page-source exposure mechanism and the exposed political-leaning/access-token data.