{'fraction_non_alphanumeric': 0.013605442176870748, 'fraction_numerical': 0.0009718172983479105, 'mean_word_length': 4.9854651162790695, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
The Ethnography of a Digital Object

What happens when Eve1 finds a “bug” compromising the security of a particular software? She can sell it on the black market to criminal organizations or to vulnerability brokers who are building cyber arsenals for law enforcement agencies. But Eve can also decide to report the security bug – or the “vuln”, for vulnerability – to the company or the team who developed the software for them to fix it as soon as possible. This happens several times per day in the global field of information security (infosec) and is called vulnerability disclosure and management. These sensitive processes engage various actors negotiating multiple aspects of what is perceived as a crisis whose proportions can vary from the distress of a handful of hyper-specialized experts to a full-blown scandal involving major companies of the digital economy. Our current research project looks at these particular kinds of processes to explore a relevant part of the mundane fabric of computer security.2 We aim to analyze the negotiation of practical norms and relationships of power between a wide range of experts involved in these processes. To do so, we decided to track vulnerabilities from the moment of their public disclosure and to account for their management until a fix is provided. However, we quickly had to acknowledge that the disclosures can happen behind closed doors at first and are often a disjointed and lengthy process that takes place simultaneously in different locations and for various durations. Similarly, vulnerability management processes are often obfuscated and can also be lengthy and scattered. This assessment led us to reconsider the nature of our empirical research and in particular the types of processes we are able to follow. What follows is a reflection on the nature of our ethnography of computer security practices, taking a particular disclosure as a case in point to outline some preliminary thoughts on the conceptualization of our objects. Considering the scope of this piece, we limited our