The properties of a complex system are not confined to the properties of the individual components in isolation. The relationships between the components give rise to new properties which can be called emergent.Emergence is a commonly recognized feature of complex systems, and it basically says that the properties of a complex system are not limited to its constituent parts; rather, new properties—new structures and behaviors—can emerge from the dynamic functions within the complex system and between the complex system and its ecosystem. The boundaries of a complex system must be elastic enough to include any newly emerging properties. Perhaps a better way to say this is that our definitions of the boundary of any complex system should be pliable enough to recognize that the shape of the complex system has changed. As the complex system rearranges its structure and develops new properties through its own internal activities and its external exchanges with its environment, then we must anticipate the emergence of new boundaries.
I'm old enough to have witnessed the many changes to the boundaries of my bank account. I am not old enough to have known when a bank account consisted of metal coins stored in a vault and data security consisted of a big lock and an armed guard. However, I think that most people still have this physical, mechanical view of their money and how to secure it. I fear that too many data security people also have this view.
Consider, for instance, my bank account: I'm in Florida, the bank's corporate offices are in Virginia, the online banking applications I use may be on servers in a third location or in distributed locations, the billing center is in Atlanta, the data could be housed in some data center operated by a third party company in a fifth location, the help center is in India, and each geographical location likely has different regulatory controls and business practices, certainly different data security practices. So just where the hell is my money, and how do I define the boundaries around this amorphous monster? Is it not obvious that assigning boundaries to my money is no longer like assigning boundaries to a stack of coins? And is it not obvious that my bank account has emergent properties and interactions that I'm probably not aware of, that perhaps no single person is aware of all the emergent properties of even this one, small account? Finally, consider the financial accounts of a Warren Buffett or an Apple, Inc., and I defy anyone to draw neat boundaries, or even ragged ones, around those puppies.
Cilliers and Nicolescu make another important point about boundaries as emergent properties of complex systems:
It is common to argue that the system is more than the sum of its parts. This is true to the extent that emergence is not simply a result of the characteristics of the components. However, in some sense the system is also less than the sum of its parts. The emergent properties of the system constrain the behavior of the system to the extent that not all the possible characteristics of the components of the system can be realized in the dynamic interaction which constitutes the system. (715)Boundaries, then, have a complex role to play in complex systems. They not only set the limits of the internal interactions within the system, but they also form the zone of engagement between the system and its ecosystem. As Cilliers and Nicolescu say it, "Boundaries operate with the purpose to demarcate, but also, and essentially, to connect" (716).
In complex systems, boundaries are always problematic, and as near as I can tell, that makes data security problematic. Boundaries always demarcate, but they also, and essentially, connect. No complex system can have a boundary that does not connect as well as separate. Ahh, there's the rub.