nothing we do matters (so it can't hurt to try!)

nothing we do matters (so it can't hurt to try!)

Speakers: elle armageddon, Security Leader

Conference: Kawaiicon

YouTube: https://www.youtube.com/watch?v=NnCq2NYtS9A

Overview

In her compelling Kawaiicon talk, "nothing we do matters (so it can't hurt to try!)," security leader elle armageddon delivers a powerful call to action, urging security professionals to translate their unique skills and problem-solving mindsets from the workplace into meaningful community activism. Far from a conventional technical deep dive, this presentation inverts the common conference trope of applying life skills to security, instead demonstrating how the competencies honed in security roles—such as triage, prioritization, system design, and risk management—are profoundly applicable to addressing complex societal challenges.

The talk is a deeply personal and vulnerable exploration of overwhelm in the face of escalating global and local crises, particularly within the United States. armageddon candidly shares her struggles with finding hope amidst the terrorization of immigrant communities by ICE, government shutdowns impacting food assistance, and the pervasive feeling of powerlessness. However, she masterfully pivots from despair to empowerment, showcasing how community resilience and mutual aid efforts provide tangible proof that collective action can make a difference, even in seemingly impossible situations.

Ultimately, armageddon's message is one of defiant hope and practical engagement. She argues that the security industry's inherent ability to tackle "no-win situations" and innovate under pressure makes its practitioners uniquely equipped to contribute to "healing the world," a concept she frames through the Jewish idea of Tikun Olam. This article will delve into how she unpacks these ideas, offering concrete parallels between effective security practices and impactful activism, and what this means for both individual action and systemic change.

Background

▶ Watch: Translating security skills for community impact (1:05)

The genesis of "nothing we do matters (so it can't hurt to try!)" is rooted in elle armageddon's dual experience as both a seasoned security professional and a long-time activist. Before her entry into the security field, she taught operational security (OpSec) to activists for many years, a background that clearly informs her perspective on applying structured thinking to real-world threats beyond enterprise networks. Her personal identity as an anarchist deeply committed to community, alongside her roles as a wilderness first responder and participant in harm reduction collectives, underscores a life dedicated to practical, direct action.

The talk was delivered against a backdrop of significant social and political upheaval in the United States, which armageddon describes as "descending into straightup fascism." She illustrates this with vivid, personal examples: the inability of a friend, Snare, to attend the conference due to fear of not being able to re-enter the US; frequent ICE (Immigration and Customs Enforcement) activities in her neighborhood, including the abduction of documented and undocumented individuals and asylum seekers; and a government shutdown that led to millions losing access to food assistance benefits as of November 1st. These events created a profound sense of overwhelm and demoralization, making it difficult for her to write a hopeful talk.

Despite this bleak context, armageddon found inspiration in the immediate, grassroots responses to these crises. She witnessed activists leveraging pre-existing communication networks to track ICE movements, coordinate community defense efforts, and even physically block access to ICE staging facilities. Concurrently, restaurants—many owned by the very immigrant communities under attack—began offering free meals to those impacted by the food assistance cuts. These acts of mutual aid and community resistance demonstrated to armageddon that even when systemic problems seem insurmountable, individual and collective efforts can create life-changing differences and prevent people from feeling alone. This provided the crucial evidence that "even when shit is this fucked up and fucked up, there are people out there who are willing to do whatever they are able to try to make things right for each other." This resilience became the core "proof of concept" for her argument: that the skills security professionals employ daily are not just for corporate defense, but are vital tools for societal improvement.

Key Findings

▶ Watch: Community resistance against ICE in the Bay Area (8:40)

elle armageddon's talk doesn't present technical vulnerabilities or exploits, but rather a series of profound "findings" related to human agency, collective action, and the transferable nature of the security mindset. These core contributions can be summarized as:

1. Security Skills are Transferable Life Skills: The central thesis is that the analytical, problem-solving, and systemic thinking skills developed in security are directly applicable to broader societal issues. Just as security professionals triage and prioritize overwhelming problems at work, they can apply this to community challenges, starting with "low-hanging fruit" like ensuring neighbors have food. This builds capacity and empathy, freeing up resources for larger issues.

1. The Evolution of Effective Security is a Blueprint for Activism: armageddon highlights a significant shift within the security industry: moving away from blaming individuals (e.g., for clicking phishing links) and forcing compliance, towards building phishing-resistant login mechanisms and systems resilient to human error. This involves understanding user needs, reducing friction for secure paths, and fostering collaboration (security is "our job," not "everyone's job"). She argues this collaborative, enabling approach is far more effective than mandates, both in enterprise security and in community organizing.

1. "Breach is Inevitable" as a Catalyst for Innovation: While often a declaration of powerlessness, armageddon reinterprets the phrase "breach is inevitable" as permission to experiment and innovate. If existing approaches are guaranteed to fail, there's no harm in trying something new. This encourages a scientific approach to activism, using current "best practices" as controls, defining success and failure modes, and having backup plans. This mindset, she argues, is crucial for escaping "no-win situations" and creating novel solutions.

1. The Power of Shared Failure and Vulnerability: Drawing a parallel to Root Cause Analysis (RCA) in security incidents, armageddon stresses the importance of openly discussing failures and lessons learned in both security and activism. Sharing "smaller failures"—experiments that didn't make it to production, or activist efforts that fell short—builds trust, fosters powerful bonds, and allows others to make "new and novel mistakes" rather than repeating old ones. This vulnerability is key to collaborative growth.

1. Beyond Defense: Envisioning and Building a Better World: Effective security isn't just about defending against threats; it's about understanding what we're trying to build. A threat model is incomplete without understanding the desired state. Similarly, activism must move beyond merely identifying problems ("all your shit is broken, lol") to envisioning "what best could look like in a perfect world" and demanding full remediation, not just mitigation. This involves suspending disbelief and dreaming big, recognizing that "the realm of possibility is shaped by the improvements that we make."

1. The Enduring Principle of Tikun Olam: The talk culminates in the profound Jewish concept of Tikun Olam, the work of healing the world, which armageddon describes as the functional meaning of life. She shares a poignant anecdote about her cousin planting fruit trees he would never see bear fruit, illustrating that contributions to a better future are gifts to future generations, a legacy that transcends individual lifespans. Coupled with Rabbi Tarfon's ancient wisdom—"we are not obligated to complete the work but neither are we free to abandon it"—this provides a powerful framework for sustained, hopeful action, even when complete success seems impossible or distant. This perspective decouples effort from immediate outcome, making continuous striving a virtue in itself.

Technical Deep Dive

▶ Watch: Security's shift: you can't make people do things (15:00)

While elle armageddon's talk is not a traditional technical deep dive into specific exploits, vulnerabilities, or security architectures, it performs a crucial "deep dive" into the mindset and methodologies prevalent in the security industry, demonstrating their profound applicability to broader societal challenges. The technical content here lies in the direct analogy and transferability of security principles.

Triage and Prioritization in Societal Contexts:

Security professionals are masters of triage—the art of assessing and prioritizing an overwhelming influx of alerts, incidents, and vulnerabilities. armageddon highlights this skill as fundamental. In a Security Operations Center (SOC) or on-call role, analysts must quickly identify "low-hanging fruit" to clear cognitive load and free up capacity for more complex problems. She directly maps this to community work: "It's all right if you don't have an answer to ending world hunger. You can start by making sure your neighbors aren't hungry tonight." This isn't just about charity; it's about applying a systematic approach to problem-solving, breaking down seemingly intractable issues into manageable, actionable steps. The goal is to create "safe spaces" for individuals, much like a well-tuned alert system allows a SOC analyst to "sleep through the night without getting paged."

Shifting from Enforcement to Enablement:

A significant technical shift in modern security is the move from a "gatekeeper" mentality to an "enabler" one. Instead of demanding that software engineers memorize the OWASP Top 10 and then blaming them for vulnerabilities, the industry is increasingly building tooling to help them avoid common errors. This includes implementing phishing-resistant login mechanisms instead of relying solely on repetitive, often resented, phishing training. This involves understanding user workflows and designing security controls that make the "secure path the easiest path," rather than creating friction that users will inevitably circumvent, thereby creating new attack surface. armageddon argues this principle is directly applicable to activism: "You can't make people do things." Instead, effective community building involves "asking questions to understand what the people around us are trying to accomplish, what they need, and then working with them to figure out how we can help meet those needs." This systemic approach to security, focusing on resilience and enablement over blame, becomes a powerful model for fostering positive social change.

Scientific Experimentation and Learning from Failure:

The talk advocates for a scientific approach to solving problems, a core tenet of security research and development. When faced with an "unwinnable situation" or inevitable "breach," security teams often experiment with novel approaches. armageddon encourages this: "If we know our existing approaches inevitably lead to breach, why not try something else? Why not start to innovate?" She outlines a structured approach to experimentation:

• Use existing best practices as a control.
• Think about the implications of changes.
• Have an idea of desired new outcomes.
• Plan for knowing whether an experiment is successful.
• Understand likely failure modes and how to detect them.
• Have a backup plan.

Crucially, she emphasizes the need to "talk to the community around you first," akin to researching prior attempts or existing solutions in a technical context to avoid reinventing the wheel or repeating known failures.

Root Cause Analysis (RCA) and Sharing Lessons Learned:

In the security industry, a Root Cause Analysis (RCA) is a standard post-incident procedure, designed to understand why a security incident occurred and what mitigation steps can prevent recurrence. armageddon laments that this practice is often limited to major incidents and suggests extending it to "smaller failures." She calls for conference talks about "experiments that never made it into production and what we would do differently today if we knew then what we know now." This open sharing of failures, she argues, builds trust and provides collective learning, allowing everyone to "make new and novel mistakes, the fun kind of mistakes," rather than repeating the same errors. This technical practice of collaborative learning from failure is presented as a vital component for growth in both security and activism.

Building Beyond Defense: The Threat Model of Utopia:

A robust threat model in security identifies what assets need protection, what adversaries exist, and what attack vectors are likely. However, armageddon argues that a threat model is incomplete without understanding "what we're trying to build." Security controls designed without understanding the desired functionality of a system are likely to "roadblock" users. This translates to societal design: "In order to build a world where everyone's needs are met, we have to take the time to learn what those needs actually are, understand how they're unmet today, and envision what things around us might look different if we rebuilt society to meet those needs." This means moving beyond merely identifying problems (a "pentest report that just says all your shit is broken, lol") to proposing concrete, aspirational remediations and envisioning a "utopia"—even if it can't be built overnight. This involves demanding "full remediation" rather than settling for mere mitigation, much like we'd ideally seek to fix a critical vulnerability completely, not just reduce its severity from critical to high. The application of compensating controls is acknowledged as a pragmatic step when full remediation is impossible (e.g., for SSO), but the aspiration for the ideal remains paramount.

In essence, the "technical deep dive" of this talk is a profound exploration of how the cognitive toolkit of a security professional—analytical rigor, systemic thinking, risk assessment, iterative improvement, and a proactive, building-oriented mindset—is a powerful, underutilized asset for societal problem-solving and community empowerment.

Demo / Proof of Concept

▶ Watch: "Breach is inevitable" as permission to experiment (19:30)

While "nothing we do matters (so it can't hurt to try!)" does not feature a traditional technical demo or a live proof of concept in the sense of software or system exploitation, elle armageddon masterfully presents real-world events as compelling "proofs of concept" for her core arguments.

Her primary demonstration of effective community action and resilience comes from the recent experiences in her own neighborhood. She vividly describes:

• Response to ICE Activity: When a "huge influx of ICE officers was dispatched to my community," and ICE converged at a Coast Guard facility, activists leveraged "pre-existing communication networks" to alert at-risk individuals and coordinate a direct response. Community members "shut down the only road onto or off of the Coast Guard base where ICE was staging," parking and abandoning vehicles and "even using their bodies to block the road." This collective, organized action served as a direct demonstration of how a community can mobilize to protect its vulnerable members, mirroring a defensive security operation to block an attack.
• Mutual Aid in Response to Government Shutdown: Concurrently, as millions lost food assistance benefits due to a government shutdown, armageddon highlighted how local restaurants—many owned by immigrant communities themselves—began "offering cooked meals and other food" to those in need. This act of mutual aid, arising from an industry with "incredibly narrow profit margins," served as a powerful example of community members identifying a critical need and filling it through direct action, even when government systems failed.

These examples, rather than being theoretical, are concrete, recent instances of people applying ingenuity, collective effort, and a deep understanding of community needs to solve immediate, pressing problems. They serve as her "demo" for the efficacy of translating problem-solving skills into tangible, impactful activism, proving that "people are doing what they're able to solve each other's problems" and fostering "community resistance and resilience." She uses these real-life scenarios to illustrate that the principles she advocates are not just abstract ideals but have been successfully implemented, making "life-changing differences for people who are under attack."

Defensive Implications

▶ Watch: "Not obligated to complete, nor free to abandon" (30:00)

The defensive implications of elle armageddon's talk extend far beyond traditional enterprise security, urging a proactive and systemic defense of communities and societal well-being. For security professionals, the core implication is a call to broaden their scope of defense.

Leveraging Security Skills for Societal Defense:

Security practitioners are inherently skilled in threat modeling, identifying vulnerabilities, and designing controls. The talk implores them to apply these skills to societal threats like bigotry, systemic bias, and oppressive government actions. For example, confronting a sexist joke or racist comment is a "defensive control" against the erosion of inclusive cultural norms, similar to patching a vulnerability before it can be exploited. Recognizing that "remaining neutral upholds the status quo" means that inaction is itself a choice with defensive consequences.

Building Resilient Communities as a Primary Defense:

Just as resilient systems are built to withstand attacks, resilient communities are the ultimate defense against overwhelming external pressures. armageddon's examples of ICE resistance and mutual aid networks demonstrate that pre-existing communication channels and a culture of looking out for one another are crucial compensating controls when formal systems fail or become adversarial. Community building itself is framed as activism because "when we work together, we are capable of things that are bigger and more beautiful than anything we could ever build alone." This is a defense strategy against isolation and powerlessness.

Proactive System Design for Inclusivity:

The shift in security from blaming individuals to designing systems that are resistant to human error (e.g., phishing-resistant login mechanisms) has direct defensive implications for fostering inclusive environments. Instead of passively hoping for diversity, defenders should ask, "Why aren't there more women here?" and actively "educate yourselves on what sexism actually looks like in the workplace so that you can be an effective advocate." This means designing social systems and cultural norms that proactively make it "easier and safer" for diverse individuals to participate, much like designing a secure system that makes the safe path the default. This proactive design minimizes friction for participation and defends against the insidious "attack surface" created by systemic bias.

Defending Against Demoralization and Disinformation:

A significant defensive implication is recognizing and countering the psychological warfare deployed by those who benefit from the status quo. armageddon explicitly states that those who want to maintain power will "try to convince you that a better world isn't possible." The defense against this is not just hope, but sustained, pragmatic action, even when hope is scarce. The Tikun Olam framework, coupled with Rabbi Tarfon's saying, provides a mental defense mechanism against burnout and the feeling of futility. It empowers individuals to keep "solving the pieces of it that we're able to today," recognizing that continuous effort, not necessarily complete victory, is the core obligation. This mental resilience is a critical defensive posture against apathy and demoralization, which are often the most effective weapons against collective action.

In essence, the talk redefines "defense" to encompass the active cultivation of human connection, mutual support, and systemic change, arguing that these are not merely social niceties but essential strategies for protecting individuals and societies from harm.

Key Takeaways

• Translate Security Skills to Community Action: Your expertise in triage, prioritization, risk management, and system design is invaluable for solving problems in your local community and contributing to broader social change.
• Start Small, Build Empathy: Don't be overwhelmed by large problems; tackle "low-hanging fruit" first. Helping with immediate, solvable issues builds capacity, trust, and empathy, freeing up mental and material resources for bigger challenges.
• Enable, Don't Enforce: Just as modern security shifts from forcing compliance to making the secure path easy, effective activism involves understanding people's needs, asking questions, and collaborating to meet those needs, rather than dictating solutions.
• Embrace Experimentation and Learn from Failure: View "breach is inevitable" as permission to innovate. Apply scientific rigor to social experiments, and critically, share your failures and lessons learned (like RCAs) to build trust and accelerate collective learning.
• Envision and Demand a Better World: Move beyond merely identifying problems to actively envisioning "what best could look like." Demand full remediation for societal ills, not just mitigation, and advocate for those who are not yet "in the room."
• Community Building is Powerful Activism (Tikun Olam): Collective action, mutual aid, and fostering strong community bonds are potent forms of resistance and defense against systemic harms. The ongoing work of "healing the world" (Tikun Olam) is a shared, defiant, and joyful endeavor that transcends individual lifespan and ensures a lasting legacy.

About the Speaker(s)

elle armageddon is a Security Leader whose professional background is deeply intertwined with her extensive experience in activism and community support. Before her career in the security industry, she dedicated many years to teaching operational security (OpSec) to activists, demonstrating a long-standing commitment to empowering vulnerable communities with practical skills. Beyond her professional life, armageddon is a multifaceted individual with non-computer hobbies, including being a longtime wilderness first responder who has provided emergency medical support at protests. She enjoys cooking, painting, and creatively insulting referees at sporting events. She identifies as an anarchist and is actively involved in a mutual aid-based harm reduction collective, reflecting her profound care for the communities she inhabits. Despite admitting to being "terrified of public speaking," elle armageddon embodies a strong belief in "doing hard things," particularly when encouraging others to do the same, and is a vocal advocate for unionization. Her talk reflects her unique ability to bridge the analytical rigor of security with the compassionate, action-oriented principles of community organizing.