I have recently learned that a certain respectable university will soon require two-factor authentication (2FA) simply to access basic student administration systems. At first glance, this might seem like a perfectly reasonable security measure. After all, who could possibly object to better protection of personal data?
But the issue is not whether institutions have the right to secure their systems. Of course they do. The question is something rather different: when did securing institutional infrastructure become an obligation that individuals must fulfil using their own private resources, at their own expense, and according to rules they had no say in creating?
This is where a seemingly mundane administrative decision reveals something much broader and more troubling.
Across public institutions, universities, corporations, and government portals, mandatory two-factor authentication is becoming the new standard. Long live progress! Long live security!
Now, I am not suggesting that ordinary student or employee records are worthless, nor that they should be left unprotected. Data breaches are real, and sensible security measures are entirely justified. But one might reasonably wonder whether the implementation of these measures has become less about finding a proportionate balance between security and convenience, and more about making the individual responsible for accommodating whatever technical arrangements an institution happens to find convenient.
And this is where the real masterpiece begins.
Institutions, in their infinite concern for our safety, graciously present us with a selection of options by which we may prove to the machine that we are, in fact, ourselves. The choices are so democratic that one can hardly contain one's gratitude.
Option number one: A smartphone app.
Simple, right? After all, it is the twenty-first century! The assumption that every living soul owns a personal smartphone, maintains it, updates it, and is willing to install institutional authentication software on it seems as natural to the modern bureaucrat as snow in winter.
But what if someone does not own a smartphone? What if their work, studies, or legal obligations do not require them to carry one? What if they simply prefer not to turn their private device into an extension of somebody else's IT department?
Minor details. Surely we are not going to be formalists about such trivial matters.
Your personal smartphone is hereby commandeered as an official, complimentary branch of the institutional server room. You are expected to install, click, scan, and generate tokens whenever the institution demands it.
And don't you dare complain that the device is your private property, purchased with your own hard-earned money. Its physical ownership may remain yours, but its practical use is now partly dictated by an external administrative authority.
Be a good modern lemming. Don't ask questions.
Now, let us assume someone is a technological heretic. They do not own a smartphone because no law requires them to. Or—heaven forbid—they believe that their personal phone is their private fortress, entirely outside the jurisdiction of their university, employer, or local government.
What has modern administration prepared for them?
Option number two: Biometrics.
Wonderful! Now you can use your fingerprint or face scan to authenticate yourself. Where? On your personal computer, naturally!
Because owning a computer with the appropriate hardware and software configuration is apparently another universal characteristic of the human species.
The institution cordially invites you to reconfigure your personal operating system so that it becomes a component of its authentication infrastructure. Your computer is yours? Don't make them laugh. It is now expected to cooperate with an external security architecture.
And what if your laptop remembers the previous decade and lacks a fingerprint reader? What if its operating system does not support the latest authentication standards?
Fear not. The premium option awaits.
Option number three: A physical hardware security key.
Here we arrive at the crowning achievement of this magnificent programme.
Since the institution has devised the procedure, will it provide the necessary equipment? Will it purchase the hardware, distribute it, and take responsibility for ensuring that everyone can access the system?
Of course not!
Buy it yourself, dear citizen, employee, or student. Reach into your household budget, pull out a few dozen or perhaps a couple of hundred dollars, and invest in a little plastic gadget just so you can graciously log in and check your basic administrative records.
The institution improves its security. You pay for the privilege.
What a splendid arrangement.
And here lies the fundamental problem: the institution is outsourcing not merely the technical implementation of its security policy, but also part of its cost, maintenance, and practical burden to the very people it is supposed to serve.
This is not an argument against cybersecurity. Nor is it a demand that every institution maintain an army of clerks and publicly accessible terminals. It is an argument for proportionality and responsibility.
If an organisation decides that access to its services requires additional authentication, it should also take responsibility for providing reasonable means of satisfying that requirement. A smartphone should not become an unofficial prerequisite for studying. A privately purchased hardware key should not become an implicit admission fee for accessing one's own records.
There is a perfectly reasonable alternative: provide institutionally managed authentication devices, offer a properly secured alternative through a physical terminal, or maintain an accessible process for people who cannot or do not wish to use personal devices.
None of this is particularly revolutionary. It is simply the idea that institutions should not assume ownership of resources they have neither purchased nor provided.
But perhaps the most fascinating aspect of this entire development is how smoothly we accept it.
We download the apps, scan our fingers, purchase the gadgets, configure our operating systems, and obediently march towards an increasingly elaborate digital infrastructure. Every new requirement is presented as a technical necessity. Every inconvenience is framed as a minor sacrifice for our own protection.
And gradually, the boundaries of what institutions may reasonably demand begin to shift.
Today, you need a smartphone to access a university portal. Tomorrow, perhaps a particular operating system, a specific biometric device, or a certified piece of hardware. Each individual requirement may appear harmless in isolation. Together, they create a system in which participation in ordinary social and administrative life increasingly depends on owning, maintaining, and surrendering control over a growing collection of personal technological resources.
The irony is that digital technology was supposed to simplify our lives and reduce administrative burdens. Instead, we increasingly find ourselves performing unpaid technical maintenance for the institutions that have supposedly modernised their services.
"We are no longer merely users of institutional systems. We are becoming their peripheral infrastructure."
And perhaps this is the real question worth asking: when did convenience for the institution become an obligation for the individual?
Why should a human being be unable to walk into an office, sit down at a terminal provided by the institution, and access their records without carrying half their personal technological estate on their person?
Why is the burden of adapting to institutional technology so consistently placed on the individual, rather than the other way around?
Are there still people willing to question this creeping bureaucratic expansion? People who understand that technological progress does not automatically justify every administrative demand made in its name? Or are we becoming a society of digital lemmings, obediently wagging our personal smartphones whenever some distant system commands us to generate another token?
Then again, perhaps I am expecting too much.
I am merely waiting for the day when an obliging bureaucrat posts a guard at my front gate, just in case I ever lose my house keys. For my own protection, naturally. The guard, adjusting his stylish uniform cap, will meticulously record the exact hours of my entry and exit, perhaps even requiring biometric confirmation before allowing me back inside.
After all, we must somehow catch up with those sleek digital standards from Beijing... or at least from Oslo.
And naturally, it will all be done for our own protection.