Social and Technical Sources of Risk in Sustaining Digital Infrastructure

Abstract

Significant risks to our shared digital infrastructure---communication systems, servers, and applications---can be identified by examining the social and technical conditions of the communities which produce that infrastructure. Exploration of these production communities reveals the deeply contingent processes of collective action that sustain them---processes that are innovative and powerful but sometimes fragile. As this shared body of digital infrastructure has grown, some crucial pieces have become neglected, leading to <i>underproduction</i>: the phenomenon of highly important, low-quality software packages. Underproduction is a form of what I will call a <i>social production failure</i>, and a substantial source of risk to digital infrastructure that today is used by billions of people. This dissertation is framed around a series of methodological and empirical projects. The first proposes a method for measuring underproduction risk in cross-section and demonstrates the application of that method to the Debian GNU/Linux community. Next, I examine the social and technical conditions of the Debian community and test hypotheses about how these conditions are associated with underproduction. I then develop a method to measure underproduction longitudinally, and apply this method to projects in Debian written using the Python programming language. I close by synthesizing these results with respect to my proposed theory of social production failures, and offer propositions and proposals for future work.