Mental Denial of Service: Narrative Malware and the Future of Resilience
In the early 1990s, while working at Sea Change Corporation and discovering the emerging internet, I witnessed an event that permanently shifted my understanding of cybersecurity. It wasn’t a software exploit or a zero-day vulnerability — it was an email. A simple message warning of a supposed virus — “Good Times” — that would wipe your hard drive. It wasn’t real, at least not in the traditional sense. But that didn’t matter. What mattered was that everyone believed it. They read it, feared it and forwarded it. It propagated itself by triggering human behavior, not machine logic. And in doing so, it achieved the core goal of any virus: Disruption.
This, I argued at the time, was not a hoax. It was a real virus — one executed by human cognition. I was shouted down. But I never let go of the point. Decades later, I’d discuss it with my dear friend and colleague Fred Cohen — the man who coined the term “computer virus.” Fred agreed. I was right.
This was my first exposure to what I now call Mental Denial of Service: Disinformation or manipulative content that hijacks the cognitive processing of individuals and institutions, causing them to act in ways that damage the systems they are part of. This is the story of how that idea evolved — and why it now defines the future of resilience.
From Email Hoaxes to National Infrastructure Threats
Fast forward to my time as Chief Security Officer for EPM, the Colombian grid, while working with Unisys. I insisted on seeing everything myself: Renting a car, living in Airbnbs, touring every corner of the system. It was during one of these tours that I met Freddy, a 70-year-old Colombian water plant operator perched in a concrete building high in the Andes.
Freddy had high-tech screens and sensor data flowing in, but he also had a fish tank plumbed directly into the third stage of the water treatment process. If the fish showed distress, Freddy shut off the water — regardless of what the digital systems said. He understood, innately, that trust must be grounded in something observable, human and real. Freddy became my archetype for trust-layer defense.
In the 25-year roadmap I built with Fred Cohen, we marked a 7-year checkpoint — right about now. I argued that if Colombia didn’t get serious about what we now call narrative integrity, they wouldn’t be able to keep the lights on. This wasn’t a political forecast. It was a systemic one. You don’t need to hack the grid — you just need to convince the person holding the switch that the grid is under attack.
This is what makes narrative attacks different from traditional cyberthreats. They don’t exploit code — they exploit belief. And belief drives action.
Narrative as Executable Logic
Mental DOS works because the human brain is itself a processor — an interpreter of symbolic input. When exposed to a crafted message, it can execute that message as if it were code. This is not a metaphor. If you receive a message that says, “The water is poisoned,” and you shut off the supply, the message has caused real-world change.
You are the runtime environment.
We’ve now seen this model play out at scale:
– In the 1990s, email hoaxes that choked the network.
– In 2016 elections influenced by synthetic social content.
– In 2021, Capitol rioters acting on false inputs.
– In 2025, operators pausing infrastructure services due to fake alerts.
The consequence is always the same: Belief triggers a cascade of action that exceeds the scale of the original message. Like a Denial of Service attack, it’s not the code that causes the failure — it’s the overwhelming response.
Conclusion: From Fish Tanks to Firewalls of the Mind
Whether it’s Freddy’s fish tank or a neural network parsing propaganda, the principle is the same: Trust must be rooted in validation, context and human judgment. We can’t outsource that completely. And we can’t afford to ignore it.
We are living in the age of Mental DOS. It’s time we built defenses that recognize the human stack — not just the digital one. The future of resilience depends on it.
