Even cybersecurity experts make simple mistakes. Here’s the real lesson

Turns out that helming the forefront of cybersecurity is not a shield from basic mistakes. Such was the lesson buried in a talk at RSAC 2026, where a pioneer in cryptography recapped a notable slip-up last year: A whole election failing because someone lost their part of an encryption key.

(Yep.)

While discussing the field of cryptography during a panel talk, Whitfield Diffie referenced the International Association of Cryptography Research’s ill-fated leadership election, which took place last November. In an effort to thwart collusion and election tampering, the election required three trustees to hold part of the cryptographic key needed to decrypt the results. Unfortunately, one member lost their piece, leaving the election results forever locked by encryption.

So what are the lessons here for us normies? I think there are a couple. First, everyone gets tripped up by basic human error—and you just have to accept that such errors reveal our weaknesses. Diffie alluded to this idea himself, saying that key management is “on one hand, it’s the subject of a lot of work, but on another, it’s sort of often missed.” In this case, the IACR got through by holding a do-over election the following month, and also made revisions to their election system to avoid such a problem in the future.

Second, if you make a dumb mistake, don’t hide it. Sharing your story can help others. Last year, well-known security guru Troy Hunt fell for a phishing scheme, leading to a leak of info about his mailing list subscribers. He decided to lay the situation in detail for his blog subscribers—an act that helped remind everyone that threat avoidance isn’t always about smarts. Sometimes, you have to guard against your own human vulnerabilities. (In this case, fatigue was at fault.)

How do you create those defenses? Figure out the info you’ll need if your normal process fails—you forget your login info for your password manager, lose your device for two-factor authentication, or realize your encrypted hard drive is failing. (The to-do items for these scenarios? Set up recovery keys; create backup 2FA methods; and save your BitLocker key.)

Think of it as digital disaster preparation, similar to being ready for an environmental catastrophe at home.