The Oblique Line: When Risk Doesn’t Belong to Anyone

Near my house, on the dusty floor of the Mojave Desert, there’s a sun-bleached wooden post leaning just slightly under a creosote bush. It’s easy to miss. But if you know what you’re looking for, you’ll realize it marks something far more complicated than it looks: the supposed border between California and Nevada. It was never quite right to begin with. The man who put it there believed it would stand the test of time. It didn’t.

Cybersecurity is full of lines like that.

We love the idea of clear boundaries. Segment the network. Assign the roles. Draw the map. But much like that post in the desert, the boundaries we rely on are often not where we think they are. And even when they are technically correct, no one’s quite sure who owns what’s on either side. That usually doesn’t become a problem until someone starts poking around, digging a trench, laying fiber, or launching a scan. Then, just like in the desert, someone has to show up and explain where the line really is and who’s responsible for the mess.

A Line in the Wrong Sand

Back in 1873, a surveyor named Alexey Von Schmidt was hired to mark the boundary between California and Nevada. The northern part of the line was already set: the 120th meridian, running straight down from the Oregon border to Lake Tahoe. South of Tahoe, though, the law called for an angled boundary, an oblique line, stretching to the Colorado River at the 35th parallel.

And that’s where things went sideways. Literally.

Instead of using astronomical observations to hold a true bearing, Von Schmidt relied on a compass and a surveyor’s chain. His team crawled across the mountains and desert, 66 feet at a time. An early misstep near Verdi meant the entire line started off just a little wrong. But they kept going. Stone cairns. Iron posts. Wooden stakes. All of it anchored to an invisible line that slowly drifted away from where the law said it should be.

When they reached the Colorado River, the river itself had moved. So had the intended intersection with the 35th parallel. Von Schmidt tried to work backwards to fix it, retracing his path and resetting markers. But by the time he reached what is now Pahrump, Nevada, where I live, he was out of time and out of money. So he put a kink in the line, called it done, and walked away.

People accepted it. The line was on the ground. It looked official enough. Towns grew up around it. Taxes were collected. Laws were enforced. And for decades, nobody thought much about whether it was actually correct.

Until it became a problem.

It started with people being taxed by the wrong state. In towns like Verdi and Crystal Bay, residents weren’t sure which state they lived in. In Aurora, they went ahead and voted in California and Nevada. And in Honey Lake Valley, the dispute turned into an actual standoff: the Roop County judge arrested the Plumas County justice of the peace, and the Plumas sheriff responded by arresting the Roop judge. Shots were fired. Blood was spilled. A truce was called before it got worse. Eventually, both sides asked their governors to settle it. Everyone agreed the border needed to be marked properly, and fast.

But that didn’t happen. Survey after survey tried to fix the mess. Lawsuits came and went. The confusion stuck around for over a century. It wasn’t until 1980 that the U.S. Supreme Court officially settled the boundary dispute between California and Nevada.

The Line No One Owns

And now we’re back in cybersecurity.

Because this kind of thing happens all the time. A cloud storage bucket is left wide open, but no one’s sure if it belongs to the dev team, the infrastructure folks, or security. A contractor spins up a SaaS platform, connects it to production data, and then leaves. Years go by. Nobody remembers it exists until there’s a breach. Or maybe there’s a legacy system, built by someone who left five years ago, still sitting quietly in a rack, quietly collecting risk.

Everyone assumes someone else is responsible. And while everyone hesitates, nothing gets fixed.

Some of it is structural. Organizations are full of handoffs and half-documented systems. People move around. Teams reorganize. Ownership gets fuzzy. The tech stack outpaces the accountability map, and over time, whole chunks of the network become borderlands.

Some of it is cultural. Security teams talk about shared responsibility, but that often turns into shared neglect. If everyone is sort of responsible, then no one feels truly accountable. And like the Von Schmidt line, these assumptions go unchallenged for years. Until something goes sideways.

So How Do You Redraw the Line?

You don’t need to put iron posts in the ground, but you do need clarity. Start by surveying your own terrain. Run ownership mapping across your systems, not just who owns the code, but who’s responsible for the data, the security posture, and the lifecycle of the system.

Then put up markers. Use tagging, labeling, and automation to track what’s running, who owns it, and when it last changed. Create alerting for orphaned systems. Give your internal surveyors the tools they need to spot where the lines don’t match.

Build clear jurisdiction. Publish ownership matrices. Don’t let risk live in the shadows because no one wanted to argue over a spreadsheet.

And when teams offboard tools or people leave, treat it like a boundary handoff. Document it. Walk the line. Make sure someone’s name is actually on the deed.

Reclaiming the Desert

Eventually, the California–Nevada border was fixed. It took time. It took gunshots. It took court cases. It took people willing to admit that what was on the map didn’t match what was in the dirt.

We can do the same with cybersecurity. It just means having the courage to walk those old lines, question inherited assumptions, and redraw the map when the markers don’t line up. The risk is out there either way. But it doesn’t have to live in a no man’s land forever.