While the philosophical foundations of information security have been unexamined, there is an implicit philosophy of what protection of information is. This philosophy is based on the notion of containment, taken from analogies with things that offer physical security (e.g., buildings, safes, fences). I argue that this implicit philosophy is unsatisfactory in the current age of increased connectivity, and provide an alternative foundation. I do so from a constructionist point of view, where the coevolution of social and technical mechanisms is seen as the source of the security of an information system, rather than rational design choices only. I employ the concept of causal insulation from system theory in order to give an account of the fundamental characteristics of information security research. This generates definitions that can be used for philosophically informed discussions on the protection of information in new systems.A growing proportion of computer science research is now devoted to what is called information security. In this subdiscipline the focus is on how to protect information systems from malicious users. This is quite different from research in other areas of computer science such as programming paradigms or software engineering methods, primarily because security is concerned with what systems should not do rather than what they should do. The philosophical basis of this research, however, has not received much attention until now. Although security-related societal implications of information systems, especially in the area of privacy (see, e.g., Nissenbaum 1998; Floridi 2005; Gutwirth and De Hert 2008), have been discussed extensively, the philosophical foundations of the scientific endeavour have been left largely unexamined. This oversight is not only problematic philosophically; it also makes it impossible to connect high-level privacy discussions with the possibilities the technology now offers.When computer scientists speak of privacy, they mean a special kind of information security, namely, confidentiality of personal information. But the repertoire of information security is much broader, as it covers integrity and availability of information next to confidentiality, and business, military, and government information next to personal information. For the computer scientist it does not matter what kind of information needs to be secured. However, for the policymaker, it does. Therefore, the technical solutions never speak of privacy as it is used at policy level, and policymakers never speak of information security as it is used in the technical domain.While the philosophical foundations of information security have been unexamined, there is an implicit philosophy 1 of protection of information based on the notion of containment, taken from analogies with things that offer physical security (e.g., buildings, safes, fences). Correspondingly, in such a philosophy, the asset to be protected needs to be separated from the environment by security boundaries such as a firewall. This fort...