Schneier on Security

Ive seen this in action. A friend's wife was 't-boned' in an intersection car accident (not seriously hurt, but car severely damaged). So now he was a huge fan of stoplight/intersection cameras. No amount of research proving that stoplight cameras are merely expensive tools designed to increase revenue and the only effect they have on safety is to move accidents from the intersection to the approaches to the intersection would sway him.

Or more famously Sarah Brady - her husband go shot so she became a nationwide campaigner for gun control, nevermind that the changes she sought would have had no effect on what happened to her husband.

The problem with travel choices is that the experts tend to only deal with one form of danger at a time.

For instance, in the bus analogy, you're much more likely to be in a serious accident in a car than on a bus - but you're much more likely to be pick-pocketed on a public bus than in a private car. You can securely carry much more luggage (or groceries) in a private car.

I can get there faster on a plane, with a smaller chance of catastrophic accident, but a 100% chance that a TSA agent will go through my luggage, and a greater- than- zero chance that someone will steal something while examining my luggage. That sort of search is considered illegal in a private car, and the odds of theft are much smaller.

It boils down to time vs. money vs. how one perceives their own personal safety.

Thousands of years ago, somebody may have had a similar thought, not that the author was thinking of the psychology of risks per se:

"For in much wisdom is much grief: and he that increases knowledge increases sorrow." (Ecclesiastes 1:18)

I deal with various heavy matters and find that I don't get particularly worried by them. Maybe it's a matter of personality and/or I reached a point where I see how humanity has gotten through so many disasters and that anxiety doesn't particularly help. Sense of humour helps.

Excellent article. I especially liked the phrase "learned helplessness", because it gave me an insight into another quote I've been grappling with recently. In July of 2007 (before the sub-prime mortgage implosion) Chuck Prince, the head of Citigroup, told a group of analysts, "When the music stops, in terms of liquidity, things will be complicated. But as long as the music is playing, you’ve got to get up and dance. We’re still dancing." In retrospect it is a confounding statement, until you apply "learned helplessness". Was the risk becoming so overwhelming that Prince's only recourse was to do virtually nothing, a decision that likely added billions to Citigroup's losses?

Does the same principle apply to information security risk? How many of us have seen technology heads minimize a security risk, not because the risk was insignificant, but because they had no viable solution?

I'm not sure the following is a true statement:

Slovic says "... [n]ot only do we fear more what we can't control, but we also fear more what we can imagine or what we experience."

Or maybe, not a complete statement.

Instead of fearing what we can't control, we ignore it. Then we transfer fear to the improbable.

For example, an airline stewardess I know flies professionally day by day. She does not show fear of an airplane crash. Yes, I know popular fear of airplane crashes is exaggerated. She also shows no fear of driving to and from the airport, which is significantly more dangerous than flying.

On the other hand she is terrified of getting hanta virus from rat droppings on canned foods. She advised me fearfully to be sure I carefully washed can lids with soap before opening in case a rat pooped on it. Some years ago there was a person who died of hanta virus contracted from rat droppings on a tin can. But the odds of dying in this way must be close to those of winning Lotto.

In my experience, people accept their daily risks without losing sleep, and obsess over the most improbable risks.

I believe it is a transference of fear from those risks we cannot avoid to an expression or release of those fears to imaginative if improbable risks.

On TV you can see catastrophes from all over the world. This sums up to an image of permanent danger.

And because bad news are good(selling) news, the TV people jump on every occasion to sell bad news.

Here in germany we had a storm front on friday and the forcast said it would be severe. In the evening news they switched from one field reporter to the next eagerly asking how bad it was.

But all all they got was: "not as bad as expected" and you could almost see the disappointment in the face of the studio reporter.

So you end up with a completely wrong image about your personal danger

The national manifestation of this pathology is the fact that our national budget for building levees and dams is a tiny fraction of what we spend on "preventing" terrorist attacks. We've never lost a city to a terrorist attacks. We lost one to a Hurricane in 2005. But people who froth about terrorism shrug about violent weather, despite the fact that analytically, it is perfectly clear that the latter is the more serious threat. The same could be said of earthquakes (SF 1905) and fires (Chicago 1871).

In terms of sheer body count, cars kill nearly three orders of magnitude more people than terrorists, but the terrorized still commute to work every day.

I am old enough to have worked with people who lived through World War II in London.

The interesting, even fascinating thing, was that when presented with life threatening situations on a daily basis the most common reaction was just to ignore the risks altogether.

People living with there families routinly went to air raid shelters "because they were worried about Grandad", but, people living on thier own routinely spent the night in thier own homes "because theres nothing you can do if the bomb's got your name on it".

Certainly I lived through a couple of IRA bombing campaigns without altering my beheaviour in any way whatsoever.

The reaction to a risk seems to be in inverse proportion to the actual danger.

We recently published a brief whitepaper called "The Psychology of Risk" which has some similarities to this article. It references an excellent article in Psychology Today.

The whitepaper can be downloaded here: http://geminisecurity.com/wp-content/uploads//The%20Psychology%20of%20Risk.pdf

supersnail:

Come now, I'm sure you've altered your behaviour at least a little. I mean last time I was in London, there was a Continuance campaign, and I took a different tube to the conference I was attending because the usual (much more direct) tube had been shut down.

http://www.met.police.uk/campaigns/campaign_ct_2008.htm

@ Anonymous (responding in turn to supersnail)

Your example of taking a different tube to the conference isn't a reaction to a terrorist campaign, it's a reponse to the tube line being shut down. You'd have done exactly the same if it had been shut down for electrical repairs.

The transit authority may have shut down the tube line due to a bombing campaign, but that's not you.

Be afraid about being afraid of becoming afraid!

One issue with the old trope about how much safer flying is than other forms of transport is that transport safety statistics are often insufficiently detailed, measure risk in a naive way and in fact are usually prepared by people with an interest in skewing the results.

Air transport statistics routinely ignore some classes of risk (hijacking, for example) and don't account for different ways of assessing risk between transport methods: for example, when things go wrong on flights but no one dies, this isn't boiled into the overal safety statistic; but a train derailment or car accident (where no one dies) might be.

These statistics are usually calculated in a naive way, as well. Are you "twice as safe" because your flight has double the number of people on it? You are not, but by dividing accidents by travelers this is how the calculation works.

The safest way to travel is by rail, by far (it's some "six times safer"--in the sense of killing one-sixth of the people per trip mile than air travel). But long car trips with safe drivers in safe cars are actually very safe as well (people tend to have accidents barging around town): competitive with air travel.

The funny thing about this hand-wringing over how people make bad decisions and decide not to fly is that such people are decidedly in the minority. Air travelers are treated terribly and they still fly, in huge numbers. Air travel is enormously popular. So I think that, with respect to air travel, if you take away any lesson about human risk behavior that doesn't say "human beings overwhelmingly adopt a mode of transport despite over-proportionate exposure to sensationalistic risk scenarios concerning it" you've really missed the boat. (Which are pretty safe, too).

Now, personally, I don't like flying, for all kinds of reasons. One of them is an irrational fear--yes, irrational. But it makes the experience far less pleasant. Knowing that the actual risks associated with any long trip are quite low, I do choose more often to travel by rail or by car--for one thing, I can count on being treated humanely when I do. And sometimes I grit my teeth and fly, too.

As long as you bring up the sniper? Why is that guy never referred to as a terrorist?

This is interesting in light of the research that says the reason teenagers make such poor decisions is they get too analytical.

On a personal note: so that's what that mobile-and-pillow experiments were about! My mother has told me about volunteering me as a test subject for an experiment that sounds just like that one, though in my case it would have been in the mid-1970s.

I was in group A. The way they checked to see if the babies had actually learned that the pillow controlled the mobile was to switch it off for a bit and see if there was any change in the baby's behavior. I'm told I threw a huge tantrum. I still really hate it when my mental model of a gets broken...

This is interesting in light of the research that says the reason teenagers make such poor decisions is they get too analytical.

On a personal note: so that's what that mobile-and-pillow experiments were about! My mother has told me about volunteering me as a test subject for an experiment that sounds just like that one, though in my case it would have been in the mid-1970s.

I was in group A. The way they checked to see if the babies had actually learned that the pillow controlled the mobile was to switch it off for a bit and see if there was any change in the baby's behavior. I'm told I threw a huge tantrum. I still really hate it when my mental model of a system gets broken...

This is what makes people inherently manipulable via engineered fear.

Where I grew up almost an entire republic of otherwise educated, rational people were immersed in government propaganda about a threat from their cousins nearby (who were in fact more or less harmless). Using primarily the government-run news media to invoke historic injustices suffered at the hands of these others and to hype some imaginary imminent threat made the young men (and older men) literally jump at the chance to preempt these pending attacks. They joined the regular military, militias, gangs, you name it. They armed themselves, organized somewhat, and turned that country into a slaughterhouse.

They've been slowly waking up from it for the last decade, and you can imagine how chagrined and sheepish they are about the whole thing.

The article mentions the mobile and pillow, as well as an experiment with dogs, electric shocks, and controls.

In these experiments, they expose the babies (the ones with ordinary pillows) or dogs (the ones with no lever to stop the shock) to events not under their control. Then, when a non-obvious control element is added, they blame the victim for not finding the control. They are drawing drastically wrong conclusions.

Would any of us act differently? Their implication is that every time a new element is introduced introduced into our environment, we should attempt to use it to control some other negative aspect of the environment. If we did, we'd have nothing to do other than to frob everything new sufficiently long to determine whether it controls something else.

This way madness lies. It seems to me that the evolutionary and the informed reactions are identical and they are both the _correct_ response to the situation.

Why do they think they've learned anything?

It makes me wonder if there have been any studies seeing if the same information about risks is assessed differently by those who see it on TV, read it a newspaper or magazine with illustrations, read it without illustrations and who hear it on the radio.

@Terry Cloth

Exacly, but I'd say go deeper. All of these examples -- and the entire premise that people are poor estimators of risk -- are all instances of poorly conditioned bayesian inferences.

Evolution has given us priors geared to only to gene propagation. The government, corporations, your friends, and society in general lies by omission and commission.

There is no computational framework -- wet or dry -- that can construct reliable, general, risk estimates in this kind of environment. This is common sense, but I guess it takes a bevy of economists, social scientists and psychologists to "discover" it as some completely new phenomena, needing complex explanation.

@John:

I think you're seriously underestimating the probability of winning the lottery. I don't have hard numbers, but I'd be really shocked if the percentage of the population that buys lotto tickets isn't significantly smaller than the percentage that eats food from cans.

Given that assumption, someone still wins the lotto every few weeks, at least. When's the last time someone died from hentavirus on a can? Or even got sick from it?

I always think it's amusing when people equate the chance of winning the lottery (which does actually happen - maybe not to me, or to you, but to someone somewhere) with improbable risks that have never happened to anyone and, in all likelihood, never will. (Or even to risks like hentavirus that have happened just a few times, ever)

Recency also has an effect. The number of people who died in airplane crashes on September 11th did not significantly change the percentage of airline passengers who've died in the last twenty years. But a lot of people didn't want to fly for a while and justifiably so. They had new information about how airlines might crash. Since there was a highly visible new factor in potential airline crashes, it's reasonable to believe that airline crashes could be more likely in the future than they were in the past.

If no child has been hurt on the neighborhood playground in ten years and then one kid falls off some playground equipment and dies, the recency of the accident is more important than the history of safety. The kid may have exposed a new structural weakness that wasn't present over most of the life of the playground.

As David Hume and many others have pointed out, there's no logical reason to assume that the future will be like the past. We seem to have evolved a heuristic that the near future will be more like the recent past than the distant past. And it seems to work well a lot of the time.

I thought the concept of 'learned helplessness' was very useful to explain some human behaviour that otherwise is mystifying. It's can be a result of long-standing abuse (racism? poverty?) that suggests there is nothing to be done - which may be true, but which in many situations is a self-fulfilling prophecy, if you therefore don't try to do anything.

As to why the DC sniper was not called a terrorist: because he (they) didn't have an agenda. There have been vigorous arguments about defining terrorism, but usually definitions require violence or threats of violence against (innocent) civilian populations in order to achieve some political goal, e.g. get a country out of a war, release prisoners, what have you. "we had better leave these people alone, because see how crazily harmful they are."

On a personal note, I never worried about crashing in an airplane until a crash that killed a person I slightly knew and rather liked. I was much more nervous in an airplane for some time after that.

I used to be a crewmember on a US Army helicopter. I got so used to being up front at the controls that flying in a commercial airliner became unnerving, mostly because I was no longer up front and had no idea what was going on. Long, bumpy landing approaches and, God forbid, a go around, really began to bug me. To this day, they still do. Once you have control, it's hard to give it up. Never mind that the chances of dying in a military chopper crash were many times greater than dying in a commercial airliner crash. It's the lack of control and information that's unnerving.

I'm pretty sure a computer dies of viruses caught while looking for hentai every few weeks.

it irks me to see lead lumped in with these other "risks."
Lead (in general, I don't know about in toys) is the opposite:
The stats and quantities involved show that people have, and have had for a very long time, a bit of cognitive dissonance on the matter.

I think this may be partly due to peoples thorough belief that their thoughts, abilities and "self" are somehow magically independent from their brain.

Joe Patterson: John may not have been so much underestimating as oversimplifying. I would say that the chances of winning the lottery are, _approximately_, about the same as the chances of being gored to death by a white rhino while visiting the World's Largest Cheese on vacation. At that level of unlikelihood, a couple of orders of magnitude here or there just get lost in the underflow. Yes, it's true that winning the lottery supposedly does occasionally happen to _somebody_, but it's so extremely unbelievably fantastically mind-bogglingly unlikely to happen to you that it has become a standard idiom for something so unlikely it's not worth thinking about. Which was the point: the rat poop on can lid poisoning risk may technically be nonzero in theory, but in practice it's WAY too small a probability to warrant any consideration, if we're being realistic. Only a completely irrational mind would give any thought to it at all, just as only a completely irrational person would spend money on lottery tickets.

And the point was just that: people *are* irrational sometimes. Frequently, even. Indeed, if the state lottery had a "sale" on tickets where you could get two tickets for the price of one, I'm absolutely certain that ticket sales (in dollars) would increase. Because people who buy lottery tickets don't buy them based on a rational evaluation of their real chance of winning.

Yes, if we go into scientific notation mode, the chance of winning the lottery is probably technically several orders of magnitude greater than the chance of getting killed by rat feces residue on a can lid. But that observation completely misses the whole point.

Thanks to Jonadab for support. I really did not want the discussion to get lost in the likelihood of airplane crashes. And, Joneadab also helped in supporting my point, which was not Lotto or airplane crashes, but human behavior in risky situations.

Supersnail made the same point with Londoners who lived through the blitz. My wife had the same experience on the other side of the war, going through the bombing of Stuttgart as a girl.

Where horrendous dangers were an every day reality, people cope with the risks matter-of-factly, even complacently.

It is the unknown, other-worldly, in some way non-real risk, that people get scared of.

My own guess is transference. Though one appears complacent against a genuine and familiar risk, I'm guessing that deep down in one's psyche, one is scared s**tless. But there is nothing that can be done about it. But deep emotions must have their outlet, and my guess is that the fear of harm from an unlikely source allows us that outlet.

Spending money to say we are sending money. You might get a letter when the check is mailed telling you the check is on the way.

WASHINGTON -- At a cost of nearly $42 million, the IRS wants you to know: Your check is almost in the mail.

The Internal Revenue Service is spending the money on letters to alert taxpayers to expect rebate checks as part of the economic stimulus plan.

Funny thing... I have an anecdote to share.

A couple days ago I took my wife for a hot-air balloon ride for her birthday. First time for both of us.

I spent the first 20 minutes of an hour long balloon ride scaring myself with the possibilities of what could happen to us while being tethered to a balloon by just a couple wooden toggles. And what if the nylon lines snapped? And the tiny wicker basket 3,000 above the ground...

Though after seeing my wife enjoying the ride, I decided that I needed to just let go of all those concerns and enjoy the flight.

After a couple deep breaths, I was able to enjoy the rest of the flight and get some great pictures.

> hot-air balloon ride... First time ...
> After a couple deep breaths, I was
> able to enjoy the rest of the flight
> and get some great pictures.

If you check an actuarial table you will find that hot air ballooning heads the list, topping such safer activities as motorcycling, kayaking, helecopter skiing, trick snowboarding, parachuting, parasailing, hang gliding, flying ultralights, etc., by a wide margin.