Schneier on Security

Clive Robinson • October 28, 2024 1:15 PM

Cash is king when the lights go out.

As some in the South East of the US will appreciate, whilst credit cards are convenient, they don’t work when there is no power for the machines etc. At which point people if they’ve got it go to cash or they go without the necessities of life.

It’s been a little while since I’ve been to Germany but they and Austria had a

“Cash is normal cards are not view point.”

Which brings us to, cause and effect. The cause is cash is popular, the effect,

“Why Germany? It has more ATMs than other European countries, and—if I read the article right—they have more money in them.”

Kind of “supply and demand” the demand for cash is high therefore the supply has to be consequently higher.

[1] Credit cards against population,

https://www.statista.com/statistics/1425039/biannual-credit-card-count-in-germany/

Harder to read,

https://www.statista.com/topics/1118/credit-cards-in-the-united-states/#topicOverview

But roughly ten times as many cards per head of population as Germany.

Clive Robinson • October 29, 2024 10:11 PM

Thu “But for” test does it apply?

@ Daniel Popescu,

You make the point that,

“it’s a complex issue: probably it could be partially solved by raising the bank’s insurance premiums against these type of heists and the damage caused to the nearby buildings…”

But you do not mention other “harms arising” such as physical and mental harms and even death, to those in or around the buildings that house the ATM devices or just those who use any ATM devices.

It can be argued that the banks with much forewarning from cases in other countries did not take reasonable steps to deter the attacks with explosives on their ATM devices and systems within Germany.

Thus the argument can be made that,

“‘But for’ the actions by the banks, these known and predictable harms would not have happened”.

Thus claims could be made against the banks, that might well succeed thus payouts could be immense…

As you say,

“In a nutshell, risk analysis”

The banks appear from their tardiness not to have taken what are “standard precautions” carried out in many countries for many years (thus arguably best or better practice). As an argument can be made that the banks failed to take very reasonable and clearly identified precautions simply because it involved “cost” to them. Thus others came to harm they would not have due to incorrect risk analysis and action… It is something a court might well consider in a significant way.

What the banks might use as a lawful defence, would have to be significant, such as Government Legislation or Regulation (think “defacement” legislation). Not something like “The insurance company said they would not pay for the loss of currency glued/inked if we did install such measures”.

Interestingly though if it can be shown the insurance companies have said that or similar… Then they too would fall under the “But For” test, and they have deeper pockets to pay from.