Schneier on Security

crf • November 17, 2005 12:26 AM

The phone company and user benefit from the supposed reduction in fraud this technology might provide. The company benefits directly, and the user might benefit from lower rates (since the company no longer has to eat some fraudulent charges, as they do now), and might also benefit if their phone is stolen, and this technology prevents the fraudulent use of the phone, which they would be partially responsible for.

But the costs seem borne by the user, rather than shared with the company, which is not the best deal for users of cell phones.
I guess some of the costs are unknown atm, such as how often the system would send a “false alarm” and force the legitimate user to re-enter some pass key to reactivate the phone.

A known cost would be that it would prevent the loaning of the phone to another (for an extended period) without also sharing the password. How great a cost that is depends on how the user uses the phone.

A more serious cost might be that the system disables a phone in a situation where, if the phone worked normally, a great benefit could be gained. One might speculate that the phone would disable itself during a traffic accident or other serious situation, and prevent any party from quickly using the phone, or prevent a stranger from using the phone to save its owner’s life. Such a hypothetical cost would seem to negate, several times over, any potential benefits in fraud reduction. (Of course, the phone could be programmed to always allow calling of emergency numbers, etc, but there will still undoutedly be situations where this technology would get in the way of providing a great benefit to society.)

Also it is the nature of companies to reduce their costs (such a fraud) by passing hem on to their consumers, by improving their products, or by participating in industry agreements: for example, shared insurance among the industry, and with other parties, to spread the risk of phone-fraud fairly, or by devising other, industry wide methods of reducing fraud (for example, an easier way of reporting a lost phone). But passing their costs (not strictly dollar-denominated) onto consumers is often the easiest way. But the cost to the consumer may be much higher than the benefit saved by the company.

Good industries and individual companies need to think of these above ideas, particularly they should not look at only their bottom line in evaluating a cost-saving measure, but their constomers’, as a group or as individuals, real cost, as well as society’s costs, otherwise they are depending too much on governments or other outsiders to regulate their industry (and have little right to complain when they do) — for they cry out for it.

When I read about dorky ideas like this one, wrapped up in a fancy faddish ribbon of security, I truly wonder about the maturity of the high-tech industry in general. Other, more traditional, industries used to behave with attitudes like this — think of the chemical industry (who in their infancy thought not about who truly bore the costs of pollution — and who now pay ever stiffer prices to regulate pollution), or the auto industry (who cared little about the safety of their products in crashes, until it was forced upon them by governments and consumers): both those industries now, more or less, are proactive about considering the total costs of what seem at the time, to be good, innovative, ideas.