Schneier on Security
A blog covering security and security technology.
« EPIC Alert |
| Interview with WEP Attack Researchers »
May 17, 2007
Rare Risk and Overreactions
Everyone had a reaction to the horrific events of the Virginia Tech shootings. Some of those reactions were rational. Others were not.
A high school student was suspended for customizing a first-person shooter game with a map of his school. A contractor was fired from his government job for talking about a gun, and then visited by the police when he created a comic about the incident. A dean at Yale banned realistic stage weapons from the university theaters -- a policy that was reversed within a day. And some teachers terrorized a sixth-grade class by staging a fake gunman attack, without telling them that it was a drill.
These things all happened, even though shootings like this are incredibly rare; even though -- for all the press -- less than one percent (.pdf) of homicides and suicides of children ages 5 to 19 occur in schools. In fact, these overreactions occurred, not despite these facts, but because of them.
The Virginia Tech massacre is precisely the sort of event we humans tend to overreact to. Our brains aren't very good at probability and risk analysis, especially when it comes to rare occurrences. We tend to exaggerate spectacular, strange and rare events, and downplay ordinary, familiar and common ones. There's a lot of research in the psychological community about how the brain responds to risk -- some of it I have already written about -- but the gist is this: Our brains are much better at processing the simple risks we've had to deal with throughout most of our species' existence, and much poorer at evaluating the complex risks society forces us to face today.
Novelty plus dread equals overreaction.
We can see the effects of this all the time. We fear being murdered, kidnapped, raped and assaulted by strangers, when it's far more likely that the perpetrator of such offenses is a relative or a friend. We worry about airplane crashes and rampaging shooters instead of automobile crashes and domestic violence -- both far more common.
In the United States, dogs, snakes, bees and pigs each kill more people per year (.pdf) than sharks. In fact, dogs kill more humans than any animal except for other humans. Sharks are more dangerous than dogs, yes, but we're far more likely to encounter dogs than sharks.
Our greatest recent overreaction to a rare event was our response to the terrorist attacks of 9/11. I remember then-Attorney General John Ashcroft giving a speech in Minnesota -- where I live -- in 2003, and claiming that the fact there were no new terrorist attacks since 9/11 was proof that his policies were working. I thought: "There were no terrorist attacks in the two years preceding 9/11, and you didn't have any policies. What does that prove?"
What it proves is that terrorist attacks are very rare, and maybe our reaction wasn't worth the enormous expense, loss of liberty, attacks on our Constitution and damage to our credibility on the world stage. Still, overreacting was the natural thing for us to do. Yes, it's security theater, but it makes us feel safer.
People tend to base risk analysis more on personal story than on data, despite the old joke that "the plural of anecdote is not data." If a friend gets mugged in a foreign country, that story is more likely to affect how safe you feel traveling to that country than abstract crime statistics.
We give storytellers we have a relationship with more credibility than strangers, and stories that are close to us more weight than stories from foreign lands. In other words, proximity of relationship affects our risk assessment. And who is everyone's major storyteller these days? Television. (Nassim Nicholas Taleb's great book, The Black Swan: The Impact of the Highly Improbable, discusses this.)
Consider the reaction to another event from last month: professional baseball player Josh Hancock got drunk and died in a car crash. As a result, several baseball teams are banning alcohol in their clubhouses after games. Aside from this being a ridiculous reaction to an incredibly rare event (2,430 baseball games per season, 35 people per clubhouse, two clubhouses per game. And how often has this happened?), it makes no sense as a solution. Hancock didn't get drunk in the clubhouse; he got drunk at a bar. But Major League Baseball needs to be seen as doing something, even if that something doesn't make sense -- even if that something actually increases risk by forcing players to drink at bars instead of at the clubhouse, where there's more control over the practice.
I tell people that if it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." It's when something isn't in the news, when it's so common that it's no longer news -- car crashes, domestic violence -- that you should start worrying.
But that's not the way we think. Psychologist Scott Plous said it well in The Psychology of Judgment and Decision Making: "In very general terms: (1) The more available an event is, the more frequent or probable it will seem; (2) the more vivid a piece of information is, the more easily recalled and convincing it will be; and (3) the more salient something is, the more likely it will be to appear causal."
So, when faced with a very available and highly vivid event like 9/11 or the Virginia Tech shootings, we overreact. And when faced with all the salient related events, we assume causality. We pass the Patriot Act. We think if we give guns out to students, or maybe make it harder for students to get guns, we'll have solved the problem. We don't let our children go to playgrounds unsupervised. We stay out of the ocean because we read about a shark attack somewhere.
It's our brains again. We need to "do something," even if that something doesn't make sense; even if it is ineffective. And we need to do something directly related to the details of the actual event. So instead of implementing effective, but more general, security measures to reduce the risk of terrorism, we ban box cutters on airplanes. And we look back on the Virginia Tech massacre with 20-20 hindsight and recriminate ourselves about the things we should have done.
Lastly, our brains need to find someone or something to blame. (Jon Stewart has an excellent bit on the Virginia Tech scapegoat search, and media coverage in general.) But sometimes there is no scapegoat to be found; sometimes we did everything right, but just got unlucky. We simply can't prevent a lone nutcase from shooting people at random; there's no security measure that would work.
As circular as it sounds, rare events are rare primarily because they don't occur very often, and not because of any preventive security measures. And implementing security measures to make these rare events even rarer is like the joke about the guy who stomps around his house to keep the elephants away.
"Elephants? There are no elephants in this neighborhood," says a neighbor.
"See how well it works!"
If you want to do something that makes security sense, figure out what's common among a bunch of rare events, and concentrate your countermeasures there. Focus on the general risk of terrorism, and not the specific threat of airplane bombings using liquid explosives. Focus on the general risk of troubled young adults, and not the specific threat of a lone gunman wandering around a college campus. Ignore the movie-plot threats, and concentrate on the real risks.
This essay originally appeared on Wired.com, my 42nd essay on that site.
EDITED TO ADD (6/5): Archiloque has translated this essay into French.
EDITED TO ADD (6/14): The British academic risk researcher Prof. John Adams wrote an insightful essay on this topic called "What Kills You Matters -- Not Numbers."
Posted on May 17, 2007 at 2:16 PM
• 79 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
As someone who grew up "down the road" from Tech, got my BA there, worked there for 12 years and was married on its campus, I have felt great personal grief and shock following the events of April 16. As you might imagine, I followed the news closely, needing, at first, to know *everything* anyone said.
I no longer want to know everything that anyone at all has to say about coulda/shoulda/woulda, but I read your article in _Wired_ , and I have to say that it is the most *rational* thing I have read or seen on the subject.
Thank you for being the voice of reason.
The wonderful 42, and you hit the nail on the head. Then you came back and kicked it into submission. ;-)
Following events like the VA Tech shooting, it seems hard to find *anyone* willing to offer a rational opinion because, like you say, they feel the need to do something. Something bad happens and they feel the need to retaliate, regardless of whether or not we can launch a successful retaliation. A murder against a family member requires retaliation, a lone, rare, improbably tragedy doesn't necessarily. What *can*, practically speaking, be done?
As I like to say, you can't out think bad luck. Freak chances happen and by definition they happen, well, freakishly, usually regardless of whatever safe guards you have in place.
Thanks for being the voice of reason -- again. I'll definitely be pointing people towards this article.
Mention of Domestic Violence reminded me of a stat I read- from Canada, but presumably the same in the US. The demographic group most likely to be murdered are people engaged in criminal activity. I think it may even have narrowed it down to the drug trade. The 2nd most likely demographic is women who have left a husband/boyfriend within the last 2 years. Sorry, no source.
Wow, Bruce, you're so sensible it's scary. (I'm afraid you'll have to be banned.)
The TSA successfully keeps elephants off of our airplanes too. Maybe the agents should get a commendation and a raise for their excellent work?
I saw a clip on CNN about an online game mimmicking the massacre. The object is to murder as many students as possible and get away before the police get there. If the developer makes it space aliens or Nazi's, it's a non event. "Students" gets your 14 year old game developing self 15 minutes of fame from CNN's mock outrage. Unfortunately, you'll probably also be kicked out of school and/or arrested.
Bruce, this is one of the best articles you've written in a long time (Don't get me wrong, you write plenty of fine articles, I just thought this one was particularly well written and sensible). Thank you. I only wish there were more people who thought like you running things.
There is a group of people in the united states who are successfully killing thousands of people a year. Though we have known about them for a long time and passed many laws to stop them, they still continue to kill people each year.
They are distributed throughout the United States.
They operate in independent cells.
They have their own resources and cash.
They employ random targeting.
They employ law enforcement evading devices.
They utilize liquids in the commision of their crimes.
Drunk Drivers: the true liquid bombers!
A well written piece, Bruce.
Reminds me of the Simpsons where a bear wanders into town one day and everyone demands the mayor do something about it, so he institutes the "Bear Patrol"
Homer: Not a bear in sight. The Bear Patrol must be working like a charm.
Lisa: That's specious reasoning, Dad.
Homer: Thank you, dear.
Lisa: By your logic I could claim that this rock keeps tigers away.
Homer: Oh, how does it work?
Lisa: It doesn't work.
Lisa: It's just a stupid rock.
Lisa: But I don't see any tigers around, do you?
[Homer thinks of this, then pulls out some money]
Homer: Lisa, I want to buy your rock.
[Lisa refuses at first, then takes the exchange]
Couldn't agree more on the gun control issue, and you've hit this one right on the head as usual:
"We simply can't prevent a lone nutcase from shooting people at random; there's no security measure that would work."
Avoiding widespread media publication of glamour shots (guy posing with guns, hammer, sword, etc.) and martyr videos of killers, however, could go a long way towards not encouraging copycats.
You're right, so right. But how do we tell people? It's very difficult to tell someone who is grieving the death of a loved one that they are overreacting. At least partially, it's down to control. People who have just suffered a rare tragedy need to lobby and campaign because it makes them feel that they are helping, and that if they can change something, then the tragedy had meaning. To say to such a person "actually, you're making the situation worse, you should just accept this as a rare event, and move on", isn't feasible.
How do I argue against someone whose child was kidnapped that person tracking and recognising CCTV cameras are ineffective and an intolerable breach of my liberties?
The attack on the World Trade Center was a rare event, and we should have simply not responded. Kidnappings and rocket lauches against Israel by Hamas should never have led to retaliatory military action, but how do you say to the people in fear and grief. "We can and should do nothing". You can only do it by making nothing seem like the powerful thing to do, as Gandhi tried to.
And I suppose this is what we must do. Find a way to target that grief and desire to do something and take control towards something more constructive than security theatre. It's something that has not often been attempted, but I think that every society requires it, or face the slide into fascism.
Pre 9/11 my statistics teacher had a joke:
"Whenever I fly, I always take a bomb with me. The chances of two bombs being on the plain are so low that it's impossible for a terrorist to bring one".
Excellent essay, Bruce, even for your already very high standards. And congrats on it being your 42nd, too! :)
It occurs to me that there's another reason people don't focus on the mundane and daily as the actual source of preventable harm. It's too damn damaging to routine interaction, not to mention close personal and family contacts.
Aside from the fact that it's rather hard to see just how one would go about doing much about these close-in risks in many cases, the drag that would be imposed on both necessary and valued activities could very quickly get to be intolerable. So people rationally judge that "it ain't worth it" to lock down the home front. (Admittedly there are plenty of egregious cases of denial of risk, the usual example being the abused woman who won't break it off no matter how obvious it is to others that she is headed for the hospital or morgue.)
The advantage of focusing on the rare and more remote threats is that they don't have this kind of personal or intimate cost, though the consequences may, as you point out, end up being very inconvenient indeed from time to time.
The other issue is that the victim count per incident is much higher, so the visible payoff of prevention is clearer. So "rational" depends on where you stand, and how close that is to just
what. So to speak. ;)
It's plane it wasn't an English class.
"Something must be done! This is something, therefore we must do it!"
Some people have touched on it, but I suggest that it may also be about control, or rather the FEELING of control. In other words, I worry about stranger kidnappings and murders and terrorist attacks and NOT about friends and family doing it because I feel like I have some sort of control over people I know. The "I should be able to tell when my friend/family member/etc is going to do something bad" syndrome. As if the very concept that you know somebody gives you the ability to anticipate their future actions. This false feeling of confidence in our surroundings lends to our attempt to control those areas of our life where we KNOW we don't have any control.
"If you want to do something that makes security sense, figure out what's common among a bunch of rare events, and concentrate your countermeasures there."
That's a good point, but it's precisely what people DON'T want to do about disturbing events -- think about them.
By and large people would rather cast a "gut judgement" which is meant to make themselves feel good, instead of gaining a real appraisal of the situation. You know, the "they hate us for our freedom" kind of nonsense. No insight is gained, but then one can go around puffing his own chest and feeling good about himself.
This reminds me of a wonderful quote from Yes Prime Minister.
Hacker's intention to make this announcement even when he was well aware of the risk involved was a result of what is known to the logicians in the Civil Service as the Politicians' Syllogism:
Step One: We must do something.
Step Two: This is something.
Step Three: Therefore we must do this.
Logically, this is akin to other equally famous syllogisms, such as:
Step One: All dogs have four legs.
Step Two: My cat has four legs.
Step Three: Therefore my dog is a cat.
The Politicians' Syllogism has been responsible for many of the disasters that befell the United Kingdom in the twentieth century, including the Munich Agreement and the Suez Adventure - Ed.
'A Conflict of Interest', The Complete Yes Prime Minister, pp. 378-9.
"It occurs to me that there's another reason people don't focus on the mundane and daily as the actual source of preventable harm. It's too damn damaging to routine interaction, not to mention close personal and family contacts."
That seems like a good point to me. If I was to continually worry myself about the real risks I face in life, I might just go mad.
I wonder how this relates to people who are forced to deal with real, extreme risks on a daily basis e.g. a soldier in a combat zone. Rationally, the soldier must know that having bullets whistled around his head is not good yet there is plenty of documentation about soldiers who continued to function by ignoring the risks they faced. Even when repeatedly faced with appalling threats, perhaps we choose to ignore the threat simply because this state of denial is the only way to keep functioning effectively?
This theme is becoming so tired. Don't worry about terrorism, worry about car crashes and killer pigs. Forget that terrorism is a knowing crime, not an accident, the intent is reduced to meaningless when stats are compared in a spreadsheet. Don't worry about guns, security in schools - hopefully your kid doesn't get shot. The expense of having bracelets to help protect babies from being stolen from hospitals - pointless in the extreme. Hope your baby doesnt get stolen. I have the utmost of respect for the creds and the crypto but the social commentary about how everyone is an idiot for worrying about things that might hurt of kill you or anyone you love, it's real tedious. Callow in the extreme. Kids seem to really eat it up, works on npr too. sit tight and relax, all this nonsense about worrying about anything is nonsense and everyone is an idiot but you. good job. stay in minnesota
I've heard it as the Thatcherite Syllogism, and when properly constructed it actually follows the rules of a syllogism.
Something must be Done
This is Something
This must be Done
It's the same shape as:
A cat has four legs
Felix is a cat
Felix has four legs
There were two events, a double murder and, hours later, a massacre. The police and university authorities decided to keep the double murder secret. Had they broadcast a warning of the murders, students, faculty, and staff could have taken whatever actions they felt prudent.
The police assumed they knew what had happened -- a double murder in a love triangle -- so they went to her boyfriend's and searched for evidence and tried to get a confession out of him.
When the police finally arrived after the massacre started, their first impulse was a 'lockdown', which prevented people from escaping freely.
As with Hurricane Katrina, the disaster policies of the authorities are always secret, and always wrong.
@Ted ("This theme is becoming so tired. ")
(1) Repetition is a good teacher; (2) pity it isn't yet widely appreciated; (3) part of Bruce's point is that this theme is counterintuitive, so unsurprisingly it's unpalatable, sort of like medicine.
Also part of the problem is that caring and action seem to go hand in hand -- but they are a toxic couple. Anyone who says, "Shocking news is, of course, a terribly low-probability event" should be thoughtful about what is said next. Right after the shooting, I said something akin to my roommate, who was revulsed; he thought I was dismissing these folks' death as irrelevant and not worth caring about. That is not at all what I (a Hokie-proud alumnus) meant! The point I was driving at was, we don't need to make more laws because of something like this, we don't need to clamp down on campus security, impose gun control, loosen gun control, etc. I still was very moved by the horrible event, wrote letters to Blacksburg friends, and so on. What I'm saying now is, somehow we need to decouple our affective response--caring, compassion, concern--from our attempts to be effective--new regulations, more guns, less guns, more security.
Also, do I correctly sense when you write "callow" you mean something other than "young, unfledged, immature"?
Bruce writes 'Our greatest recent overreaction to a rare event was our response to the terrorist attacks of 9/11. I remember then-Attorney General John Ashcroft giving a speech in Minnesota -- where I live -- in 2003, and claiming that the fact there were no new terrorist attacks since 9/11 was proof that his policies were working. I thought: "There were no terrorist attacks in the two years preceding 9/11, and you didn't have any policies. What does that prove?"'
Sure. Just write off the 17 people killed on the USS Cole and your argument is accurate. Ignore the hundreds killed over the years before 9/11; diplomats slaughtered, cripples in wheelchairs pushed off of boats, sailors shot in the head and dumped off of planes, Marines bombed in Lebanon, hundreds killed in embassy bombings. Just wave the hand and it all goes away.
While there is plenty to criticize in the inane actions of our government, to suggest that we should ignore terrorism and do nothing about because it's statistically insignificant displays an appalling disconnect with reality. The fact that many people lap it up and think your ideas actually make sense explains a lot about the present political climate in America.
Less than 10% of the people in America were involved in the Revolutionary War yet we defeated the greatest nation on earth. But don't worry about terrorists. They pose no threat to us. They're just a statistical anomaly.
There's been 8331 terrorist attacks since 9/11 with an average of almost 8 dead per attack. Tell the families of the over 64,000 dead that their loved ones were a statistical anomaly. I'm sure they'll be receptive.
What your argument has proven is that it's entirely possible to be brilliant in one area and without a single clue in another.
Excellent essay, it really highlights the things that drive me crazy about society.
Terrorists no longer have to kill people to cause terror, they just have to threaten to kill, and the media does the terrorizing.
As clucky said...
Wow, Bruce, you're so sensible it's scary. (I'm afraid you'll have to be banned.)
When I wrote it I meant callow. Reading your thoughtful comments I would add "callous", maybe that is a better word.
I wish I never worked in WTC but I did.. so the fact it's gone makes it hard for me to associate 911 with a car crash or pig-related death.
Car crash is something we all try to avoid but happens anyway, randomly, unfortunately. 911 was people trying to kill me and mine for no reason I respect - funding, planning, maliciousness.. to compare that with random mechanical accident amazes me.
that matters to me but seems not to matter to Bruce et al. "et al" is a *ton* of people i admit. for most americans already 911 is as compelling as something that happened in some other country decades ago it seems to me. for bruce it's all in the math.
Similarly I have kids, and I was happy with the "security theater" of wearing ID bracelets when they were born, not so much only because it made me feel better but because you can read about stuff so trivially
Bruce reduces this kind of human tragedy to a statistical anomaly which bothers me. if you are so incautious as to believe Bruce's stats and someone takes your kid what do you do? You would be able to live the rest of your life being extremely smug that you hadn't been taken in by a false sense of security which would be quite a feather in your cap. got no kid though! have fun.
I think you're missing the point here. Of course it is appropriate to be moved by individual tragedies, but you have to do a statistically minded cost/benefit analysis before you take action in response to it.
If my girlfriend goes out and gets raped, of course I'm going to be angry, frustrated, and yes--maybe, I will wish there were cameras wired into the nearest police station so she could have been helped. That should not affect what I perceive to be best for society overall, however. We can't protect against every possible danger, and one has to be aware of the rapidly diminishing returns that go along with trying to do so.
Bruce makes a very legitimate point, albeit one most people often fail to realize due to an inappropriate emotional reaction. It is not a matter of being callous when you realize the simple fact that society has finite resources to devote to protecting property and life.
Ted has a point. There's a difference between random events, like car crashes, and motivated events, like terrorist attacks. Killings perpetrated by a nut case are somewhere between.
Because the perceived effectiveness of one terrorist attack can affect whether the next terrorist decides an attack is worth while, there's some theater there too.
Perhaps one of the reasons some risks are rare is because people 'over'react. There is plenty of documented evidence (sorry, no sources to hand) on the difficulty the majority of human beings have in killing other human beings - many people find it very hard to break the overwhelming social conditioning that killing people is a Bad Thing (TM). This strong social conditioning must surely reduce the number of attempted murders (to choose one crime as an example), which in turn must reduce the number of successful murders.
The massive 'over'reaction by society to these rare risks helps to reinforce the social message of the abhorrence with which your fellow humans view this type of act. This in turn reinforces the social conditioning against these acts; this in turn contributes to keeping them rare.
After all, if the public's overwhelming reaction to a school shooting was "another one? Oh well. Now, who won the rugby on Saturday?", more kids might attempt it.
If that opinion's valid, then any strong reaction, however illogical on the face of it, contributes to mitigating the risk.
I think it is even more perverse than you describe Bruce. We are all shocked at the abnormality of the Tech shooting, but most of us rationally realize it is unlikely to happen to us. And yet, there are just enough people who are irrational that 'something has to be done'. And as a local politician or whatever, you don't want to be seen as unresponsive, because that one loud voice will cause all kinds of trouble. And what the heck, maybe we shoudl do somethign anyway... And at least I look like I'm solving problems this way...
I just got off a plane, and during the flight, the pilot needed to go to the bathroom. The flight attendants dragged a cart across the aisle blocking anyone from coming up, and one FA switched with the pilot. The other stood in the aisle blocking any possible access. This even tho the re-inforced cockpit door was closed. Maybe this is reasonable, but do we really expect terrorists to fly around waiting for those few flights and those few opportunities when the pilot needs to take a leak???
I want to add a new thought to the mix now: about rare risk and *underreaction*. So, now we all know one facet of "The Schneier Thesis" is, we overreact to rare risk and underreact to common risk. I want to offer a friendly challenge to that notion, brought on from reading _Over the Edge: Death in Grand Canyon_ by Ghiglieri and Myers. One thesis in this book is that people fall off the rim of Grand Canyon (almost always to their deaths) because the vista there is so extraordinary and unfamiliar, that these visitors underappreciate the risks around them. Namely, the grave dangers of crawling over the guard rail, clowning around on the rocks, and posing for dramatic, edge-of-the-precipice photos.
So maybe the thesis ought to be, "Rare risk leads to disproportionate reaction," rather than strictly overreaction?
Of course, I know I'm only reading about the fatalities in this book, not about the millions of visitors who behave perfectly sanely, or, I fancy, the annual thousands who probably white-knuckle grip the railing and are nervous until they are yards back from the edge -- i.e., who overreact to the unusual risks around them. Still, just because my argument is a little fallacious doesn't mean I'm wrong. :-)
" If a friend gets mugged in a foreign country, that story is more likely to affect how safe you feel traveling to that country than abstract crime statistics."
I think this comes down to the way ordinary people work out odds. If crime is really rare in that country, what are the odds that someone you know would be affected by it? So when someone you know is affected, it implies that it's very common.
@Richard Braakman, re syllogisms:
But that's not quite the same, due to equivocation between the two about words in English. (I assume you know this, so I'm mostly clarifying for others, just in case.) The Politician's Syllogism (assuming that "something" is actually a predicate and not implicitly true of everything):
- "Something must be done." ("There is something that must be done," as opposed to "Everything must be done.") ∃x: something(x) implies must-be-done(x).
- "This is something." something(this).
- "Therefore, this must be done." something(this) implies must-be-done(this), by **existential instantiation. must-be-done(this), by modus ponens.
Except the first step in the last line doesn't work, because it's the fallacy of instantiating an existential quantifier as though it were a universal. The other syllogism, in contrast, actually has a universal:
- "Cats have four paws." ("All cats have four paws," as opposed to "Some cats have four paws.") ∀x: cat(x) implies has-four-paws(x).
- "Felix is a cat." cat(Felix).
- "Therefore, Felix has four paws." cat(Felix) implies has-four-paws(Felix), by universal instantiation. has-four-paws(Felix), by modus ponens.
The point that you are missing is that society has a finite set of resources. Your example is that it is helpful to guard against babies being abducted from hospital. But at what cost?
Because abduction is a scary, rare and emotional event it creates significant media coverage. (For example, the British girl recently abducted in Portugal.) However imagine it cost $5m for a hospital to introduce a new security system with bracelets, detectors, security guards and maintenance, along with lost productivity for nurses chasing false alarms.
What if that $5m was spent on research into cot death? Or further training for nurses? Perhaps the benefits would be ten times as great. But there is little appearance of risk reduction; those scientists in the labs may take 10 years to find a solution, and that nurse education is completely invisible to the general public. But the flashing red band on your baby's leg: now that's security!
Bruce's point is not that reducing rare risk is a bad thing in itself. It is bad if the resources spent reducing that risk divert resources from other more effective programs. Improved roads are probably more important than shark control. Public transport more important again.
These effects are important not only at a government level but also for individual choice. A person who is afraid to swim in the sea for fear of sharks but doesn't mind driving to the shops is not seeing the world very clearly. And the bigger danger is that human beings become disconnected from the world, never hiking in the mountains, swimming in the sea or challenging themselves physically or emotionally because their government hasn't protected them from the unknown.
Here in Sydney our government chooses to uses our resources by having a security person walk up and down the Harbour Bridge. What they are guarding against is anyone's guess. But certainly it is high visibility to the general public and certainly makes the government look like they are doing something.
This is all very similar to the current hysteria underway in the UK about the missing girl in Portugal, "Maddy". If she wasn't white, pretty, blonde and her parents not middle class doctors how much of a similar reaction would there be ?
While a level of hysteria in the media is expected and therefore acceptable, what appears to have now happened is that the machismo in the Portugese police force has resulted in them striking out randomly at any targets (they call them "suspects" - I guess like the "usual suspects" in Casablanca) they think have done them harm and that cannot fight back.
It appears that if you dare challenge the effectiveness of the investigation and you are not - for want of a better term - an accredited journalist, then off to the slammer you go. No evidence, just suspicion.
Hysteria in the British media appears to have led to at least two male "suspects" having their reputations and lives ruined with no sign of any progress in the actual investigation. If either or both are guilty that may be mitigating but it doesn't look that way at the moment.
According to statistics (hidden somewhere on www.statistics.gov.uk) the most likely suspects are the parents. But they, of course, are too media savvy to allow any discussion on that topic.
You know...look at 9/11 in an objective light for a moment. It was a problem. 2,973 died and a great deal of property damage and disruption was caused. The job of an administrator is to attempt to address serious problems.
Now, 9/11-style terrorism isn't the worst threat to lives in the United States. About the same number of people die in automobile accidents in the United States each and every month of every year in the United States, but we don't reorganize the government, spend hundreds of billions of dollars in emergency bills, and remove civil liberties to try to address these.
However, 9/11 was still a concern. The task before an administrator is to create policy to solve the problems raised -- potential future loss of life in terrorist attacks, in this case. Just as with any other policy, this policy should be effective, try to minimize harm in other areas, and not waste money. According to Wikipedia, 9/11 produced 38 billion dollars of damage, and slightly under three thousand lives lost. A policy that probably would be viewed by most as a failure would be to completely ignore the problem. This would result in 38 billion dollars in damage, three thousand lives lost, and no reduced risk of future attacks. As a silver lining, many people around the world sympathized with the United States, so there was even a small gain.
Bush decided to invade Iraq (whether or not he actually believed that it had any basis in 9/11 or was being completely opportunistic, his administration did present a tie between the two, so I will hold him to this). The Iraq invasion and subsequent occupation has directly cost the United States already some 400 billion dollars, resulted in the deaths of another 3400 United States soldiers, the wounding (and possible maiming or handicapping) of another 25,000 or so, deaths of some half-a-million Iraqis, global expansion of anti-Americanism, the collapse of US-friendly leaders like Blair, the acceleration of Iranian and North Korean nuclear weapons programs, the destruction of Middle Eastern oil infrastructure and the reduction of oil production, the destruction of most of the economy of one of the most secular and prosperous nations in the Middle East, the introduction to power of Islamic leadership in that nation, the loss of civil rights for United States citizens, and a great deal of ineffective policies passed, of which I have seen nothing that convincingly does much to address the possibility of future 9/11 attacks.
Put simply, Bush's post-9/11 policy not only did not resolve 9/11-raised issues, but caused many times over the direct damage of the 9/11 attacks. A President who simply completely ignored 9/11 would have left us far better off -- and yet, 9/11 is the main point on which the Bush Administration sells itself. This is not good policy.
"Ted has a point. There's a difference between random events, like car crashes, and motivated events, like terrorist attacks. Killings perpetrated by a nut case are somewhere between."
Definitely true. Our brains are hard-wired to deal with other people, and we definitely exaggerate risks associated with people. I've read some really impressive experiments that demonstrate this.
"This theme is becoming so tired. Don't worry about terrorism, worry about car crashes and killer pigs. Forget that terrorism is a knowing crime, not an accident, the intent is reduced to meaningless when stats are compared in a spreadsheet. Don't worry about guns, security in schools - hopefully your kid doesn't get shot. The expense of having bracelets to help protect babies from being stolen from hospitals - pointless in the extreme. Hope your baby doesnt get stolen. I have the utmost of respect for the creds and the crypto but the social commentary about how everyone is an idiot for worrying about things that might hurt of kill you or anyone you love, it's real tedious. Callow in the extreme."
What I think you're missing is the cost side of the trade-off. The decision isn't baby bracelets or no baby bracelets. The decision is: we have $x million to spend on our children. Should we buy baby bracelets, or should we spend it on early childhood education. Or whatever. What is the best thing we can do with that money? If it's buying baby bracelets, then fine -- buy them. But if it's something else, we're making a mistake by buying the bracelets.
"I think it is even more perverse than you describe Bruce. We are all shocked at the abnormality of the Tech shooting, but most of us rationally realize it is unlikely to happen to us. And yet, there are just enough people who are irrational that 'something has to be done'. And as a local politician or whatever, you don't want to be seen as unresponsive, because that one loud voice will cause all kinds of trouble. And what the heck, maybe we shoudl do somethign anyway... And at least I look like I'm solving problems this way..."
I've written about this elsewhere: there is a propensity for elected officials to *do something*. It might not be smart security or smart social policy, but it's smart politics.
From the story:
In the United States, dogs, snakes, bees and pigs each kill more people per year than sharks. In fact, dogs kill more humans than any animal except for other humans. Sharks are more dangerous than dogs, yes, but we're far more likely to encounter dogs than sharks.
Part 1) Interactions
Ok let's work this out. Each human-dog interaction is much less likely to end in death than a human-shark reaction. Thus people seeking human-dog interactions and avoiding human-shark interactions really underscores how bad we are with risk analysis. Really?
Part 2) Policy
"Sharks must be leashed."
There are signs for almost anything. Where is this sign?
no fan of bush or iraq.. but here we go again with the car crashes.
why is that what is used over and over and over, everyone brings up car crashes, always the same.
i bet we do spend billions trying to prevent car crashes? have for decades? we don't reorg the govt because we have a dept of transportation that is always trying to make vehicles safer already, has been for how many years? Has there been a huge increase in car crashes lately that I havent heard about? my car has like 10 airbags, i still could die in a crash.
if a tire manufacturer spends a ton of money making the best tire they can and the govt has standards and inspects them and your tough luck is, despite your air bags and safety belt and jersey barriers and speed limits and whatever else, unfortunately your tire blows up on a nail and you die on an interstate.... is that the same as someone plotting for years to kill random families they never met in a country they've never been to because of their religious fanaticism?
does the latter not occur to you as any worse than the former? would you rather die at 70 of a heart attack or at the age of 4 from some terrorist, in your daycare at the pentagon?
the point of view is so far afield for me, i don't understand how they could be equated other than strictly numerically which i guess is the point of all of this, our limited utils should apparently be doled out strictly on the basis of raw numbers. i don't agree, i think a lot of people accept they might die in a car crash and feel sufficient measures are already being taken to reduce the likelihood. they accept some responsiblity when they drive. they don't when they're at work at cantor fitz.. they expect the govt will try and protect them. what do car crashes have to do with any of this.
"What I think you're missing is the cost side of the trade-off. The decision isn't baby bracelets or no baby bracelets. The decision is: we have $x million to spend on our children. Should we buy baby bracelets, or should we spend it on early childhood education. Or whatever. What is the best thing we can do with that money? If it's buying baby bracelets, then fine -- buy them. But if it's something else, we're making a mistake by buying the bracelets."
that makes sense. thank you for your comment.
That said, often the message seems to be, look at what idiots we are for buying the bracelets. Even your reply (which I appreciate) is "childhood education or whatever." That respectfully doesn't inspire me, I am already spending a ton of money on early childhood education. I do think it's important. why do i need to spend more on that and what do i get in addition to what i have already?
The idea of carefully determining where we invest scant funds to protect, improve ourselves makes a ton of sense but seems to morph frequently into, look at all the stupid ways we squander those funds. are they really so stupid? is your point that no one thinks about this stuff? i think they do.
I would definitely rather the bracelets than "Or whatever". If you were able to give me a good whatever where I am spending less than I should, then I am all ears, but I don't hear it.
The bracelets made it less likely someone could walk away with my new kid while I slept in those really uncomfortable hospital chairs for a few hours. I value that way more than whatever. I'm spending enough on education thanks. Is that theater?
I guess we can all choose which hospitals we go to so the market can decide if it wants bracelets or not, but for me it doesn't seem like undue effort cost or concern.
the theme seems to be (not you but in general, the /. types), the hospital's dumb, the cops are dumb, the govt is dumb, i'm smart because I think their efforts to protect us are all theater, but what are the new ideas, what do we do instead of the theater. i guess smarter things, what are they though.
MLB has had problems with booze for years. they don't want to encourage their players to drink so they don't allow them to drink anymore at work. My job doesn't allow me to drink at work. I think that is for the best. What am I missing here. Does MLB think this will prevent DUIs by their players? I don't think so, I think they were behind the times having players get drunk in the locker room after games. Maybe they could be liable. Why would they not ban booze on the jobsite? I don't get it.
"forcing players to drink at bars instead of at the clubhouse, where there's more control over the practice."
Should i encourage my staff to drink at work then? So I can control it? or is it their problem and i shouldn't encourage them to drink by handing out shots at their desks. just asking.
what to buy instead of bracelets, that seems to be someone else's problem to figure out, if we don't have anything better in mind how do we know just how dumb the bracelets are.
Bruce's comments bear directly on the issue of gun ownership. Gun owners claim their guns will keep them safe from such rare threats as random home invasion, yet they insist that their personal practices mean that they are not much more likely to suffer gun injuries by owning a gun. http://tinyurl.com/2evb4u The truth is that while gun ownership is certainly a Second Amendment right, it's not one that makes the owner safer.
I heard on the news yesterday that Canada is now considering a no-fly list that you won't know your name is on it until you try to fly and you won't be able to dispute to have your name removed.
It is doesn't work in the US why even try here.
"There's been 8331 terrorist attacks since 9/11 with an average of almost 8 dead per attack. Tell the families of the over 64,000 dead that their loved ones were a statistical anomaly. I'm sure they'll be receptive."
Source for your figures please, Antimedia.
A reputable one.
The problem, Ted is that there is an almost unlimited number of things that are useless (or possibly harmful) and a very few that are useful. So 'do something' is statistically likely to be useless.
I suggest that 'do nothing' is the appropriate action if a clearly justified action cannot be identified. At least it costs a lot less.
Ted-- On the MLB point -- my blog entry points out that from a risk point of view, it's not necessarily for the best FOR THE PLAYER that players are banned from drinking at the job site. Essentially, banning beer in the club house moves the drinking to a less controlled environment.
You say MLB doesn't "want to encourage their players to drink." This is the trickiest area of the argument, as I point out in the essay. It's not necessarily a question of encouragement; some players will drink regardless. In fact it can be argued the ones who will drink regardless are the ones at a higher risk of poor behavior.
What they don't want, really, is liability for the behavior. So, it's for the best FOR THE TEAM to ban booze, even if it's not in the interest of the player.
One other point, you say, "My job doesn't allow me to drink at work." In fact most companies at some point or another face this very issue MLB faces. These men are not drinking at work, they are drinking after work on premises. Security execs have put serious time and effort into policies for alcohol-on-premises events, like Holiday Parties etc.
So overall, the point is not that they shouldn't ban booze, rather that by banning booze--I'm not here to make that judgment. The point is that despite their wrapping it in preventing another drunk driving death, MLB has actually done little to reduce the risk of that and may have even increased the risk of it.
jayh, mlb banning booze at work, or trying to prevent people from stealing babies.. both seem the furthest thing from useless. they seem more like common sense.
mlb banning booze costs them nothing and i would think makes it less likely they get sued? it's hard to see how revenues could accrue from their allowing employees to drink at work. can you tell me how that would be useless or costly.
buying a bracelet system, not sure what that costs but worth it to every parent i know.
i don't see how either is doing something just to do something. they both seem rational, helpful, even obvious, definitely clearly justified to me, anyway.
who and what determines if they are justified? my guess is MLB, and each parent. if you wanted to have people drink at your work, and if wanted to find a hospital that didn't spend money to prevent abduction i'm sure you could.
@peri re: Odds of dying 1 in 1 (100%)
That means they assume that each person will die at some point.
Well said Bruce - and I'm saying that as somebody who's been part of the Virginia Tech community for the last 2 decades. I haven't seen anybody else writing about how things are actually going here, so I'll add my two cents..
"You're right, so right. But how do we tell people? It's very difficult to tell someone who is grieving the death of a loved one that they are overreacting."
The next day, we had a convocation on campus, and everybody from George Bush on down had something to day (most of it not very memorable). Fortunately for all of us here, Nikki Giovanni said exactly the right thing next day:
'We Are Virginia Tech" has been the galvanizing meme here ever since. Nikki Giovanni said it, and the Hokie Nation agrees - we're not going to let this be a show-stopper - we're better than that.
One other point that seems to be getting lost is that human beings aren't good at rigorously applying the risk in an "activity" depends on both the probability at the individual event and the number of times it's repeated. Baby bracelets are probably a bad example because they're relatively cheap and parents will pay large amounts at that point, but supposing you were really cash constrained and could pay for either a baby monitor or an expensive-because-it's-good baby-cradle--car anchor mechanism? The argument is that, whilst if it were to happen, getting your baby stolen is devastating and has a suitable "narrative" to it, it's incredibly rare and is only possible over a very small time interval. You're going to spend at least an order of magnitude more hours driving around (and your "driving skill" can only compensate for what others will do up to a point), so the overall risk of loss of your child is much higher.
I don't think Bruce is against (in this hypothetical situation) people spending money on both the baby bracelet and the car car cradle, but the situation where people are eager to pay for a top of the range baby-bracelet but feel so "intuitively comfortable" with their cars that they discount any risk there and don't bother much about baby cradle anchors. In the terrorism instance, are low-level security people already being paid at a level that optimises their cost-"awareness" value? If you don't believe so, then then there's definitely a question whether the money for highly touted "exciting, cutting-edge" things like data-mining for terror networks is being deployed to best use? It may be, but the "boring, commonplace issue" of whether low-level security people are performing poorly has to be analysed as well as the "exciting computer stuff".
Bruce, the modern definition of 'news': Now for Entertainment, Weather, and Sports.
> Zigzag Walker - Odds of dying 100%
I have to take issue with that chart.
If you add up the probabilities for all those ways of dying, they only total up to 41.7%. I.e., there is a 58.3% chance of dying from something not found on the list. What is it? Considering that the biggest killers _are_ represented, what else could possibly be missing that would account for ... checks US mortality rates ... 1.44 million deaths each and every year.
Maybe this chart is more useful: http://en.wikipedia.org/wiki/...
The British academic risk researcher Prof. John Adams wrote an insightful essay on this topic called "What Kills You Matters -- Not Numbers." It can be found at
He notes that much of what determines our reaction to a given risk relates to the level of control over that risk, and the motivations of those imposing the risk. Road accidents kill far more people than terrorism, but individual drivers have far more control over the risk they face from motoring than they do from terrorism (you can choose to drive cautiously or dangerously, within certain limits), and other motorists are generally assumed to be not openly malign in the risks they impose (that is, they aren't out to get you, even though they might).
Those who appreciate Bruce Schneier's work might also appreciate Adams', especially his book "Risk."
> buying a bracelet system, not sure what that costs but worth it to every parent i know. [Ted]
Ted, you really still are missing the heart of Bruce's thesis. Your emotional reaction to this example is just that: emotional. No matter what the cost, the bracelet system is visible security and therefore worth any cost. To you it is worth it even if it diverts resources from SIDS research or diverts nurses' attention from patients in need. You see it as valuable because it is visible and solves a rare but emotionally laden problem.
Unfortunately interest groups, media and political pressures will pressure administrators into making these decisions based on the same emotional response, ultimately creating a system with poorer performance, whether it be hospital security or preventing terrorism. It is hard for that administrator to argue that $5m spent on SIDS research may save 10,000 lives per year, while $5m spent on bracelets may save 1 baby every 3 years, because research (and other 'hard' national security activities like intelligence gathering) don't make the front page of the newspaper, don't create an emotional response and don't have clear predicable outcomes.
@Mark7 - setting aside the numerous canards which you sprinkle through your "explanation" and the assumption that there is a direct correlation between what's going on in Iraq and what has taken place in Iran and North Korea (an assumption without foundation in fact), your "argument" assumes that all of the "return" on the "investment" in Iraq is, or should be, immediate. You therefore conclude that the cost far outweighs the risk which it was designed to mitigate.
Mitigation of risk often does not return immediate benefits and may appear to be far too expensive for the "return" you received. However, mitigation is often designed to reap long term benefits not short term. Far too many business managers do not understand this and consequently refuse to invest in "expensive" mitigation that would benefit them greatly in the long term.
If, for example, Iraq becomes a stable democracy, the long term benefits could far outweigh the immediate costs to the US. In fact, there is historical precedent for just such an outcome; Germany and Japan after WWII. We are only recently reaping the benefits of those "investments", "investments" whose cost, in real, constant dollars and percentage of GDP, far outweigh what the US has "invested" in Iraq. Japan is now one of our strongest allies, and Germany, despite what you read in the press, is as well.
"claiming that the fact there were no new terrorist attacks since 9/11 was proof that his policies were working"
The anthrax sent through the mail is now not considered a terrorist attack? Richard Reid ("shoe bomb") was on a US plane. The Egyptian who shot people at the El Al ticket counter at LAX? Beltway sniper attacks? Mohammed Reza Taheri-azar hit and wounded people with his car to "avenge the deaths of Muslims worldwide", and Omeed Aziz Popal also ran over people in what some allege was also a terrorist attack.
@Colossal Squid "Source for your figures please, Antimedia. A reputable one."
I'm not sure how you decide what defines a reputable source, but the 8331 figure is from this site: http://www.thereligionofpeace.com/ - which has been tracking worldwide terrorist attacks (reported in the international media) since 9/11.
Their standard for reporting is explained here - http://www.thereligionofpeace.com/Pages/...
The US' National Counterterrorism Office estimates 8,016 attacks which resulted in at least one fatality and 14,618 terrorism-related fatalities for 2005 alone - http://av.rds.yahoo.com/... so the ROP site is far more conservative.
The figure of 64,000 dead is an estimate based upon an average of 8 dead per attack, which is (I believe) a reasonable estimate based upon the conservative ROP figures.
The State Dept's annual report lists (http://www.state.gov/s/ct/rls/crt/2006/82739.htm) 14,618 dead in 2005 and 20,498 dead in 2006, and their figures do not include Iraq or Afghanistan.
"Ted, you really still are missing the heart of Bruce's thesis. Your emotional reaction to this example is just that: emotional. No matter what the cost, the bracelet system is visible security and therefore worth any cost."
ari is security that's visible always worthly of derision? is security that has any beneficial emotional value necessarily pointless? if someone said, Ted you can pay an extra $10,000 for an armed guard for your kid I can assure you I would pass. From there does not follow, for me, that any spending at all to make us safe that also makes us feel safe is clearly absurd.
(i only keep with the baby bracelets for discussion)
Do you know how much the bracelet system costs? I don't. It's not fort knox though, it's just little cheap plastic bracelets that identify our babies. if they added more than 5 bucks to the multi thousand dollar bill of having a kid I would be surprised.
i never said it would be worth it at any cost. instead i think that it's probably very cheap compared to the staff and equipment at a modern childbirth center, and that the idea of using a little technology to protect babies doesn't strike me as obviously reckless, stupid and maudlin as it does others.
"It is hard for that administrator to argue that $5m spent on SIDS research may save 10,000 lives per year, while $5m spent on bracelets may save 1 baby every 3 years"
Why do you think these bracelets cost $5M? I don't see any costs in Bruce's post
Can't find easily on the internet how much such a system costs a hospital.
(other examples like the mlb one have nothing to do with costs it seems to me)
Would it be worth it at a price of $10? 500K? When you say any money spent on preventing abductions would likely cost us 10,000 deaths in a year because those funds were not spend on SIDS research does that sound likely to you? how much is spent on sids now? do you know? i don't.
instead of sids can we say cancer, dentistry, vitamins, whatever, is that just a proxy for, must be some better way to spend our money that people are too stupid to see they should want?
The whole population of the town I live in, dead in a year all because we bought those little pink and blue bracelets, what were we thinking.
I think the idea is, make a list of everything anyone does to protect them and theirs, and then force rank by which ones solve an emotional need, and be critical of those regardless of whether or not they make sense.
Because what I suspect is that you a) don't know the cost of the bracelets and b) I don't think you know what the money spent on bracelets should go to.
it's just a preference for the counterintuitive, to me, if people can see the security and it makes them feel any better, then it must be pointless and not sufficiently numbers-driven spending. That is patently true some of time but not nearly as often in my opinion as is assumed here. The guys with the machine guns in the airport.. that i can see is theater, baby bracelets.. that spending to me is as extravagant and pointless as eyeglasses.
Hi Bruce & others
(I haven't read all the comments here so sorry if some of this has been said already, but here is my reaction to Bruce's article. I'm writing from Australia, btw.)
I'm not sure I agree with your logic there. Specifically I'm not sure that just because there is very little chance that I or my children (assuming I were American) will get shot by a nutcase at an educational institution, means that the fact that this has happened is not alarming & is not a potential reason to make a change. I realise you have not necessarily ruled out trying to change things, but to me your general tone is on the defeatist side. I.e., we'll never stop lunatics running round killing people. There are other ways to look at the Virginia incident, &, from the overseas perspective, one that occurs is to ask how often such an incident happens in countries with tighter gun control. Comparing to 9/11 - yes, I agree there was an over-reaction, *because* the reaction had negative consequences. But if you "over-react" to something negative, reduce its likelihood in the future, with no negative consequences, to me this is a positive thing, irrespective of how rarely it happens. So, e.g., I wouldn't equate tightening gun control with invading Iraq, which is essentially what you are doing.
Just fuel for thought. Interesting article.
An a propos story (assuming no distortions):
A parish (ie, extremely local UK) council has installed CCTV cameras which the top-level policeman responsible for the area belives are unwarranted based on the actual levels of crime level (given the cost and civil liberties trade-offs). Now it could be that the council just assigns different values to the various elements of the trade-off and has actually analysed the numbers in the light of those different priorities, reaching their conclusion. Or it might be "There was a break in at the church, and at X's house over the last couple of months. We can find money from somewhere in the budget, so let's put some cameras up." (ie, no detailled analysis of the relative risk reduction compared to, eg, traffic calming measures, better streetlighting, etc). Given that the people who get elected to goverment tend to be "people-people" rather than "details-people", I'm inclined toward the latter.
Show me a house-broken shark & i'll stop worrying about shark attacks!
"Sharks are more dangerous than dogs, yes, but we're far more likely to encounter dogs than sharks."
If that's the case then doesn't that justify our fear of a shark attack? E.g. If there are 100,000 encounters with dogs resulting in 10 deaths (.0001%) and there are 20 encounters with sharks resulting in 2 deaths (10%), which one is more likely? Which has more 'risk'?
Is it really overreaction when the risk of death from a shark encounter is far greater than death from a dog encounter? I think that is why this type of reasoning is flawed and shouldn't really be used to support this type of argument.
Thank you for a cogent and well thought-out analysis of the issue at hand. As a student of behavioral decision making, I see irrational decisions made on a regular (and unfortunately, in many cases, predictable) basis. And as you alluded to, the reactions to these can often lead to ridiculous policies and unproductive debate over preventing the effects, not the causes. However, there is something so human about these errors that seems to be impossible to overcome. The real next frontier, in my opinion, is to understand these biases better, and to use them (perhaps through policy) to aid in productive, positive decision making.
@Bruce Schneier>...my 42nd essay on that site.
So Bruce, is your 42nd essay the answer to "life, the universe, everything.." ? ;-)
ref: Hitchhiker's guide...by Douglas Adams
"Bruce's comments bear directly on the issue of gun ownership. Gun owners claim their guns will keep them safe from such rare threats as random home invasion, yet they insist that their personal practices mean that they are not much more likely to suffer gun injuries by owning a gun. http://tinyurl.com/2evb4u The truth is that while gun ownership is certainly a Second Amendment right, it's not one that makes the owner safer."
This is the same old tired anti-gun BS that they keep trotting out year after year. I will counter with another link from a source that is also biased on this issue. Read both and draw your own conclusions.
There are 5 things all crime has in common. By addresses those 5 key elements ALL types of crime can be prevented or stopped in progress.
I have a full description on my blog plus more details on the system I use to find these 5 elements. http://www.markproffitt.com
I'ld like to start off thanking you for the thought provoking views on security and cryptography. I own a copy of your Applied Crypto and have been a long time subscriber to Crypto-Gram.
I wanted to comment on this months Crypto-Gram article on over-reaction to the VA-tech shootings. I whole heartedly agree with you about individual and societal over-reaction to low probability risks while being immune to the real risks we face everyday. I realize that your articles main point is on this over-reaction, but I still felt that something was missing. As you discuss statistics showing the cockeyed reactions to risks, I couldn't help but think of how those statistics change.
Thirty years ago, school shootings were not even a statistic (or at least the media did a good job of hiding such things from the public, needed to add that since I am most certainly not an expert in the field and have to rely mostly on the media as my source of info). Now school shootings are a statistic, and they seem to be a rising statistic.
Terrorism may also fall into that rising statistic category, or at least terrorism on US soil.
I agree we see this over-reaction, we have become a risk averse society, but mostly averse to the risks that get popular attention rather than the real risks. But I think it only fair that while certain risks like school shootings and US terrorism are very low probability, they are rising. I don't think the rise in these risk categories warrants a lot of the FUD we have seen, nor the lose of liberties (won by the price of the blood of patriots) we as a society have been so willing to sacrifice on the altar of safety and security. But this rise in these risk categories should cause us pause to think of real ways of reversing the trend.
A little over 100 years ago, man could not fly, so the fear of crashing in a plane did not exist. As this industry developed, there were mishaps, and the fears of plane crashes were born. Thankfully these fears did not stop the pioneers, and blessedly the media did not have the wide spread ability to popularize every little mishap within the industry. But, the reality of a rising statistic of people being injured or killed falling from the sky led to real concerns about flying safety and led to better designs, more rigid testing, and accountability. This has led to flying being one of the safest rapid transit methods available.
I don't have the answers of how to reverse the trends in school shootings and US terrorism. I wish that I did. But I guess my concern is in the focus on the hysteria of popular risk without mention of the real concern we should have in trying to stop these rising statistics with real measures and not momma-pleaser eye-candy security. I don't know, maybe there is no answer to reversing these recent trends and if we can't reverse these trends, then these issues may become cause for real fear rather than just concern.
I think the sadder answer may be that there are real answers to these issues but because they take time and much effort to implement our short sighted society doesn't want these real fixes but would rather have their ears tickled with immediate sound bites that don't have any real bearing on solving anything.
Once again, thank you for your well reasoned thoughts in the areas of security, especially in these post 911 hysterical driven days. I lost 1 distant relative in the towers( a firefighter), and a distant friend couple to United 93, so I have a vested interest in protecting our nation from terrorism. It is so refreshing to read Crypto-Gram to hear someone with the guts to challenge what is happening and not challenge it just to be sensationalistic, but to challenge it based on intelligence. I wish more people in positions of authority would listen to the voice of reason rather than just trying to please the masses.
The horrendous event at Virginia Tech has ramifications in many dimensions. Though not intending to reduce the personal impacts felt by many, I believe actions that might prevent similar events could take a lead from the IT environment. Within that environment substantial research and development and purchase of software packages is directed towards minimising the impact of malicious software. Such software might be a virus or a hidden application making a PC a member of a BOT net. As it is so difficult to inhibit the actions of those who develop and release such malicious software, actions are directed towards constraining the impact of that software, and not at those ultimately responsible. Within the US, the constitution and various laws ensure that the equivalent of malicious software is allowed to exist within every home – guns. I am writing from Australia – however I have had some time in the US. During one work related sojourn to a Lockheed Martin campus, I discussed gun ownership with a US citizen colleague. At the bottom of many circular discussions came the realisation that gun ownership is primarily to protect the owner from other citizens of the US. Like the virus on my computer, the gun poisons it’s owner, enhancing the potential impact of irrational behaviour that can strike any citizen at any time. Like in Iraq, “me and my gun can correct any perceived problems��?.
Bruce, your "Rare Risk and Overreactions" piece was excellent and right on target. I think it is worth pointing out, though, that there are crucial differences between worrying about (and thus overreacting) to improbable events, and not being prepared for them, or taking modest measures to prevent them.
Right now, where I live (in New York's Hudson Valley), the newspapers are whipping people into a frenzy because a large black bear has been ambling around peoples' yards and munching on their potted plants. Parents are being urged to meet their kids at the bus stop and escort them home. Unless cornered or harassed, the bear is very likely to be harmless to people. Still, there have been a few incidents not too far away in recent years of black bears injuring people and even dragging a young child from his home porch and killing him. But black bear attacks are probably about as rare as shark attacks. Yet when camping with our Boy Scout troop, we think about bears, and store our food and trash in ways so as not to attract them. Why? Call it cheap insurance. The cost is de minimus, and the potential benefits are great.
I have always kept a set of jumper cables in my vehicles. In the hundreds of thousands of miles I have driven over the years, I have never had a dead car battery while on the road. In fact, I've only used the cables to start others' cars when they didn't have cables. I also keep a tow cable, tool kit, fire extinguisher, road flares, a first aid kit, and other emergency gear in my trunk that I rarely (if ever) need. Why? Again, cheap insurance. The benefit to keeping this gear on hand far outweighs the costs, which are a modest cash investment, the loss of some cargo space, and a slight loss in fuel economy from the added weight. These are costs I'm happy to pay for the peace of mind that comes with it.
And just like the jumper cables, keeping a gun for personal safety (and being trained in its use) is another form of cheap insurance. That's why the calls for allowing college students who are licensed to carry guns to bring them on to campus is a bit different from some of the other security theater you cite. By all accounts, these students are carrying their guns safely and lawfully everywhere but campus. By establishing gun free zones, rampages and other acts of violence are facilitated. In fact, the absurdly rare occurrence is the misuse of such licensed guns on campus, which makes the campus gun bans part of security theater, and not the calls to let students bring their guns on campus.
Obviously, the focus should be on dealing with likely events, and not on the statistical outliers. But taking modest precautions, such as not keeping food in your tent when camping, keeping emergency gear in your trunk, or keeping a gun handy and knowing how to use it, all fall into the cheap insurance category. Like the saying goes, "I'd rather have it than not need it, than need it and not have it."
Keep up the great work.
I agree whole heartedly with what you have to say. Everyone is always looking for someone to blame, that is for sure. But, I found a lot of it to be egocentric. Rather than being about the people it happened to, they are concerned about themselves, as if they are the only ones important to the issue, even though it has/had absolutely nothing to do with it. I find this "curious" to say the least.
If it didn't happen to you, it's not about you but, people tend to grind it from a fantasy to a reality that it is about "them," and become offended when you tell them it is not. The reason I find it curious is, why do they suddenly think they are the important ones in the scheme of things? What makes them think they are more important than anyone else, including the "true" victims? I have seen this over, and over again. In my eyes, it has only produced contempt, and ennui!
I know it's an old entry, but I read it again today to check something and I was surprised to see you say school shootings are rare. There are more and more common, as this list proves it:
Still loves the topic and, as usual, the way you explain ideas and concept :)
I once came across a Latin quotation which seems to pre-figure the politician's syllogism. The thrust of it was that men think that merely by re-arranging things they will improve them.
Does anyone know the quotation?
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.