Schneier on Security

Ward S. Denker • September 11, 2009 2:47 PM

I tend to disagree with the premise that regulation should play a bigger role in security. I think that would be a disaster because it would increase the cost of IT and not actually improve security by a whole lot.

I think the reason that automobiles have security and safety features because people want them, not because the government mandates them. We want locks on the doors and air bags because the idea of dying in a car accident is not a pleasant one.

We could discuss the merit of regulation all day, but I see the problem as a fundamental flaw of regulation to begin with. Regulation, like everything, is subject to the law of unintended consequences. Because we often make regulation where we feel people are not risk averse enough. Laws themselves, because of perverse incentives, create other problems which are even more invisible and difficult to gauge the risk of. This leads to further regulation and further unintended consequences and, therefore, even more difficult-to-understand risks.

I think that, eventually, the risks become so esoteric and the downsides of regulation so invisible that “progress” in regulation becomes difficult to attain because too much expertise is required to navigate the entire legal structure and the risks are so much a product of the system that created them. This makes new regulation a tough sell, because the people who made it to begin with can’t understand the issues enough to explain them and those of us who listen to the explanations are confused, skeptical, mislead by widespread disinformation campaigns, or simply not well-versed enough in the subject matter to buy into the solutions proposed.

This, eventually, leads to apathy until the problem becomes too big to ignore. A huge, much-debated example of this is health care. I think it’s exceedingly clear that much of the problems that sector faces are actually artifacts of regulation – unintended consequences of otherwise well-intentioned regulation. Certainly a lot of the laws are well-meaning, but some of them don’t even meet that standard (if a specific corporation or lobbying effort is for the legislation one must be wary because it’s almost certain to benefit them to the detriment of everyone else). Worse yet, the eventual outcome is a major power grab by government itself. The mess gets so big and people so sick of it that they allow themselves to become convinced that it would all be better off if the control were centralized, which leads to its own set of unintended consequences.

This spiral of regulation leading to unintended consequences leading to further regulation leading to public apathy until it gets to be such a huge problem that it can’t be ignored any more, leading to the eventual massive power grab is difficult for the common mind to grasp, let alone be convinced of without appearing to have ulterior motives. It’s like akin to asking a layperson to provide advice in a match between two masters of chess – both of whom have mastered a level of thinking out layer upon layer of moves and counter-moves ahead of their opponent that few of us can imagine, let alone possess. The layperson can’t even make an informed decision as to who will win the match based on understanding, so they resort to statistics, intuition, or even to appeals to their emotion instead.

We could break this cycle which kills entire industries and cripples our economy by stopping it when it’s small and saying no to the beginnings of the regulatory nightmare. No matter how well-intentioned we are, we can’t provide any insight to the masters of the game, and it’s high time that we admit it and let the market decide who wins and who loses.

Ward S. Denker • September 11, 2009 3:17 PM

Sorry, but this Utopian view

This is the kind of statement that ends conversations (or starts their decline into insults/derails/etc.) fast. Avoid this language, because it’s clearly not a dismissal based upon facts or logic but rather your personal, emotional attachment to your political worldview.

innate goodness of corporations

This is not a position being advanced by anything I said at all. My point, since you seem to have missed it, is that economics isn’t easy to understand. We can only pretend that there are no unintended consequences to regulation. One of the very few times in history where we, collectively, were smart enough to realize a massive mistake created by a lack of foresight and correct it was prohibition. It was repealed only after some pretty significant damage was done to our society and a lot of crime and violence were created.

Why is it that we allow ourselves to become so blind to the downsides of our ideological positions, especially when our positions are based upon a desire to do good? Good intentions can have VERY bad outcomes, and most regulation comes from good intentions. Unfortunately, the beast which is our massive federal government rarely admits error, incompetence, or defeat to better judgement. It would rather blunder on, growing more powerful and more damaging to everything around it. Is this what we really want?

All of this talk of “level[ing] the playing field” is enablement, nothing more. It’s the moral equivalent of a wife allowing a husband to continue to beat her because at least he works to support the household and the beatings just aren’t that severe in retrospect. I, for one, reject political Stockholm syndrome.

Remember that everything you advocate under the leadership of your favorite political party will be meddled with, perverted, twisted or destroyed by your political foes when they come into power. One must think pragmatically and think ahead and not with their emotions. We have to, sooner or later, admit there are certain ends which no amount of regulation will ever accomplish, no amount of tax dollars will ever solve.

Ward S. Denker • September 18, 2009 10:49 AM

You’re a good enough writer – you could have found a better way to argue your point here.

Thank you for the compliment. I’ve learned that it’s best to not waste words on ideologues who simply won’t pay attention to what has already been said. It’s a Sisyphean effort – any progress made ends up at the bottom of the hill again anyway. It’s just too damned hard to argue against deeply-ingrained prejudices.

What would this system that purports to protect against fraud in the the big pharma world look like?

I think this is all a matter of goals. Let’s say that our goal is to reduce fraud and still allow the market to be agile enough that it can deliver drugs without the mountain of added costs added by bureaucratic process. Why can’t a system like the FDA be well-funded at hiring medical professionals, chemists, biologists, etc. to investigate the claims made by drug manufacturers and only have the power to step in when there’s considerable evidence that a drug is harming more people than it’s helping? If its goal is mostly advisory and is relatively toothless when it comes to enforcement, it won’t be as susceptible to the kind of political games-playing it currently experiences.

With such a re-focus, it would be more difficult for companies to use the FDA to harm their competition through traditional corruption mechanisms (bribery, inside men, etc.) since the FDA wouldn’t have the power to do anything about it. That power should probably be reserved by Congress anyway – and their votes for or against legislation are public. Take the CDC as an example of a relatively toothless organization, as far as enforcement is concerned (it takes a lot for them to be able to wield their power to call for quarantines), but they’re definitely an excellent advisory body.

• I’ve actually developed and implemented fairly secure software systems. It can be done when the incentives are there (in our case, it was HIPAA)

I, too, have had experience developing software under the nightmare of regulation that is HIPAA. One organization I worked for pretty much only existed because of that legislation, and that makes it a pretty clear drain on the system. If legislation actually creates new businesses just to deal with the complexity added by the legislation, something was probably done wrong.

What guarantees can you make that no security flaws exist within the systems you developed? I’ve developed systems for the criminal justice system, and I can’t say that I feel that the software itself is 100% free of security vulnerabilities, since the systems I developed relied upon other systems which I never possessed the source code for. I can make no claims that there aren’t subtle vulnerabilities in the code I wrote which can’t be exploited by a determined attacker, which is why a big part of the security provided to those systems was access control.

Don’t get me wrong, I do like the concept of using externalities to our advantage and I do agree that regulation could be used in this fashion. That takes some extremely smart people to accomplish, and I’m just not convinced that the people we elect to public office are up to that challenge (we don’t tend to elect literal geniuses because society prefers that such people be put to use propelling our science and technology sectors – for obvious reasons).

Ward S. Denker • September 19, 2009 12:17 AM

Likewise there are other drugs where the opposit would be true as in a “poison” that will eventualy kill you but prolong your life or improve your quality of life when you have a fatal condition (think certain cancer treatments for instance).

That’s actually the truth for just about all drugs. An awful lot of people aren’t aware that most of the over-the-counter pain medications can do some very serious damage to your liver (that’s why they list such long periods of time between doses and very explicit dose sizes – usually two tablets).

Sometimes people take a bottle of Tylenol to try and commit suicide, wake up the next morning wondering why it didn’t work.

A couple of weeks or so later they wake up orange as a pumpkin (severe jaundice) and by that time it’s too late, even though most of the time they’ve gotten over their suicidal urge.

I guess the measuring stick of harm vs. help is mostly between a doctor and a patient. There are drugs which would shorten one’s life, but which would improve the quality of that life immeasurably. I think that people should be able to discuss risks like this with their doctor and still take drugs which harm them, so long as they understand what it is they’re doing and their doctor agrees with the patient.