Schneier on Security

Clive Robinson • June 10, 2010 12:06 PM

@ Doug (DCFusor),

“Cash pay on the day for casual labour”

Used to be a way of life long before and long after the Great Depression.

However the Gov didn’t think they where getting their due in the 60’s and started killing it off.

Now in “these times of terror” you have to be on a Gov DB somewhere or you are a defacto terrorist…

Somebody I used to know years ago only had their 1940’s army pay book as identity and spent their life walking from farm to fam working for as little as a good meal and a barn to sleep in.

Their reason for living the way they did was what we would call PTSD these days. They got chewed up both physicaly and mentaly by what they had witnesed.

Where they a bad person, I’d of said not but it did not stop some police officers trying to turn them into a criminal.

Everybody is different and we all get a bad throw of the dice in our lives at some point what happens is often the equivalent of another throw of the dice, and the community you live in.

A lot of people don’t want charity but as you say cann’t for whatever reason behave in the Moaist manner that the Gov appears to require of citizens and the choice is often stark.

A simple hand to give a days pay is often all they need, it ain’t charity it’s community.

I know quoting Islamic words of wisdom etc is not a popular activity these days, but they have an ethos of not alowing their neighbour to starve if they can help them to help themselves.

Call it what people will but it used to be the glue that bound all societies together. And we have lost it at our cost as society decohears around us.

Clive Robinson. • June 11, 2010 4:47 AM

Many people appear to be almost deliberatly missing the point about time since offence, and further the real value of the offence (not what LEA’s claim to justify various things).

If somebody did something in their teens or some time ago the question has to be asked why have they not gone on to commit a crime since?

There are several answers to this question one being the opposite of @Kathy Ro’s question,

“Oh and speaking of that “talent”: just how talented is a hacker who got caught?”

Potentialy the answer is they have smartened up and are not making mistakes by which they can be identified.

However C.V.’s are actually not that difficult to check against various online DB’s of companies and credit histories etc just time consuming (and yes you have a duty of care to the share holders to make adequate checks).

Conversly setting up a false ID with a an adiquate supportable history is not that easy, it costs time and effort as well as money (currently about 1000 in any major currency to get the documents to start from).

Now I know people “over egg” their C.V.’s but they shouldn’t as it is in many jurisdictions a criminal offence (ostensibly fraud). And again in most places an employer can summarily dismis an employee when such is found on the employees C.V. (however using a false ID is in most juresdictions not a crime unless it is to gain some advantage).

The question then arises at what point need a prospective employee not mention a conviction?

This varies from jurisdiction to jurisdiction and on the type of crime/offence (tort / criminal / misdemeanor / etc). Then again depending on how they are employed they may not have to mention it at all (ie an employee of a sub-contractor).

Thus an organization should actually consider what their highring policy is and how they imdemnify themselves against the risk of employing people either directly or indirectly (ie externalise the risk onto others via sub-contracting etc).

This should not just be to their shareholders, or their insurers, but also to the consumers of their services.

However this needs to be tempered against the “common good” as others have pointed out a criminal that has no oportunity has no choice but to remain a criminal and thus a burden on society either directly through taxation or indirectly through insurance.

As I have said people sometimes need a hand to get back on their feet from time to time and importantly it is up to the employer how much trust they chose to give an employee and when.

However if you say “I will as a mater of policy discriminate against people for reason X” you cannot realisticaly be offended if others discriminate against you for whatever reason Y they happen to chose.

Also there is another point my father made to me when I was young and had done something that was inadvisable,

“If you have the brains to commit the perfect crime, you have the brains to earn more money honestly”.

It is the question of “value” of an action be it illegal or not.

The point being “one off crime” does not pay sufficient to last you a life, large value crimes attract a lot of scrutiny not just from the authorities but the insurers and others such as other criminals and the realisable gain is thus disproportionately small (“two cents on the dollar”).

Thus you have to become a career criminal with all the risks that entails to even hope to make crime pay.

The only difference between then and now is the force multiplier and zero cost action at a distance of the information world and it’s potential for white collar crime. That is you can now commit hundreds if not thousands of low value crimes in many many jurisdictions outside of your own. Thus hope you stay under the radar of LEO lower limit on crime value (ie it is not proportionate to invest 100USD of LEO resources for a 25USD crime with no obvious conviction potential from the outset).

Now as a potential employer the real value of a persons crime needs to be considered not the faux value that prosecutors use for political reasons.

There is actually two asspects to this, one is to judge what the crime may have been about, the second a ready reconer for “stock loss”.

Many many retail employers know that a small percentage of their employees may be, or are dishonest (as are their customers). The costs attributed to such low value crime is often called “stock loss”.

However as with LEA’s there is a threshold at which it crosses from being an annoying “cost of business” to something that has to be dealt with.

Thus there is an acceptance of what level of dishonesty is acceptable or not within any given business model an organisation uses.

Which leads you onto the “shoveling snow” point made by @ Russel Coker.

However it has another side, if a person is in a position of trust what value can they obtain by abusing that trust, or more correctly what level of harm can they cause to the organisation.

In many cases this might actually be less than the amount you pay them in a relativly short period of time thus there may be no incentive for them to betray the trust you put in them.

So it may be perfectly acceptable to employ a criminal because you either do not place trust in them or the gain they can make by breaching that trust is to small in comparison to just “doing the job” honestly.

There will always be exceptions but as with “stock loss” it’s part and parcel of the cost of doing business.