Schneier on Security
A blog covering security and security technology.
« The Withdrawal of the A5/2 Encryption Algorithm |
| Friday Squid Blogging: Studying Squid Hearing »
November 26, 2010
Psychopaths and Security
I have been thinking a lot about security against psychopaths. Or, at least, how we have traditionally secured social systems against these sorts of people, and how we can secure our socio-technical systems against them. I don't know if I have any conclusions yet, only a short reading list.
EDITED TO ADD (12/12): Good article from 2001. The sociobiology of sociopathy. Psychopathic fraudsters and how they function in bureaucracies.
Posted on November 26, 2010 at 1:52 PM
• 52 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
On the other hand, lower risk psychopaths can be very reliable at counterintelligence and pen testing. The fact that they just don't give a damn is very useful. They have to be carefully monitored and controlled, though, for rather obvious reasons. Its also advantageous to ensure the psychopath has a personality that lowers their risk, esp. regarding destructive behavior.
Isn't it easier to provide security against a psychopath than against an idealistic moron? Unlike the latter his/her actions are at least rational.
Well, the fact that MI6 did a study which concluded that you can't profile against propensity to commit acts of terrorism, made it to the popular press - it would be interesting to do a "compare and contrast" with this.
While I'm no psychologist, I suspect it boils down to "are psychopaths born, or made, potentially in adulthood"?
@ISO "actions are at least rational."
If by rational you mean predictable not necessarily. AND you have to know the basis of his decision making. What is his cause belle?
Even the choices of the sane is not traceable back to motivation without a lot of analysis that most of us never choose to undergo. Why is that?
Game theory might suggest that psychopaths are still rational actors and that they will choose that action that benefits them regardless of the cost to them. So, in theory we should be able to model psychopath behavior and associated threat.
Steve and Bruce, this has been a serious discussion among many of my friends, ranging from psychologists to doctors to sociologists. Among topics we discuss is the appeal of certain activities that will attract a disproportionately higher number of sociopaths and psychopaths than the average percentages normally found in society.
It is estimated that at any given time, at least 8 - 10% of our population are sociopaths. One of my thoughts was that given the physical violence in a sport such as football, you could make the assumption that the game would probably attract a higher proportion of sociopaths and psychopaths. Legalized violence? A godsend!
That said, the Internet would surely also have a high appeal based on several factors which would certainly include a false sense of "anonymity," the ability to stir up large crowds quickly (manipulation and control), as well as new avenues of access to all kinds of supposedly secure data. A psychopath's delight.
Which leads me to one of my current pet theories: Is it that far a cry to assume that Julian Assange and his Wikileaks is a clear example of socio/pyschopathic behavior? He exhibits absolutely no remorse in any of the potential consequences of his actions and his arguments always seem to draw a narcissistic response rather than any serious rationale for doing what he does. Would love to see more discussion and examples on such issues in the security community. I'm sure the FBI and the other alphabets already have some profiling done on such subjects and people.
RobertinSeattle and others seem to want to not talk about a fact well-known among psychologists, but apparently not to the public at large: that despite the media's stereotype, sociopathy is alive and well among positions of power in this country - think megabank executives and politicians. It's hilarious to see Robert finger Assange given the more plainly obvious sociopathy that goes on regularly among just the two groups I just mentioned. (Consider for example the well-documented starvation that happened in many nations in 2008 thanks to agriculture commodities speculation by bankers.) We would do well as a society to figure out a way to keep sociopaths from these positions of power.
What sort of vulnerability do you think exists in our social or socio-technical systems that makes them vulnerable to psychopaths in ways that they aren't vulnerable to any other random person who wants to break them?
That is a truly excellent article.
"how we have traditionally secured social systems against these sorts of people, and how we can secure our socio-technical systems against them."
do you mean thieves and violent criminals? because there's no such thing as a psychopath.
"because there's no such thing as a psychopath"
Sure there are. Psychiatrists just use a different term. Borrowing from another writer's style, a psychopath by any other name would be just as dangerous.
People are exhibiting a lack of precision when they equate a "psychopath" and a "sociopath".
Technically, a psychopath is someone suffering from a major mental disorder, generally a psychotic one characterized by gross distortions in reality testing or disorganized thought process.
A sociopath is more vaguely defined, with most agreeing that a required characteristic is a lack of remorse for actions which hurt other people and any willingness to change those actions.
A psychopath may be a sociopath, but most sociopaths are not psychopaths. In fact, psychopaths (those suffering from a major mental disorder) are poor sociopaths because major mental disorders tend to reduce the ability to perform sociopathic actions.
The distinction is important because the highly successful sociopaths do not display any evidence of major mental illness. They look and act perfectly normal except for the harmful behaviors they indulge in. Those who confuse the two are more easily caught off guard because they expect to observe signs of a mental disorder in a sociopath, which are usually not present.
You need to realise that as with autism there is a sociopath spectrum that covers 5-15% (depending on your values markers) of the population (by the way the term sociopath is less used in Europe).
Importantly those that suffer autism appear to stit on one tail of the bell curve and those that have sociopath tendencies sit on the other tail of the bell curve.
Now you have both high functioning autistics and high functioning sociopaths both are very much needed by society (that is society as we currently know it would not exist). The sociopaths are very goal orientated with human activities (business leaders) and the autistics tend to be goal focused with non human or technical issues (engineers). Which makes them almost symbiotically dependent on each other to function within the more general society.
The bulk of the population(80%) tend to be in the middle of the bell curve but are generaly not high functioning and tend to be the "sheeple".
Which suggest that the ability to be high functioning may be an integral part of both the autistic and sociopath spectrums.
The fact that those with high fuctioning autism can train them selves to be good at business in a mechanistic way well beyond the comprehension of non high function persons gives rise to a philosophical debate as to if there is some mechanism that predicates high function but that has a "handedness" component of autism or sociopath.
Those who grace the corridors of academia know of the "Bursur gone despot" syndrome. I've jokingly heard it refered to as "switch to the dark side". What happens is a not so good academic rises not on their research or teaching skills but develops political and business skills and often ends up turning against the academics in a power grab which usually results in more and more money being diverted away form core academic activities (research & teaching) into other activities.
Thus students see rising tuition costs and tutors and researchers see falling funding, and the institution sees rising numbers of "administrators and their ilk" in their midst telling them what they must do not only in terms of direction of core activities but in what happens to the proceads of such activities.
It has got to the point now in some institutions that any original thought by either staff or student automaticaly become the property of the institution, and in some places academics are finding that their research results are being censured for the "commercial reasons" of sponsors...
"Technically, a psychopath is someone suffering from a major mental disorder, generally a psychotic one characterized by gross distortions in reality testing or disorganized thought process."
There is *no* consensus on this point. You say it like it's a standard definition, when it couldn't be further from that.
As a supposed sociopath... we love you.
And r lying...
How can you say that a psychopath is threat? Who made a normal person psycho? What are reasons for a normal person to choose a psychopath? May be a normal person is pretending to be a psycho. He knows more than psychologists, probably, because of his know how of Psychology.
Intriguing. It seems like a sizeable number of people live in constant fear of socio/psycopaths (or 'mutants' as one of those links puts it). I can't help but suspect that the fear of such people does serious harm, just like terrorism.
Anyway good luck ousting those psychos from BT Mr Schneier :)
@Nick P, I'm pretty sure very few penetration testers feel guilty about helping a company in this manner. I certainly don't.
It's far from obvious to me that a sociopath, still less a psychopath, would be useful in a sporting team. However vicious they were, their self-centredness and deceit wouldn't be helpful at all. I can think of possible examples but they're all of failure, or at least of mediocrity achieved in the face of talent, rather than success.
I know that psychopaths don't exist because it's impossible for someone to be supremely charming and charismatic, emotionless, manipulative and intelligent, irresponsible, temperamental and violent. Those are incompatible traits. Humans aren't innately good, but we are innately similar; we're not a caste species that gives birth to pure evil subhumans. If people aren't innately good, then criminals don't have to be born bad, just raised badly.
As for "psychiatric consensus", these are the same people who presented Munchausen syndrome and satanic ritual abuse as scientific facts. If they don't understand something, they create a story to explain it. It doesn't have to be true or even make sense - it only has to be popular and comforting. In this case, they've stacked every evil, creepy thing they could think of into a medical diagnosis applied to people who piss you off. (That's what lovefraud.com is about - ex-spouses who are evil in every possible way, regardless of consistency.) I'm just pointing out that psychiatric consensus is worthless as evidence.
We love you, man. Step away from the ledge.
One significant problem with security against psychopaths could be that the smart ones not only know how to pretend no to be a psychopath, but also are smart in addition.
You do not need to worry about the dumb ones. They can only do limited harm, like mistaking fireworks for explosives and other pathetic engineering failures.
Yet for the smart ones, you also have to take into account, that they can predict the fallout from a crime and will not commit it if it looks disadvantageous.
So, maybe, there is no special need to protect against _crimes_ from psychopaths at all? The real problem seems to remove them from business and politics...
@Gweihir: That's exactly the point. You only need to prevent the smart ones from the crimes that do actually pay (or make sure that they don't pay anymore, which is easy in theory but hard in practice since the sociopaths are the ones who will have to decide on this).
But in politics the moralists do at least as much damage as the sociopaths - and on top of that *they* are usually completely irrational and unpredictable.
Stopping some one from doing politics is not solution of threat. Instead, the solution lies in understanding what make a normal person to choose psychopath. Millions effected as a result of a blunder and this effected their mentle health in some way. How many of those mentle people will be stopped? They are in million and their recovery will atleast take a generation...
RobertinSeattle, why do you confuse sadists with psychopaths in your (American or Aussie) football example?
The normal persons will easily choose a high functioning psychopath or sociopath over a "normal" individual for many reasons.
1) They don't know him/her enough to detect the problem
2) The psychopath have less problem to tell sweet lies than a "normal" individual
3) The psychopath is more confident, or able to project confidence, than a "normal" person. Others will reflexively react trusting the confident more than the not confident.
The only way to reduce the possibility and incentive for psychopaths to have power is to reduce the amount of power anyone can have. This imply a reduction of the power and the scope of the government. The thieves are attracted by a big vault full of treasures more than many little vault with little treasures.
Moralists can be psychopaths as much as not moralists. They are simply different types of psychopaths. Both will not feel any trouble if people suffer for their actions. They consider them justifiable anyway.
The first two links were interesting, the third was a little on the woo-side of things, and the last seemed to be run by a nutjob (who couldn't even get his facts right). Come on Bruce, you can do better than that, just because someone quotes you doesn't mean they are otherwise on the ball...
The direct link I had for this is now dead, but the article seems to survive in several forms:
It's focused on understanding the convergent origins of sociopathy, based on filling the evolutionary niche of antisocial behavior.
"The new research, however, examines what they have in abundance -- impulsivity, heightened attraction to rewards and risk taking."
People matching this characterization should be particularly easy to catch with honey-traps, and traps with bait that has actual value would be hard to resist even if they knew it was a trap (a real reward with nothing but a heightened risk in the way).
I was in the security team of a major IT vendor between 2000 and 2004, where I sat on the company's standards review council. At the same time, I was dealing with someone who was clearly a sociopath (specifically, Antisocial Personality Disorder with co-morbid Narcacistic Personality Disorder). In studying the ~1% to 5% of people who could not seem to comply with company policy, and having discussions with them about it, it was hard not to miss a lot of commonalities between them and the aforementioned sociopath.
It really isn't hard to figure out why. Sociopaths fundamentally feel that rules don't apply to them (exceptionalism), that everyone else is inferior (superiority), compulsively lie and self-aggrandize (fantasize), externalize responsibility for failure, and indulge in high-risk activities through most of their life. This couldn't be further from a responsible and compliant employee.
The problem is what to do about it. I don't have an answer there, but note that concern about "corporate psychopaths" is rising, primarily due to the damage such individuals cause others around them. It is also notable that some corporate psychopaths can be high-achievers, if their personal goals are aligned with the corporation's. Although that observation is, I personally believe, incomplete as the secondary cost of their success might be huge.
I haven't read thru all comments, but here's my understanding:
Psychopathy and sociopathy are very similar, but with a small semantic difference. The important thing is that they both share the important commonality of a reduced (or non-existent) ability to empathize with others. In other words, psychopaths don't care if you're hurt (even if they're hurting you). Normal people process others' pain with some level of emotion, whereas psychopaths process this information cognitively. There are other typical characteristics as well (such as impulsiveness) that are relatively common.
Some criminal psychopaths (or sociopaths) are violent, some are seemingly non-violent but nonetheless manipulative and hurtful in the non-physical sense. Behavior might be indicative of psychopathy, but a clinical eval is required to ascertain the disorder with greater certainty (the Hare checklist).
Comment threads like this make my head want to explode. Instead of discussing the security implications, it devolves into some bizarre anti-bank/corporation/IT conference diatribe.
Anyways, to paraphrase P.J. O'Rourke, I hold psychology and sociology up there with Women's Studies as a serious academic discipline.
I needed tin foil just to get through the whole thread!
Autism, Schizophrenia, Nuni/Bi polar mood disorders (depression), and Anti Social Personality Disorder (which is often broader than "core" psychopathy) are all related spectrum disorders with complex and intertwined multi-gene hereditary - environment interactions.
Some aspects, eg, psychosis and depressions, are triggered by infections and stress which implies an involvement of the immunity and stress-hormone systems (cortisol).
They have been part of humanity as far back in history as can be traced at all. Autism and ASPD spectra can also be seen as an evolutionary strategy where an individual's "genes" bet on less or more social life-styles. Note that both (weak) autists and psychopaths are parasitic. They are troublesome because they tend to take more care from others than they give back.
A very interesting suggestion is that these spectrum disorders are collateral damage from an epi-genetic battle of the sexes. In evolutionary sense, mothers can raise more children if each demands less care (autism). Fathers get more successful children if they sire cuckoo young that each demand as much care as they can (psychopathy). Things go pathological when either parent cannot "imprint" their child correctly.
Battle of the sexes may set the brain
Christopher Badcock1 & Bernard Crespi2
Nature 454, 1054-1055 (28 August 2008) | doi:10.1038/4541054a; Published online 27 August 2008
A tug-of-war between the mother's and father's genes in the developing brain could explain a spectrum of mental disorders from autism to schizophrenia, suggest Christopher Badcock and Bernard Crespi.
Winter: Please try and cite a reference showing that children on the Autism Spectrum require less care. All the evidence I've seen shows the exact opposite.
Also please try and cite a reference showing that demanding more care has historically been a good thing for a child. My guess is that a demanding child will in some situations diminish the ability of their parents to provide a reliable supply of food, and that as for most of history (and even a large portion of the world population now) food supplies have been short this would be an evolutionary issue.
It seems to me that children who are close to the median in most measures have historically been most likely to survive to adulthood. For the greatest number of grandchildren there is an advantage in a high-stakes measure for sons (not daughters as they are limited to ~1 child per year). A genetic combination that results in most sons having fewer children than average but some sons having many more than average can spread.
Finally it is generally regarded that the incidence of both psychopathy and autism is significantly greater among males than females. This would be due to some combination of females being less likely to have such traits or less likely to be diagnosed.
The fact that children on the Autism Spectrum don't need less care and the fact that there aren't more Autistic women than men seems to kill the Badcock and Crespi theory.
NB I haven't read their paper and won't read it. I've read more than enough strange theories about Autism already. If they want to promote their ideas they can start by publishing them under a CC license.
"Please try and cite a reference showing that children on the Autism Spectrum require less care. All the evidence I've seen shows the exact opposite."
I can only say, read the paper. It contains a long list of references. The linked paper tries to make sense of the high prevalence of such harmful disorders. It is not proposing a cure, nor does it assigns blame.
Note of correction:
I was a little hasty and should have reread the paper.
I intermixed the paternal/maternal drive behind autism and paranoia. Autism leads to an extremely "male" things-person (paternal imprinting) and paranoia/schizophrenia leads to an extremely female peoples-person (maternal imprinting).
Although the paper directly refers to autism and paranoia, it does not actually names ASPD as a disorder it tries to explain. I thought the pattern fitted perfectly for ASPD, but that was my interpretation, and mine alone.
One big part of securing systems against sociopaths and psychopaths is, imo, mitigating the information lost due to scaling and traversal of hierarchy levels. Sociopaths are ultimately analogous to defectors in the prisoner's dilemma game, and in an iterated game defectors are weeded out. (Or in more common parlance, they're the people everybody in their community or workplace knows not to trust or to get on the wrong side of.)
So a winning strategy for the sociopath/psychopath is to keep moving around so that they can access new pools of suckers, or to move up a hierarchy at least to a level where they're insulated from the consequences of what people know about them. Hierarchies can also (as people have noted) protect sociopaths because the people at the top (who may be more than a little off themselves) value the short-term results produced by the sociopath's behavior over the longterm organizational damage, and believe that they'll never be playing against the sociopath themselves. That's assuming, of course, that the people at the top are actually aware of the behavior in question, rather than just the veneer of charm or the manipulated numbers.
How to preserve the kind of information that would help secure systems against sociopaths and psychopaths is an open question -- those same channels could of course easily be gamed if the reward were considered worthwhile.
"Finally it is generally regarded that the incidence of both psychopathy and autism is significantly greater among males than females. This would be due to some combination of females being less likely to have such traits or less likely to be diagnosed."
In the case of autism at least, there is an increasing body of evidence that the latter is true. The full explanation is too long and off-topic to go into here.
To the degree that persons on sychopathy/sociopathy spectrum are disproportionately represented in the criminal justice system perhaps our "socio-technical systems" are already addressing them.
It seems that psychopaths know right from wrong, they just don't feel bad about doing wrong. They do seem to take precautions to avoid detection. Is non-emotional preparation predictive of success in an criminal conspiracy? Probably a little, but I don't see how that helps us defend against them. I wonder if the ability to lie dispassionately when interviewed about a crime doesn't put them a step ahead of the average perpetrator, but that's an investigative rather than a prevention issue.
Psychopathy/sociopathy can cut both ways. A degree of remorselessness can be a useful trait in those who protect us from evil. There are portions of "On Killing: The Psychological Cost of Learning to Kill in War and Society" by Dave Grossman, A Back Bay Book, which speak to the issue of the small percentage of soldiers who are not uncomfortable killing, and law enforcement officers who are not uncomfortable applying physical violence in service of the public order.
For further reading I recommend "The Psychopathic Mind: Origins, Dynamics, and Treatment" but J. Reid Meloy, Publisher Jason Aronson Inc. It may be a little dated, but it's accessible to the layreader.
>It is estimated that at any given >time, at least 8 - 10% of our
>population are sociopaths.
That sounds far too high to me. I don't believe our society could function at that level as too many "normal" people would be spending too much time dealing with the sociopaths trying to manipulate them.
That statistic I've seen is 1%.
And the accompanying idea that the dumbest third are in jail, the smartest third on Wall Street (everyone wave to Bernie Madoff!), and the rest are distributed around society where they make our lives miserable when we're sucked into their sphere of influence.
Not everyone in jail is a sociopath. Not everyone on Wall Street is, either. Abnormally high percentages, sure.
Matt from CT: There is obviously a spectrum of psychopaths. A large and complex society couldn't survive with 1% being like Hannibal Lector, most aren't like that. Most of the psychopaths do minor things, probably most of them have no great inclination towards violent crime.
The justifications of psychopathy in terms of situations where violence is necessary (armed forces and police work) are interesting. It's this type of thinking that permits all manner of bad things to be done. There is no evidence to show that non-psychopathic people have any collective lack of ability to commit acts of violence when there is good reason. There are some people who couldn't function in police work due to being unable to handle the violence, but there are a lot of nice caring people who are willing to use force to protect others.
Winter: I'm not going to pay to debunk every bit of bad research on ASDs. If the idea has any value then someone will publish something similar in public and I'll read it.
I take serious objection to the conflation of sociopathy and autism. The conflation of those two conditions is absurd, and shows ignorance of both conditions. Just because both are spectrum disorders is utterly irrelevant.
In case you missed it, I recommend Stanton Samenow's "Inside the Criminal Mind" (1984, 1st ed.) for a clinical view of the psychopath.
@Russell Coker, "There are some people who couldn't function in police work due to being unable to handle the violence, but there are a lot of nice caring people who are willing to use force to protect others.": Except that police have one of the highest suicide rates because police work is a soul-draining gauntlet of constantly dealing with (one part of) the scum of society and those most victimized by that scum. Normal people can't handle that long term no matter how well-intentioned they are and either promote out, become assholes, burn out or commit suicide.
@ Russell Coker
"There are some people who couldn't function in police work due to being unable to handle the violence, but there are a lot of nice caring people who are willing to use force to protect others."
But they are not naturally inclined to it (sometimes to the point of an inability to act) or will feel bad about it (sometimes to the point of disability) unless they are rigorously trained beforehand and carefully counseled and supported afterwords.
Don't get me wrong, a generalized aversion to violence is a good problem to have to work around. Still, before this was well understood, a fraction of this 1% - those toward the "good guy" end of the spectrum - may have been doing more violence with less remorse than the rest.
@ Ian Farquha,
"I take serious objection to the conflation of sociopathy and autism. The conflation of those two conditions is absurd, and shows ignorance of both conditions. Just because both are spectrum disorders is utterly irrelevant."
To take your point's in reverse,
The fact that they are both spectrum disorders is actually relavent for a number of reasons, however I would agree that the fact that two things are similar and have other apparent connectives does not make them the same or of necessity connected except via some fundemental mechanism.
But things can be related as opposites or as orthagonals. As I noted above they appear to be near opposites when involving high functioning, that is in the choice of focus but not to the exclusion of human emotion or empathy. Thus they appear as opposit outliers on some distrubutions.
I suspect the conflation occurs because of the apparent exclusion of human emotions in both disorders appearing the same to many people.
However this is as far as I'm aware an active area of debate, it is argued that those on the autistic spectrum lack the ability to recognise emotion in others thus not "learn emotions" (ie have no emotional intelligence). Whilst those on the Psych/sociopath spectrum may well recognise emotion in others very well but it does not engender any emotional response in them.
As always with research in to the human brain and it's functioning the issue of "handedness" arises. Most researchers exclude left handed people from their study groups or fail to investigate it's potential effects/consiquences in other studies. This has implications for all studies of the human mind and ignoring it potentialy renders an investigator "colour blind" in what they observe.
I was wondering why we had all these hits from the "Schneier on Security" website. I will say, that of the 900 articles on the Lovefraud Blog, the Autostereograms one was an odd choice. That was a post by a guest author, and was somewhat metaphorical.
In reference to some of the discussions above - the mental health profession has not agreed on what to call this disorder - sociopath, psychopath, antisocial personality disorder. In fact, the American Psychiatric Assn has proposed yet another term - "antisocial/psychopathic type." We haven't figured out what to do with that one.
The professionals have also failed to agree on diagnostic criteria. There's a standoff between the psychology PhD researchers (who use "psychopath") and the psychiatrists - MD clinicians (antisocial personality disorder, or perhaps the new name). All this does is leave the public confused, and makes our job trying to educate the public more difficult.
How many are there? I use the figure 1% to 4% of the population - Dr. Robert Hare says 1% (psychopaths), the psychiatrists say 4% (antisocial personality disorder).
An interesting note - Dr. Hare, who claims that 1% of general population are psychopaths, also says that 3% of corporate executives are psychopaths.
I invite all of you to visit more of Lovefraud.com - our discussion of this disorder is quite thorough.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.