Schneier on Security

David Thornley • October 31, 2012 11:16 PM

Let’s look at the analogy.

When I go to a restaurant, I use a table that they can’t use for anything else. I take time from people. I consume food the restaurant has paid for. I have consumed limited resources, and by eating at the restaurant have imposed costs on the restaurant.

When I download a book on cheating illegitimately, I cost the publisher and author nothing. The cost of the transaction is borne by the place I downloaded it from and me. In addition, assuming that an additional copy of the book has value, I’ve created an object of value, and the world is just a touch wealthier.

It’s not a matter that there’s more psychological distance between act and effect, it’s that there is no direct harmful effect. Any argument against piracy that fails to take this into account is actually counterproductive, as it gives false reasons why piracy is wrong. Similarly, giving made-up reasons why marijuana is bad will make the drug user think it must be OK, since if there were good reasons the person trying to discourage illegal drug use would use them.

In reality, it’s more like viewing a website without the ads. One of Kant’s forms of the categorical imperative was to ask what would happen if everybody did a certain action – what effect would it have on the world. Obviously, if everybody illegitimately downloaded digital products and nobody paid, there would be none. (There is wiggle room, though, as if everybody had an illegitimate copy of a few things and spent money on the rest there would be no impact. I have come up with no moral reason to stop piracy altogether.)

The same is true with web ads: if everybody blocked them, a whole lot of very useful sites would either go away or have to charge money, and having to charge money would cause a great change in the web. There would have to be an infrastructure to facilitate the micropayments. Web surfers would have to wonder if they wanted to pay cash to go to a new site, not necessarily knowing how much it would cost or how useful it would be, and they’d go to far fewer sites. (On the other hand, running any script an advertiser throws at your browser is dangerous; there was one incident where the New York Times site was infecting computers through malicious paid-for advertising. This is why I run NoScript and not AdBlock Plus.)

And, of course, there’s similar wiggle room. We can skip lots of ads without causing problems, and if they paid per click-through rather than impression, there’s no difference between blocking the ad and not clicking on it, except that blocking it saves the site a little bit of valuable bandwidth.

The interesting moral issue is that it is possible to be a free rider sometimes and do no damage. I can’t do so much as swipe a free mint from a restaurant I don’t pay for eating at without doing damage. I can download a considerable amount of material illicitly and cause no harm to the copyright holder; indeed, many people pirate as a “try before buy” exercise, and likely spend more money on copyrighted music or books or games or whatever than they would if they couldn’t pirate.

I’m not sure where the security angle comes in; I suppose it’s that you generally need less security from the public if they’d actually hurt you by doing whatever the security exists to stop.

David Thornley • November 1, 2012 12:13 PM

@jb, no, I don’t think that’s a better analogy. When I go to an all-you-can-eat place, I’m eating food the restaurant paid for, in the raw ingredients, the preparation, and the display. That’s a direct cost that doesn’t exist in file-sharing. If I share a plate, I’m doubling the direct cost to the restaurant. If I share an illicitly downloaded music file, I’m doing no direct harm to anybody.

So far, the best physical analogy I’ve seen is sneaking into a movie theater that isn’t full.