Schneier on Security
A blog covering security and security technology.
« Cryptography Engineering Available as an eBook |
| Breaking Hard-Disk Encryption »
December 27, 2012
Public Shaming as a Security Measure
In Liars and Outliers, I talk a lot about the more social forms of security. One of them is reputational. This post is about that squishy sociological security measure: public shaming as a way to punish bigotry (and, by extension, to reduce the incidence of bigotry).
It's a pretty rambling post, first listing some of the public shaming sites, then trying to figure out whether they're a good idea or not, and finally coming to the conclusion that shaming doesn't do very much good and -- in many cases -- unjustly rewards the shamer.
I disagree with a lot of this. I do agree with:
I do think that shame has a role in the way we control our social norms. Shame is a powerful tool, and it's something that we use to keep our own actions in check all the time. The source of that shame varies immensely. Maybe we are shamed before God, or our parents, or our boss.
But I disagree with the author's insistence that "shame, ultimately, has to come from ourselves. We cannot be forced to feel shame." While technically it's true, operationally it's not. Shame comes from others' reactions to our actions. Yes, we feel it inside -- but it originates from out lifelong inculcation into the norms of our social group. And throughout the history of our species, social groups have used shame to effectively punish those who violate social norms. No one wants a bad reputation.
It's also true that we all have defenses against shame. One of them is to have an alternate social group for whom the shameful behavior is not shameful at all. Another is to simply not care what the group thinks. But none of this makes shame a less valuable tool of societal pressure.
Like all forms of security that society uses to control its members, shame is both useful and valuable. And I'm sure it is effective against bigotry. It might not be obvious how to deploy it effectively in the international and sometimes anonymous world of the Internet, but that's another discussion entirely.
Posted on December 27, 2012 at 6:21 AM
• 32 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Shame loses value as those shamed either claim protected status or turn the deed into a badge of honor. It used to be shameful to be an unwed mother, be in an adulterous relationship, to be openly gay, to be obese, to be in debt, to be on welfare. Society has created a right to not be offended, so calling overweight people fat in ridicule is now the shameful deed.
@Derf - none of the examples you list back up your claims; they're merely evidence that societal views of what constitutes shameful behavior and what doesn't are changing.
Bruce, have you read Jensen's book The Culture of Make Believe? I think you'd find it very interesting -- it's about the relationship of so-called hate groups, certain types of antisocial behavior (bigotry, racism, etc.) and society at large. I've thought of suggesting it before, and it seems relevant again in this discussion of shaming. It's a challenging book, but worth a read.
"Shame comes from others' reactions to our actions.Yes, we feel it inside -- but it originates from out lifelong inculcation into the norms of our social group."
Sometimes. Sometimes it comes from what we IMAGINE others' reactions will be, when in fact they couldn't care less.
Or a person might feel shame for violating their own values, principles, even though those values are insignificant to, or even contrary to, those of the others.
People can be part of many different social groups in their lifetimes, and the norms may differ greatly. From those many sets, they may develop their own completely unique, and perhaps idiosyncratic, set of values. They might thus feel shame, or lack of shame, at odds with the values of any one group.
@Muffin: I don't think so. When people are others wearing it as a badge of honor and not shamed by it, they find a societal group to attach themselves with and remove the shameful feelings they might have had. There is a uppity network which can be identified with and relied upon for emotional support. It doesn't have to be accepted by society as a large, just enough people to provide the necessary support. Now, in the age if connectiveness it is very easy to find that.
Now, legal issues need a significantly larger scale support to alter landscapes.
Nietzsche famously tried to argue that humanity first began with shame, which is external, then came conscience, which is when shame becomes internalized as something one feels even when the original external stimulus is no longer present.
Isn't shame a form of fear? I've seen attempts to attach shame to doing good things because it made others look bad for not acting. Shame can be weaponized in many ways against a person for doing something good. Cynicism is a cousin of shame - the fear of being disappointed. There's never been more cynicism in security than there is now. I just read a horribly discouraging article in Dark Reading that drips with cynicism and features a twisted connection to shame.
Working in the Security Theater that is HIPAA in combination with the open and unfettered practices of academia, shame would do more for true security and privacy than all of the policies and PowerPoint presentations that go on here to try to educate and train people. A large segment of the personnel are simply lazy and careless when the data isn't their own.
The problem is that they don't want to punish anyone because, people wouldn't report when they lost an unencrypted drive or some such thing.
I believe that shame really does stop working when the "alternate social group" that supports the target of shame becomes large enough to be able to argue that it's a majority. This is true of the groups Derf cites, and it's even more true on the topic of racism.
These days I hear two conflicting narratives defining racism. They go something like this:
Left: "Traditional victims of discrimination, such as black people, are owed a debt (of both affirmative action and tolerance of bad behavior) until their overall outcomes catch up to those of whites. Anyone who denies this debt is a racist."
Right: "Discrimination against blacks ended with the Civil Rights Act. People who weren't even adults when it was enacted are not guilty and therefore do not owe the debt that leftists assert. Besides, today's blacks who fail are earning that failure by bad behavior. Anyone who doesn't want society to be absolutely color blind is a racist."
I take the rightist position, but maybe that's beside the point here. It's certainly up in the air which of these is the majority view in America right now. I would expect any poll on the topic to produce a result that agrees with the side conducting the poll.
To the commenter above with whom I disagree:
Shame on you.
Shame is really just "publication" of misdeeds to an audience wide enough to affect the person. The value is not in making the person feel bad about themselves, but giving other people the opportunity to avoid being a target of that person. The "shame" comes from how other people see the person, not from how the person sees themselves. Somewhat on the other side of the coin as:
"The liar's punishment is not in the least that he is not believed, but that he cannot believe anyone else." --- George Bernard Shaw
I disagree with George Bernard Shaw.
"The liar's punishment is not in the least that he is not believed, but that he has to look in the mirror and see a liar." --- Bob T
But who decides who to shame and when? A small group can start a shaming campaign against an individual or institution that damages the target's reputation. But the group may never be held accountable; their narrative of the target's behavior and the reason for the shaming may not be true.
A court of law has standards of evidence; the court of public opinion has few or none. A lot of unjustified damage can be done in the latter. I don't think shaming is effective enough--if it's effective at all--to make up for that.
I just read a horribly discouraging article in Dark Reading that drips with cynicism and features a twisted connection to shame.
I agree with Emma, and then some.
There is a subset of libertarians who would abolish laws against financial crimes on the theory that the reputation mechanism is good enough to prevent them. It seems to me that Mr. Madoff is all the disproof that anyone should need.
This is why most people will never be willing to transact business with some anonymous person on the Internet whom they can't touch if he cheats them.
But that is often not what the liar sees. Instead, they see a person who cleverly outwitted their mark, never giving the sucker an even break. You just can't count on them to have a "normal" internal compass (same with shame), so it helps to use further social pressures to further make the point that such behavior is not acceptable.
Public shaming as a technique to damaging someone's reputation can easily become a very slippery slope, and under many judicial systems may conflict with privacy legislation and even with the right to a fair trial.
We cannot be forced to feel shame.
The author really should read up on Nietzsche. One of his major criticisms on Christianity was exactly that it instilled shame into its followers as a means to control them. In my opinion, shaming can only be a substitute for accountability in the absence of laws or rules governing a particular issue, or when for some reason or another they fail to be applied. The extent to which it can be applied successfully also depends on the intended target. I very much doubt that it has any effect on sociopaths, which for all practical purposes already rules out most of the financial sector, to name just one.
Shaming is quite often useless in modern societies unless its big brother, shunning, comes along for the ride -- often in the form of a boycott. Cutting off the revenue stream is the surest way to let a person or organization know their beliefs and actions are repugnant.
Using modern social media, the source of the shaming is typically from an out-of-context reference observed by complete strangers. Once you have shaming sites, you also have the problem of people who are actively searching for offenses, and you introduce things like confirmation bias. Furthermore, the fact that these matters are being propagated from social media and aggressively pursued with employers and school administrators (as stated in the article) means that we've moved everyone from "proven guilty beyond reasonable doubt" all the way to "Caesar's wife must be above suspicion".
Most of these issues are eliminated when the leverage of social media combined with a highly litigious society are removed, and the traditional self-limiting nature of 'shaming' is involved.
I agree that shame is a powerful tool but there are two problems with it:
1. It is a non-scientific approach and very difficult to use consistently so that people feel the right "amount" of shame and that it makes a difference.
2. These days it is very easy to dodge the negative effects of shame. In the old days a con-man would arrive in your village with a cart, horse, flashy clothes and a big mouth and you immediately suspected him. Or if you were shamed in your village you had to bear the consequences. These days you can just move and have a new job and new friends in a matter of weeks or months.
The anonymity of the internet also provides easy dodging of the effects of shame.
Sure it might be a weapon you can use to try and instill a sense of ethics and good behaviour but it still isn't good enough. Too deeply shamed? Hand the problem to your marketing department or just change your name like the accounting firm Arthur Andersen did.
Long term good behaviour is instilled by a good judicial system, good laws and good oversight. Something that has been consistently undermined in the US for at least two decades now.
Public exposure, whether that leads to the actual emotion of "shame" or not, is extremely powerful for societal change.
Totalitarian systems whether they are large or small (such as cults) fear exposure.
Exposure convicts them by putting them before the general public, and it enlightens insiders seeing there is escape psychologically at the very least from the delusional bubble of such cultures.
This is why the printing press was extremely powerful in helping western civilization break free from the rut of church control.
And this is why we have seen so many positive changes societally. Hitler and Soviet Russia relied on weak exposure to survive. Had the world known the truth about what was going on in those countries (for instance), events would have unfolded very differently.
This is why journalists continue to be persecuted severely in totalitarian nations and extremely unwelcome in any sort of cultic or corrupt environment.
This is my conclusion, anyway.
Exposure itself is shame inducing and so change inducing. That they hide shows they have fear of that exposure. And the fear is of shame which comes with it.
People are intinsically reputationally based. They want to be seen as greater or less by society at large.
@John David Galt:
You write "There is a subset of libertarians who would abolish laws against financial crimes on the theory that the reputation mechanism is good enough to prevent them. It seems to me that Mr. Madoff is all the disproof that anyone should need."
Madoff's crime was a case of financial fraud in the presence of financial regulation. This is only one data point but we should interpret it correctly.
By Bayes' rule, Pr(Regulation reduces the risk of fraud|Madoff) = Pr(Regulation reduces the risk of fraud) x Pr(Madoff|Regulation reduces the risk of fraud) / Pr(Madoff). If Pr(Madoff|Regulation reduces the risk of fraud) is less than Pr(Madoff) then it follows that the posterior probability must be strictly less than the prior probability that regulation reduces the risk fo fraud. The only reasonable reaction to Madoff would be to reduce one's confidence that regulation reduces the risk of fraud.
If this is confusing, consider the man who gets arthritis while wearing a magnetic bracelet and, in response, becomes even more convinced of the necessity of the magnetic bracelet. You have made the same error.
There is an alternate hypothesis that financial regulation has mixed effects, the total of which is to increase the risk of fraud. Would-be bad guys fear prosecution so they attempt less fraud or only attempt fraud when the payoff is very high. Would-be victims become less fearful so they do less diligence. The net effect depends on whose behavioral response is greater. In practice the would-be victims become unduly complacent and regulation increases the risk of fraud. How would a rational person's confidence in this hypothesis change after Madoff? Show your work.
On the pitfalls of shame: there really are not pitfalls to shame. People can imagine others do not feel shame, but they really do. They do very bad things and are seemingly become immune to it, as they say, 'they are shameless'.
Conversely, a point is brought up that there can be shaming done against those who do good things someone else mentioned.
I would suggest the real issue goes beyond shame into *breaking a person*, destroying their inner sense of moral certitude. That is, destroying their sense of knowing what is the right and wrong choice of action. Whatever their morality is -- it clearly differs from person to person and from culture to culture.
For the sociopath, right may mean 'how to make money' and 'how to control people'. For the religious zealot, morality may depend on some hidden or distant cultural values such as "the opinion of those in the Kingdom of Heaven" or "the opinion of religious experts and those who believe likewise".
If you can not prove that their moral sense is wrong at a core level, you can not induce change. If you can prove to *them* at the core level their moral sense is wrong, you can induce change.
The feeling of "shame" simply goes along with this. It is a "cousin of fear" as one poster pointed out. But it is a certain sort of fear associated with the complete desolation of one's understanding -- how they value, how they judge.
At that level, they are forced to backtrack their previous decisions and completely reevaulate their entire system.
At a higher level, they may reevauluate far less, such as "how to handle the usage of strcpy in C code", or "how to judge someone of another race".
Society's opinions often figure into these matters because even the hardest sociopath cares about what others think of them. Sociopaths care deeply about what others think of them, this is the basis of much of their hiding actions and manipulative actions -- which require some level of trust... either trust that they are evil masterminds who should be feared, or trust that they are no manner of threat so they can hurt.
I do not think Hitler committed suicide, for instance, if it was just execution or just prison he faced.
What he really would have faced was dealing with accurate criticism for the Holocaust and the war... with overwhelming evidence he was wrong about a vast many things.
Besides the fact he faced losing all of his glory which he had even in his miserable bunker. Glory given to him by others to be replaced with condemnation.
@ Impossibly Stupid
I understand what you're saying, but concerning Shaw's quote, neither would not being able to believe anyone else be a punishment by the standard you put forth. Further, I would disagree that someone has to recognize the damage to their own self worth in order for it to be a fact. They'll just never know the difference that having self respect is a valuable commodity because they'll have nothing to compare it to. People who really don't care about others and have no conscience tend to either become prisoners or CEOs. But seeing a liar in the mirror for most of us is still a price that is paid.
@James: I cited Madoff to make the point that the reputation mechanism isn't enough to deter serious crimes. (Madoff had a well-earned reputation as being both trustworthy and a financial wizard when he opened his "investment firm.") I said nothing about regulation or its effects.
As pointed out, shame can be an efficacious tool (deterrance) for achieving the desired behavior model in a society as well as a tool for (perceived) justice in cases of undesired behavior.
But as Emma also points out, one man's justice is another man's abuse. The reckless or careless use of public shame and humiliation without the benefit of proven facts in evidence can, and often will, result in the devastation of what might have been a prosperous life (job, family, social standing).
Extreme examples exist in the realm of sexual and drug-related abuses (for purposes of relativity). Even if ultimately exonorated, the stigma that follows such charges (true or not) almost always unfairly maligns the innocent in near perpetuity. Truthfully, in the highly networked modern society/culture, the ability to escape such an experience is nigh impossible without completely destroying one's identity to restart again. And the collateral damage to innocent bystanders (family) is almost always abundant.
When contemplating manipulating social behavior to achieve the desired goals of the community (e.g. socially managing security-related behavior), we must consider the impact beyond the desired scope (Pandora's box), and proceed with considerable care for our fellow man. Just my 2¢.
Anyone who watched Kathy Griffin kiss Anderson Cooper's crotch on national TV last night would justifiably wonder if shame could possibly have any effect on the behavior of CNN persons at the very least.
... wonder if shame could possibly have any effect on the behavior of CNN persons at the very least.
Apparently it was a stunt that was a bit fishy...
According to USAtoday it was caused by people kissing an eight foot sardine...
Mind you apparently she did have asperations on getting the sack so maybe her NY wish might come true...
@Clive Robinson/ pfsm re: sardine kissing
--At least we know how she got the host gig.
I have a friend who has like no sense of shame and its like a super power. He can basically do whatever he wants and faces like no repercussions from it. If anyone watches Curb Your Enthusiasm he's basically a Social Assassin and you can sic him on people.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.