Schneier on Security
A blog covering security and security technology.
« Friday Squid Blogging: Paul Burke Giant Squid Sculpture |
| Prosecuting Snowden »
July 22, 2013
Violence as a Source of Trust in Criminal Societies
This is interesting:
If I know that you have committed a violent act, and you know that I have committed a violent act, we each have information on each other that we might threaten to use if relations go sour (Schelling notes that one of the most valuable rights in business relations is the right to be sued -- this is a functional equivalent).
Abstract of original paper; full paper is behind a paywall.
Posted on July 22, 2013 at 6:36 AM
• 18 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
I find it interesting how he opened with the value of profiling when it comes to smuggling rather than terrorism. In cases of smuggling you have had literal grandmothers pulled in. This case recently made the headlines:
Is this a form of mutually assured destruction.
Assuming we have a symmetric capability to harm each other.
The Police might know I have done something illegal, I know the Police have done something illegal - doesn't lead to a balanced outcome
Similar belief in 'right to carry' and 'castle doctrine' states. I have a gun, the bad guy has a gun. Levels the playing field and establishes assumed expectations, no?
It's not entirely clear this is an artefact of the search for binding commitment. Perhaps our own experience in, well, these sorts of organizations makes us less reliable as outside observers - or perhaps it's a useful perspective.
When operating outside the law as a matter of routine business practice, one seeks to align with others who are _reliable_ first and foremost. Things can - and do - go wrong with regularity. Since problems must be resolved via informal channels - not going to call the cops if someone steals your truck, for example - there's a high premium on fellow participants ("running buddies," "compas," "bros" - name your jargon, depending on cultural milieu) who can get shit done. Handle the issues. Make problems vanish.
Not infrequently, accomplishing this requires violence - or the credible threat of violence, which ends up being just a shade off. A peer in the business who, when the shit hits the fan can - and will, and has proven the ability to previously - take matters into his (or her) own hands is worth his (or her) weight in gold... or more than gold, quite often. Hesitation, stalling, fear, uncertainty - these are traits in a fellow colleague that, in a criminal context, are not only likely to end with a bad business outcome but could also end at the morgue. Conversely, someone who has "got your back" - who will act decisively and effectively, reliably - increases your team's confidence enormously. Things get done, problems get solved.
None of this has to do with increasing commitment as a tool of preventing reciprocal snitching, as it were. It has to do with operational competence and a skill that's a fundamental part of the toolkit in this sort of world: the ability to deploy violence professionally. I want someone with me who I know can deploy that tool, if needed - and I don't want to worry about some greenie who talks big but has never stepped it up in actions. In short, I want someone who I know has the capability to deploy violence - and the ONLY way to know that is to have seen it firsthand, previously... which likely means I've also participated in it. Hence, a shared history of violence being observed... but not in any sense as a result of a desire to increase commitment.
(note: I'm using first person singular here not to imply I've engaged in such violence in the past, which is not the case; rather, it's essentially a subjunctive usage, without the clunky subjunctive declension)
The best way to avoid having someone turn on you and disclose your bad deeds is for nobody but you to know of them. That is axiomatic. Only in the movies do "criminals" go out to broadcast their bad-assed-ness by having intentional spectators. Perhaps in the past that happened, but sentencing and policing procedures are such today that everyone rolls if busted and threatened with enough time in prison (or some other threat) - everyone. Mafia bosses, ice-cold assassins, drug kingpins, wild-eyed suicide terrorists... they all roll. We've built a policing system that makes such decisions almost preordained.
Thus, effective criminals today don't seek out magical ways to prevent their comatriots from rolling, Rather, they seek to isolate knowledge down to small cells - ideally, cells of only one knower. Then, when people get pinched, they don't know anything damaging: they can talk away to the cops all they want, no harm done. It's structural security - "security by design," in the extra-legal world. Which is the exact opposite of engaging in violence with the intention of others witnessing it. To have others _know_ of one's violent acts - second or third hand - that can be very valuable in modern-form criminal operations: you're known to be a "serious dude," but nobody can testify firsthand to seeing it. Get your cake and eat it too, as it were.
The more people see your bad deeds, the more people who will be shopping you to the cops when they get busted, as their ticket out the door. That's the real decision metric in Western societies - which likely varies enormously from, say modern Russian organized crime. In America, for example, having "chits" - knowing bad things others have done - in the back pocket can act as functional insurance in the event one is busted, oneself. Pull the chits, trade someone else for your own ass, and walk out free. If you've enough chits, you can do that shuffle many times. I personally know of some "professional snitches" who have operated for decades by having a steady stream of "sacrifices" in their (her) back pocket to trade in when the pressure comes down. Nasty work, and sooner or later someone takes matters into their own hands to end those snitch-sprees.
Anyhow, the alternative explanation - proof of competence in deploying violence is best demonstrated through the deployment of violence previously - seems, per Occam, a more congruent explanation for the correlations discussed in the underlying paper.
Your mileage may vary, and so forth...
~ Baneki Privacy Labs
I am told (anecdotally, I have no data on this) that Russian pubs are remarkably free from fights compared to English pubs - because if there's a fight there, people know that someone's going to end up dead.
Oops, I just noticed I commented on the wrong article...
To comment on the matter at hand. It's interesting to see this borne out in the data. There has been plenty of speculation and presumption about this but from what I can tell not that much evidence.
"Schelling notes that one of the most valuable rights in business relations is the right to be sued"
In the USA, a consumers right to sue in business relationships is diminishing, replaced by binding arbitration. Notably in contracts entered into with cell phone service providers.
Bankei writes, "The best way to avoid having someone turn on you and disclose your bad deeds is for nobody but you to know of them."
This is true but it misses a salient point, namely that there is only so much one individual can accomplish. The main reason that group activity exists is precisely because it can accomplish what individual activity cannot. Thus the trade-off. The more people know the more the group can accomplish yet the more people know about the activity the more vulnerable to attacks it becomes simply because there are more links in the chain that can break.
Further, the use of violence to build trust is well established. Many biker gangs use this tactic because they know that most government agents will not engage in activities like murder or child rape. I am stretching my memory but I seem to recall reading about a case where an on-line child porn ring was successfully infiltrated when the undercover agents videotaped the "rape" of a very lifelike doll in order to establish their creditability. It simply doesn't make any sense to argue that in such contexts violence is being used to test competence. There is no competence at stake.
I think the comment was more about relations between two businesses that form a business relationship. Its not really about individual customers, those relationships (tiny customer vs. giant corporation) are too one-sided to matter here. Its more like, big corporation and its medium-sized supplier, something like that.
For example, say that some company wants to buy some computers and some software to run on them. They could use freely available open-source software, but then who would they sue when it goes wrong? Instead, they pay money to buy commercial software, pay the commercial vendor for a support contract, etc. They are willing to pay for that because when they have problems with the software they can blame the problems on that vendor. They can demand that the vendor help them fix the problems. If the vendor's performance in the support contract falls far short of the company's expectations, they can sue them. Having someone to sue after a big money-losing disaster of a failed project, lengthy downtime, etc. is important. The business was willing to pay all that money to the vendor in the first place because they know that as a last resort they can sue the vendor to get some of it back. To avoid that fate, all the vendor has to do is mostly deliver on their promises.
"Three may keep a secret if two of them are dead." - Benjamin Franklin.
Read Codes of the Underworld: How Criminals Communicate
How do criminals communicate with each other? Unlike the rest of us, people planning crimes can't freely advertise their goods and services, nor can they rely on formal institutions to settle disputes and certify quality. They face uniquely intense dilemmas as they grapple with the basic problems of whom to trust, how to make themselves trusted, and how to handle information without being detected by rivals or police. In this book, one of the world's leading scholars of the mafia ranges from ancient Rome to the gangs of modern Japan, from the prisons of Western countries to terrorist and pedophile rings, to explain how despite these constraints, many criminals successfully stay in business.
Diego Gambetta shows that as villains balance the lure of criminal reward against the fear of dire punishment, they are inspired to unexpected feats of subtlety and ingenuity in communication. He uncovers the logic of the often bizarre ways in which inveterate and occasional criminals solve their dilemmas, such as why the tattoos and scars etched on a criminal's body function as lines on a professional résumé, why inmates resort to violence to establish their position in the prison pecking order, and why mobsters are partial to nicknames and imitate the behavior they see in mafia movies. Even deliberate self-harm and the disclosure of their crimes are strategically employed by criminals to convey important messages.
:%s/committed a violent act/dirty laundry/g
where the winner is the party that can either outbid or terminate the other.
From a comment on that page:
"Tragically, Gambetta’s theories (Codes of the Underworld) in this regard prove correct in online exploitation – in order to gain trust of the illicit network, one must provide information that implicates the user."
I think this is supporting evidence of the better theory: "dirt on others" as a source of trust in criminal society. (Violence is just one method.) Articles on criminal forums in the past showed that certain exclusive groups would force one to prove they're a criminal before gaining access. At certain sites, it would require a new virus, new child porn, a minimum BitTorrent share for the private tracker, arbitrary defacement of a web site, and so on.
The goal of trust-supporting activities isn't just to get dirt on people, though. One important aspect of these processes is to assess a person's criminal character. Are they capable? Are they reliable? Will their morals get in the way? Do they act like a rat? What potential do they have for future opportunities? And so on. There are many clever tests I've read about and seen in person that secretive groups use to asses trustworthiness and character in general. I wonder how many will make it into these books. ;)
I recently read an article regarding corruption in China. The point was made that once government corruption reaches a certain level it is impossible to be an honest official. If everybody else in the office has taken a bribe, then the one guy who has not taken any bribes is looked upon with suspicion and is ostracized. Nobody wants to help him and he becomes ineffectual.
@Michael Josem: Reminds me of that clip posted here (I think) recently of two gangs of football fans meeting for a rumble. One of the posters said that it would never happen in the US because someone would have a knife - thus demonstrating that he was unaware of what was actually happening.
In Savannah, GA in the 90s, there was a gang run by Ricky Jivens whose initiation entailed shooting a random innocent. Only then was one accepted and allowed to be a part of its drug operations. This ensured loyalty.
Unfortunately, American politics are the same. Those who aren't willing to "play ball" are not trusted or allowed inside. Only once you've compromised and given political peers something to hold over you, they be willing to work with you. No politician likes someone who's too clean.
Re. the comment about value of "right to be sued," I think that's quite true. I was for a while a landlord in the DC area. I refused to rent to diplomats - not because I thought they are not trustworthy, but because I would not be able to sue them if they defaulted on the lease.
That said, I'm not sure it really applies in this case.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.