Schneier on Security

Baneki Privacy Labs (@Baneki) • July 22, 2013 9:06 AM

It’s not entirely clear this is an artefact of the search for binding commitment. Perhaps our own experience in, well, these sorts of organizations makes us less reliable as outside observers – or perhaps it’s a useful perspective.

When operating outside the law as a matter of routine business practice, one seeks to align with others who are reliable first and foremost. Things can – and do – go wrong with regularity. Since problems must be resolved via informal channels – not going to call the cops if someone steals your truck, for example – there’s a high premium on fellow participants (“running buddies,” “compas,” “bros” – name your jargon, depending on cultural milieu) who can get shit done. Handle the issues. Make problems vanish.

Not infrequently, accomplishing this requires violence – or the credible threat of violence, which ends up being just a shade off. A peer in the business who, when the shit hits the fan can – and will, and has proven the ability to previously – take matters into his (or her) own hands is worth his (or her) weight in gold… or more than gold, quite often. Hesitation, stalling, fear, uncertainty – these are traits in a fellow colleague that, in a criminal context, are not only likely to end with a bad business outcome but could also end at the morgue. Conversely, someone who has “got your back” – who will act decisively and effectively, reliably – increases your team’s confidence enormously. Things get done, problems get solved.

None of this has to do with increasing commitment as a tool of preventing reciprocal snitching, as it were. It has to do with operational competence and a skill that’s a fundamental part of the toolkit in this sort of world: the ability to deploy violence professionally. I want someone with me who I know can deploy that tool, if needed – and I don’t want to worry about some greenie who talks big but has never stepped it up in actions. In short, I want someone who I know has the capability to deploy violence – and the ONLY way to know that is to have seen it firsthand, previously… which likely means I’ve also participated in it. Hence, a shared history of violence being observed… but not in any sense as a result of a desire to increase commitment.

(note: I’m using first person singular here not to imply I’ve engaged in such violence in the past, which is not the case; rather, it’s essentially a subjunctive usage, without the clunky subjunctive declension)

The best way to avoid having someone turn on you and disclose your bad deeds is for nobody but you to know of them. That is axiomatic. Only in the movies do “criminals” go out to broadcast their bad-assed-ness by having intentional spectators. Perhaps in the past that happened, but sentencing and policing procedures are such today that everyone rolls if busted and threatened with enough time in prison (or some other threat) – everyone. Mafia bosses, ice-cold assassins, drug kingpins, wild-eyed suicide terrorists… they all roll. We’ve built a policing system that makes such decisions almost preordained.

Thus, effective criminals today don’t seek out magical ways to prevent their comatriots from rolling, Rather, they seek to isolate knowledge down to small cells – ideally, cells of only one knower. Then, when people get pinched, they don’t know anything damaging: they can talk away to the cops all they want, no harm done. It’s structural security – “security by design,” in the extra-legal world. Which is the exact opposite of engaging in violence with the intention of others witnessing it. To have others know of one’s violent acts – second or third hand – that can be very valuable in modern-form criminal operations: you’re known to be a “serious dude,” but nobody can testify firsthand to seeing it. Get your cake and eat it too, as it were.

The more people see your bad deeds, the more people who will be shopping you to the cops when they get busted, as their ticket out the door. That’s the real decision metric in Western societies – which likely varies enormously from, say modern Russian organized crime. In America, for example, having “chits” – knowing bad things others have done – in the back pocket can act as functional insurance in the event one is busted, oneself. Pull the chits, trade someone else for your own ass, and walk out free. If you’ve enough chits, you can do that shuffle many times. I personally know of some “professional snitches” who have operated for decades by having a steady stream of “sacrifices” in their (her) back pocket to trade in when the pressure comes down. Nasty work, and sooner or later someone takes matters into their own hands to end those snitch-sprees.

Anyhow, the alternative explanation – proof of competence in deploying violence is best demonstrated through the deployment of violence previously – seems, per Occam, a more congruent explanation for the correlations discussed in the underlying paper.

Your mileage may vary, and so forth…

~ Baneki Privacy Labs