The WELL: inkwell.vue.452: Bruce Schneier: Liars and Outliers - Enabling the Trust That Society Needs To Thrive

#53: Jon Lebkowsky (jonl) Fri 14 Sep 12 11:29

Fri, 14 Sep 2012 11:29:00 PDT

Thanks for joining us, Bruce. This has been an enlightening discussion. Just a reminder that anyone can share the archive of this conversation with this short url: http://bit.ly/schneier-well Onward! [Read entire topic]

#52: Jef Poskanzer (jef) Fri 14 Sep 12 10:44

Fri, 14 Sep 2012 10:44:00 PDT

I used to sell Coca Cola at the office with one of those honesty boxes. I don't think anyone ever stole one though!

Thanks for visiting us, Bruce. [Read entire topic]

#51: Ron Sipherd (ronks) Fri 14 Sep 12 10:34

Fri, 14 Sep 2012 10:34:00 PDT

Thanks, Bruce! [Read entire topic]

#50: Bruce Schneier (bruceschneier) Fri 14 Sep 12 10:30

Fri, 14 Sep 2012 10:30:00 PDT

In response to <jonl>'s <49>:

Yes, but it's a useful oversimplification. More specifically, there are four levels of defectors. Most of us don't steal because we know it's wrong. Some of us don't steal because of how others would react if we did. Still others don't steal because it's illegal. And the rest of us don't steal because of the door locks and burglar alarms. All four types of societal pressures work together to keep the theft rate down to some acceptable societal minimum.

This is where I think my model is valuable to a security practitioner. In general, security concerns itself with systems like those locks and alarms. I argue that security is best conceptualized more broadly, and including morals, reputation, and institutions gives us a more comprehensive -- and more effective -- security toolbox.

Here's a great example. Think of an office coffee machine and an honesty box. The protocol is simple: when you take a cup of coffee, you're supposed to put a quarter in the box. No one is watching, and there are no security measure in place to ensure compliance. The moral inclinations of the coffee drinkers are the only thing that induces them to put quarters in that box.

This is also a good setup to collect data on honesty. You can measure the amount of coffee drunk, count the number of quarters in the box, and have a good idea of what percentage of people paid.

What some researchers did was put a photograph of a pair of eyes behind the box. (The control was a photograph of flowers.) And what they found that the photograph significantly increased payment. It's a fascinating security mechanism: simply a reminder that someone might be watching induced cooperation.

In our information-age hyper-networked world, I think we need more of this sort of security thinking.

I think our discussion is about done. Thanks for having me. [Read entire topic]

#49: Jon Lebkowsky (jonl) Tue 11 Sep 12 05:46

Tue, 11 Sep 2012 05:46:00 PDT

That seems to imply two levels of "defector" - those that would vary from the societal norm and steal but for the security systems that prevent them from doing so, and those that will look for ways to defeat or work around the locks and alarms so that they can steal anyway - i.e. thieves and burglars. Am I oversimplifying? [Read entire topic]

#48: Bruce Schneier (bruceschneier) Mon 10 Sep 12 15:04

Mon, 10 Sep 2012 15:04:00 PDT

In response to <jonl>'s <45>:

Security systems fill the gap where other societal pressures fail.

Let me step back. In my book, I identify four broad classes of inducements that push people to behave cooperatively: honestly, fairly, compliantly, etc. I call these "societal pressures." They are morals, reputation, institutions (laws), and security systems. I'm skipping over a lot of detail here, but you can think of them as all working in tandem.

Take stealing. Most of us don't steal, most of the time, because we know it's wrong. Or we'll feel guilt or shame if we do. That's our morality talking. Some of us don't steal because of how other people will react to it. (If I invite a friend over to my house and he steals my sweater, I won't call the police -- I just won't invite him over anymore.) A few of us don't steal because it's illegal, and we fear the punishment. And the rest of us don't steal because of the door locks and the burglar alarms.

That's the role of security systems. [Read entire topic]

#47: Ted Newcomb (tcn) Fri 7 Sep 12 12:47

Fri, 07 Sep 2012 12:47:00 PDT

re: <45> and <46> above, it seems like were on new ground, staying with the cyberspace as territory metaphor. What's on the horizon for security in the near future? And what are the implications of cyber terrorism? [Read entire topic]

#46: Jon Lebkowsky (jonl) Fri 7 Sep 12 12:41

Fri, 07 Sep 2012 12:41:00 PDT

Resonant with the aspect of reputational pressures covered in the book, I'm reposting a link here that Ted Newcomb had posted in another part of the WELL (thanks, Ted!):

Welcome to the new reputation economy: http://tinyurl.com/92ub3dl

"An aggregated online reputation having a real-world value holds enormous potential for sectors where trust is fractured: banking; e-commerce, where value is exponentially increased by knowing who someone really is; peer-to-peer marketplaces, where a high degree of trust is required between strangers; and where a traditional approach based on disjointed information sources is currently inefficient, such as recruiting." [Read entire topic]

#45: Jon Lebkowsky (jonl) Fri 7 Sep 12 10:39

Fri, 07 Sep 2012 10:39:00 PDT

And I suppose it could be different drivers for individual actors, hard to generalize.

You're a security specialist, and in the book you talk a lot about security systems. Can you discuss briefly where security systems fit in, and where they're most effective? [Read entire topic]

#44: Bruce Schneier (bruceschneier) Thu 6 Sep 12 16:22

Thu, 06 Sep 2012 16:22:00 PDT

In response to <jonl>'s <40>:

We don't know. There are a lot of theories: anonymity, the lack of social cues, a group mentality that rewards extreme behavior, specific things about the environment. It's probably a combination of things. [Read entire topic]