digitalprimate

In this excellent interview, Schneier talks about how we human primates tend to evaluate risk, and why we’re often so bad at it.

Here’s the boilerplate intro to Schneier’s philosophy:

In Beyond Fear, Schneier presents a set of questions to rationally assess the security process, in other words, how to get beyond fear:

Step 1: What assets are you trying to protect?
Step 2: What are the risks to those assets?
Step 3: How well does the security solution mitigate those risks?
Step 4: What other risks does the security solution cause?
Step 5: What costs and trade-offs does the security solution impose?
And finally: Is the countermeasure worth it?

Easy enough, but why are people so bad at it?

Central to the trade-off decision is a concept of risk, and people’s perceptions of risk rarely match the reality of risk. Like the DC sniper example, people simply don’t understand the true extent of the risk, and thus either trade off too much or too little.
There are lots of psychological studies that shed a light on this phenomenon. In Beyond Fear, I talk about five common fallacies:

1. People exaggerate spectacular but rare risks, and downplay common risks.
2. The unknown is perceived to be riskier than the familiar.
3. Personified risks are perceived to be greater than anonymous risks.
4. People overestimate involuntary risks: risks in situations they can’t control.
5. People overestimate risks that they can’t control but think they should.

What this means in real life is:

As animals, we make security trade-offs based on our immediate environment. We do it either through instinct or through intelligence, and the bias in either case is toward survival.

Unfortunately, there are two aspects of modern society that throw this all out of whack. The first is technology. Our security intuition evolved in a world where nothing ever changed. Fear of the new made a lot of sense in that kind of world. But the pace of today’s technology means that things change all the time. Look at the Internet: every week there’s a new attack tool, a new vulnerability, a new danger….

The interview is somewhat long and far ranging, but still remarkably clear and practical. Anyone concerned with evaluating risk should read it.

OK, no more Gibson or Schneier fanboy stuff for a while.

From the tireless Bruce Schneier (my personal favorite security guru, apologist, and popularizer), news of a very Neuromancer Russian black market in data.

The most expensive wares in Moscow’s software markets, the items that some Russians are calling a threat to their personal safety, aren’t on public display.

It takes less than 15 minutes to find them, however, at the teeming Gorbushka market, a jumble of kiosks selling DVDs, CD-ROMs and an array of gadgetry in an old factory west of downtown.

One question — Where can we buy databases of private information? — and the young man selling rip-off copies of Hollywood movies leaps to his feet. He leads the customers to another vendor, who wears a bull’s head on his belt buckle. This second man listens to the request, opens his cellphone, and punches a speed-dial number.

Moments later, a third vendor appears. He is jovial and blunt about his trade.

“What do you need?” he says. “We have everything.”

In Moscow these days, among people who deal in stolen information, the category of everything is surprisingly broad.

Must be where the Finn’s grandaddy got his start.

What the Bankruptcy Bill Could Do to You from the Black Commentator.

The U.S. Senate has passed a dream bill for credit card and financial service companies that, if passed by the House, will land millions of American families in debt slavery. Rather than being able to file for Chapter 7 bankruptcy and make a difficult new start, families and individuals will be placed on long-term payment plans to credit card companies, companies that will take their houses, their cars, their child-support payments, and their paychecks.

The above opens a devastating expose and critique of the pending “Bankruptcy Abuse Prevention and Consumer Protection Act of 2005.” This Republican sponsored bill passed the Senate on March 10th, 2005 with a considerable amount of support from Democrats. What, exactly, does this bill change that makes it so important?

First, here’s how personal bankruptcy filings are supposed to work today:

After filing for Chapter 7 bankruptcy, you’re required to liquidate some assets and pay off what you can. But you are then able to write off the rest of your debt and start over, albeit with a credit record that will make it harder to borrow and sometimes harder to find work. Under the current system, if a judge finds that you have significant assets or income, you can be denied Chapter 7 and be required to enter into Chapter 13 bankruptcy, in which you pay off your debt over a number of years. This current “means test” is conducted by a judge who is able to look at actual income and expenses, as well as to distinguish between someone whose child has diabetes and someone who’s been going on reckless shopping sprees.

Now, here’s what Congress proposes to change:

The bill that is coming up for a vote in the House would create a new means test that would forbid making any such distinctions. It would even forbid comparing what someone actually earns with what they actually have to pay for rent and basic expenses. A court would be forced to use standard government figures for expenses, regardless of what you’re actually having to pay. It would base your income on your last six months of income, even if you just got laid off. If your income is below the median, it would spare you the means test but require that you purchase credit counseling, even if you have no money to pay for it and it isn’t offered anywhere near your home. It would also require significant new legal expenses and paperwork

OK, so that’s kind of harsh, but if folks are abusing the system, perhaps we should crack down, right? Well, that might be true (doubtful) if folks were actually abusing the system.

As with Social Security, there’s a grain of truth that can be found if you dig for it…. Estimates of cases of abuse of bankruptcy law range from 3 to 10 percent. The non-partisan American Bankruptcy Institute estimates that at most 3 percent of filers – and almost certainly less – are able to discharge debts they could actually pay.

I don’t know if any of you know anyone who’s had to declare bankruptcy, but imagine: you can’t get a credit card (or can only get one at close to 30% interest), so you can’t buy anything off the Internet (e.g., prescription drugs you can’t afford otherwise); you can’t get a job handling money (credit risk=theft risk for many corporate employers), so many of the low paying jobs forming your pool of likely employers is closed to you; it’s very difficult to find a good place to rent (buying is out of the question and most landlords run credit checks and reject bankruptcies), so you’ll often have to settle for sub-standard digs.

This is not the case with everyone, and I’ve known people who have declared bankruptcy and then gone on to rebuild their lives: which is exactly the point of the system. Yet our leaders in Congress seem to think that the rebuilding part should start, basically, from the street. No keeping the car so you can drive to a job anymore. Just as our penal system has moved towards some Old Testament punishment model, our Congress wants to punish rather than help folks in dire straights.

But surely, you say, credit card companies, et al., wouldn’t ask for such draconian measures unless they were losing money hand over fist, unless such “abuses” caused them great financial hardship they must of necessity pass on to their “good” customers?

Credit card companies, like most lenders, charge interest rates based on the risk they see of each borrower failing to pay back the loan. Some people pay 9 percent on their credit card and others pay 29 percent. The higher rate is supposed to cover the losses the lender will suffer when some of the riskier borrowers default. This system has been bringing in massive record profits for the credit card companies: $30 billion last year.

Not only are credit companies profitable, they’ve already collected money against any risk they incur:

Fine, you say, this sucks but it doesn’t really have anything to do with me. I don’t expect to go bankrupt anytime soon. NO ONE expects to go bankrupt, and yet few understand how easy it is, how quickly things can change:

The above is from a recently completed Harvard study. The study relied extensively on data from South Carolina (among other places) and in a Reuters interview on the study, local bankruptcy expert George Cauthen said that, “fewer than 1 percent of all bankruptcy filings were due to credit card debt.” He went on to add that credit card debt leading directly to bankruptcy“truly is a myth.”

Yeah. There’s your republican family values for you. Manufacture a “crisis” (gee, where have we heard that before) and then fuck middle and working class families squarely in the ass, ‘cause can bet that aforementioned ass that the monied classes have it all squirled away in untouchable “asset protection trusts.”

Kind of hard to keep the old family together if their all out on the god damned street, eh? I suppose it’s merely a matter of time before we bring back real debtors prisons. Prison, you say, well, at least it’s better than the street. I’ll take a look at that next.