Slashdot Mirror
Why Privacy & Security Are Not a Zero-Sum Game
I Don't Believe in Imaginary Property writes "Ars Technica has up a nice article on why security consultant Ed Giorgio's statement that 'privacy and security are a zero-sum game' is wrong. The author reasons that, due to Metcalfe's law, the more valuable a government network is to the good guys, the more valuable it is to the bad guys. Given the trend in government to gather all of its eggs into one database, unless more attention is paid to privacy, we'll end up with neither security nor privacy. In other words, privacy and security are a positive-sum game with precarious trade-offs — you can trade a lot of privacy away for absolutely no gain in security, but you don't have to."
he's right ... but the thing is, the Federal Government isn't doing this to provide us with more security, they're doing it to provide themselves with more power, power over us. Consequently, they don't much care about our privacy, and there's no reasoning with them on that score.
The higher the technology, the sharper that two-edged sword.
I concur. It is based on the Law of Conservation of Happiness. If you punch somebody in the nose, you transfer their lost happiness to yourself. It is a universal law of nature. Our government, education, and financial systems know that and use it the extreme. While you may think that being anally probed by airport security sucks, the airport workers love it as do the Members of Congress who use it to get reelected.
But... that's not the point now.
The current system of more and more data collecting isn't for more security. That's just how it's sold. It is, bluntly, control. Over your data and you. It is easier to pinpoint and neutralize "troublemakers" before they start gaining a lot of support.
So I guess this very interesting point will go unheard. The ones that implement the system don't care (actually, they want it to be that way), the masses don't know (or think that zero-sum game is some sort of game show) and the little rest doesn't matter (and should they start to get too vocal, we'll invent a law against them).
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Terrorists who get caught don't continue to plan attacks...
The fundamental problem with the privacy-vs-security argument is that it is a false dichotomy:
The fundamental problem with eavesdropping is that it assumes that the bad guys are willing to divulge key operational details over an insecure channel. Even the dumbest of criminals knows to shut up when the cops are around. So who do the feds expect to catch? That's right - ordinary Americans like you and me. When we become a "problem" to those in power, they'll have hours of phone calls and pages of emails, in which they will find something - no matter how innocent - which, when taken out of context, sounds nefarious. The famous quote, "Give me six sentences by even the most upright man and I will find a reason to hang him..." (or similar) comes to mind.
Rather, I think it is helpful to expose the lies used to increase the amount of political power wielded by the executive branch.
The society for a thought-free internet welcomes you.
It doesn't even take malicious access. In the UK, some low level government peon recently snail-mailed the financial details of 25 million people on discs that went missing. Since that broke, a slew of other government agencies, from health through to defence have dumped "me too" admissions into the shitstorm.
The government's response? They'll put "new procedures" in place to ensure that it can't blah blah again blah fight them on the beaches blah.
They're still pressing ahead with the National Database, misnamed as a National ID card (the equivelant of the USian Real ID). It's Total Information Awareness with a fluffier spin on it, but exactly the same goals: to know everything, about everyone, all the time, and Goddamn the consequences when (not if) the black hats get their greasy fingers on it.
If you were blocking sigs, you wouldn't have to read this.
...they justify it and gain popular support/acquiescence using supposedly rational arguments, so it is a worthwhile expenditure of effort to criticise and dismantle those arguments.
So if some security expert idiot is wandering around convincing people that security "versus" privacy is a "zero sum game", then one effective counter-tactic is to explain how that is incorrect.
You are not reasoning with "them" as in, "the Federal Government". You are reasoning with "them" as in, "your fellow citizens, whose approval or at least inaction is needed to allow these things to happen."
Read Pynchon.
As an actual assessment of security policy "Privacy and Security are a zero-sum game" is pretty much worthless. There are obvious empirical counterarguments viz. prisons, military bases and ships, and OpenBSD. The statement manages to be both too optimistic and too pessimistic all at once. It ignores the fact that many policies end up achieving a net gain of less than zero(letting the TSA bother passengers and not even glance at cargo, for instance), even if we value security and privacy equally. It also ignores the fact that there a fair number of possible policies that achieve a positive net gain.
As a propaganda slogan, though, it is a masterstroke. It manages to imply, while sounding like good, solid, hardheaded, professional advice, that reductions in privacy automatically provide security, that defenders of privacy are enemies of security, and that proposals for plans that protect privacy and security are a bunch of unrealistic pie-in-the-sky crap.
It also manages to completely ignore a facet of security that the American public has been absolutely terrible at(and politicians and the media have been all too willing to help them continue to be so): Risk assessment. We suck at it. We also have a strong bias in favor of flashy interventions and against boring ones. We often end up with interventions strongly modified by various political interests and of sharply reduced effectiveness. "Privacy and Security are a zero-sum game" makes it sound like we actually have it pulled together, that the professionals are on the case; when we hardly know what game we are actually playing.
Prisons can be so secure that they hamper the ability of a prisoner to be rehabilitated...or worse, make the prisoner more unstable and at-risk for criminal behavior. Look at what's neatly called administrative segregation. It used to be known as solitary confinement, but now all types of people are put in ad-seg...people who are targets of gangs (who have done nothing wrong) for example. Some countries consider solitary confinement torture.
At any rate, solitary confinement is and for a person who is wrongfully put there, push them further down the spiral of anti-authoritarianism and harmful behavior. Each case greatly increases their likelihood of committing crimes when put back in general population or released.
The point is, even for a PRISON, you cannot say that security is always non-zero-sum. The converse is true, ALL security/civil rights issues are a zero sum game. The sooner we as a people realize that NO environment can be make truly secure, the sooner we can actually trying to start solving some of our worst problems.
Thank you Dave Raggett
Number of people who have been killed in the United States in the past five years by terrorism: zero.
Number of people who have been killed by the over-zealous organs of the state in the name of "security": greater than zero.
Ergo, increased "security" is killing people and stripping them of their privacy. So as a matter of empirical fact the things people are calling "security" are negative, and the loss of privacy is negative, so it is a lose-lose situation for ordinary law-abiding Americans. They would be SAFER with less "security", as well as having more privacy. And more of something else, too.
Blasphemy is a human right. Blasphemophobia kills.
There is simply no correlation between the two. There is no function or relationship that can map one onto the other, in either direction. There aren't enough parameters. It might be possible to define a function f() with the parameters of security, privacy, base cost, cost per incident, ease of implementation, time of implementation, ease of use, and latency, such that the function (which will not be linear) produces a constant. I don't guarantee it, though. Individuals are too variable, between each other and even between moments for the same individual, and an 8 dimensional non-linear topology is too simple to capture that. Even the sci-fi notion of psychohistory didn't work on individuals, but security and privacy is all about interactions between individuals.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
"Giorgio warned me, 'We have a saying in this business: 'Privacy and security are a zero-sum game.'"
This was not meant to be a hard and fast equation, folks. Just like, "you can lead a horse to water but you can't make it drink" isn't meant to be 100% true all the time. I can force that damn thing to drink if I want it to, I guarantee you. It won't be pretty. I'm not that mean though.
Not everyone in your government is out to get you. This guy is working with the national intelligence director, you better believe he wants to get all the intelligence he can. It's his job to go as far as he can to get the most benefit for his job. I'd agree this is definitely not the best way to get intel, and it probably won't be secured well enough when they get it. At the same time, someone really intelligent is probably telling Giorgio and McConnell the exact opposite. Really, it's the lawmakers we've (Americans, here) voted into office that are the ones to blame if this type of insanity passes. They're the ones that are supposed to make sure that the tenth amendment is upheld... "The powers not delegated to the United States by the Constitution, nor prohibited by it to the states, are reserved to the states respectively, or to the people."
Remember that when you vote for President, that's one man that represents 330 million people. When you vote for a senator, he/she represents only 3.3 million. When you vote for a house member, they represent 785 thousand. Get down to state and local government and the numbers drop even more significantly. Vote for a smaller government... It's too bad Ron Paul has no chance to get elected.