Slashdot Mirror
Schneier: We Need To Relearn How To Accept Risk
An anonymous reader writes "Bruce Schneier has written an article about how our society is becoming increasingly averse to risk as we invent ways to reduce it. 'Risk tolerance is both cultural and dependent on the environment around us. As we have advanced technologically as a society, we have reduced many of the risks that have been with us for millennia. Fatal childhood diseases are things of the past, many adult diseases are curable, accidents are rarer and more survivable, buildings collapse less often, death by violence has declined considerably, and so on. All over the world — among the wealthier of us who live in peaceful Western countries — our lives have become safer.' This has led us to overestimate both the level of risk from unlikely events and also our ability to curtail it. Thus, trillions of dollars are spent and vital liberties are lost in misguided efforts to make us safer. 'We need to relearn how to recognize the trade-offs that come from risk management, especially risk from our fellow human beings. We need to relearn how to accept risk, and even embrace it, as essential to human progress and our free society. The more we expect technology to protect us from people in the same way it protects us from nature, the more we will sacrifice the very values of our society in futile attempts to achieve this security.'"
Mitigate biggest risk and immediately something else becomes biggest. At some points you have to stop because every next risk is smaller and more has to be sacrificed for smaller piece of safety.
Bruce is right. Even if our society managed to put enough measures in place to mitigate all but the risks associated with an asteroid impact, you surely would not want to live in that society, as the term "living" would be a loosely defined term at best. It would be a society essentially devoid of free will.
Write failed: Broken pipe
It's an aversion to being sued for not sufficiently managing that risk which leads to massive overreactions on the part of authorities and businesses.
As someone who is familiar with a lot of theoretical work on decision making and the work of Tversky and Kahneman, but not with current empirical research, I am wondering where he gets his data from. By looking at a few examples you cannot establish general claims about how risk prone or averse we have become. Likewise, how does he know that risk aversity depends on the culture? Perhaps it does, but I want to see the study. And yes, there are plenty of studies in this field, it just seems that Schneier doesn't read them, or otherwise he should mention them.
So how about some empirical evidence?
Would be exterminating the lawyers.
"The average reporter we talk to is 27 years old......They literally know nothing." - Ben Rhodes
Business/governments are afraid of public backlash for NOT going to extreme lengths. As an example, if Obama today announced he was going to work towards repealing the PATRIOT Act and whatever silly laws have lead to excessive sums of money being spent on reducing the the already slim chance of dying in a terrorist attack, Republicans would go crazy claiming that the Democrats don't give a care if you and your family die. If schools right now weren't spending who-knows how much money on installing security cameras, hiring armed guards, etc. in response to Sandy Hook, there would be articles everywhere right around now claiming how the public school system is being irresponsible with the safety of children. Hell, I recently remember that there were actually people seriously considering shunning Starbucks because they won't become a gun-free zone where relevant laws don't require it.
After years of not using a signature, I am going to make one to say the following: Fuck Beta
Big business is risk-averse. And in America today, big business runs everything.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Though increasingly I start getting the impression that he's firing about a couple of "duh. You don't say..." statements. Or is it just 'cause I'm in the sec biz that it seems "duh" to me?
Why does anyone think security is in any way different from any other business? In EVERY business, every project, every goal you have, everything you do, the first 90% take 10% of the work, while the last 10% gobble up 90%. Be it 80/20 or 70/30 in yours, I won't split hairs, but that's how it is: A huge part of the project or goal is trivially implemented while a minimal part takes up the lion's share. I'd even go so far to say that in security, the ratio is 99-1.
The GOOD thing about security is that you can actually just do the first 99% and accept the risk for the rest, and get away with an incredible cost/benefit ratio. And you'll find that most companies actually use that strategy in their risk management and reach a security level of 95+ percent. Actually, the joke here is that most companies are, at least in my and I'd say "our" (yours too, I'd guess) definition of security standards, under-secured because of their IT-Governance and that "95% is good enough 'til everything is at 95%" rules. That's why trivial security mechanisms aren't implemented. We're already at 95 with sec. No need to throw money that way (and, believe it or not, most companies reach their "recommended" IT-Sec level easily. Simply because those 95% are SO dirt cheap, easy and painless to implement that they almost certainly ARE already in place, and if not a few pennies will do. You'll find the IT-Sec requirements usually in the "quick wins" quarter of the chart).
You see, companies already heed that advice. Mostly because they don't give a shit about customers complaining about shoddy security because, well, they'll still buy 'cause we're SO cheap. And yes, they do.
It's different with governments that won't just get a quick outcry when a security blooper happens (like a corporations would if they, say, lose every CC number of your customers). If a plane crashed anywhere into a building again, the press would have a field day. HOW could this happen? Didn't our law makers learn anything from 9/11? Did they simple ignore it and go on with their life? What do we have those useless twits for if they do not do ANYTHING? You may fill up here with statements of your choice, but one thing is certain: This administration is finished. Done. Nobody will give them credit for anything anymore. And you better forget about winning the next elections for at least half a decade. People tend to remember those things (and the other party will spend a lot of time and money reminding them of it).
So we need 100% security. Not because we really want it or need it. Not because the scenario is so dangerous to us, the people.
It's dangerous to them, and their place at the feeding trough.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I agree with the article. Increasingly people relinquish life experiences, if not life itself, out of fear and an unwillingness to take any risks. People who avoid trips to far away countries because of fear of a plane crash are a common occurrence. Yet I also know people who avoid excursions on weekends because they are afraid of being involved in a traffic accident. People who are afraid to visit concerts out of fear of crowds or stampedes, people who love oriental style and culture yet would never visit a country such as Morocco out of fear of kidnap or a terrorist attack.
I have to admit, I also experience this fuzzy fear of doing something new, moving out of my comfort zone, leaving the safe haven of my apartment, my town, my daily routine, every time I leave to do something out of the ordinary. I blame the worldwide media and my addiction to news. It seems like bad things happen all the time, everywhere. But it's important to put things into perspective. The world is a very big place, and 99.998% of the time people are safe and nothing happens. Of course, on those very rare occasions where something unfortunate does happen, it makes news and penetrates into our awareness, tickling our fears.
Of course, just as important as putting things into perspective, is not to be stupid and take unnecessary risks. You want to experience oriental culture? By all means, visit Morocco: Casablanca, Marrakesh, Fes. The people are very friendly and there are beautiful things to see there. But please, stay out of Syria, Afghanistan, Iraq... accepting risk does not have to encompass being reckless.
Looking back, I don't regret a single time I kicked myself in the butt, stepped out of my comfort zone, and experienced new things. Yes, I was anxious on numerous occasions, mostly at airports, nervous and afraid. It doesn't matter. In the end, it was all worth it.
No. You're projecting your own ideas onto others in order to come up with an answer you like. The history of humanity is filled with those who went away from others on purpose, with motivations all over the cognitive map.
I've fallen off your lawn, and I can't get up.
...but failure is unacceptable.
Standard operating procedure in nearly all industries today.
Is it just my observation, or are there way too many stupid people in the world?
But we do not even mitigate the biggest risk first. Arguably the biggest risk right now to us is cancer. However, in the US, the budget for cancer research is a pitiful 5 billion $/yr, which is rather small in comparison to the 79 billion $/yr for military research and testing.
Sources for budgets:
http://www.cancer.gov/cancertopics/factsheet/NCI/research-funding
http://en.wikipedia.org/wiki/Military_budget_of_the_United_States#By_title
...But somehow I don't have a problem with less-frequent building collapses.
When I was a kid, I used take my pocket money every Saturday morning, tear out of the house at who knows what speed, down the street, through the car park of the recreation center, across the sports oval and through to the corner store (all the while shouting who knows what at the top of my lungs). Then I would go and spend my pocket money on all kinds of lollies (most of which would probably be eaten by the time I got home).
All of this was done with no parental supervision whatsoever.
These days if that happened, the parents would be yelled at for allowing their kid to go out unsupervised, yelled at for allowing their kid to run so fast though car parks and sports ovals and things with such a high risk of being hurt in the process and quite possibly yelled at for allowing their kids to spend their money with no controls on what they are buying.
Note that I also did other "dangerous" things like walking/riding my bike to school, playing on playground equipment and accessing the Internet without a parent looking over my shoulder at all times.
People have responded to this with statements about terrorism/security and such, but the first thing I thought of was vaccines. The anti-vaccination folks constantly declare vaccines to be a bigger health risk than the disease they protect against. Part of the problem is that vaccines are so successful that most folks today don't remember a time when polio, measles, whooping cough, etc ravaged the world. They don't remember people dying or being permanently maimed by these diseases. (This includes me, by the way.)
To some people, this lack of personal experience makes them imagine the diseases as if they were a "bad cold." Then, they hear about the "toxins" in vaccines and the bad risk assessment kicks in. They figure that the high danger (as perceived by them) of vaccines outweighs the low chance of getting the disease and the low severity (again as seen by them) of the disease. So they skip the vaccinations - and then herd immunity breaks down, people get sick, and die.
Though I wouldn't trade being safe from these diseases, this state of safety has altered the ability of some people to make good risk assessments.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
Two problems, actually. One is that we are dealing, not with a fear of risk, but a phobia towards it: the terms are related, to be sure, but the latter is taken to an irrational degree. If we don't want to spend our lives in padded rooms, then we must be willing to forego the mantra of "Never Again."
But the other problem comes in when the current political fashion of empathy-based arguments comes into play. We are asked to empathize with people who have been traumatized, in the moment of their trauma. Anyone would say "Never Again" in those circumstances: that's a large part of what it means to suffer trauma, and the very definition of empathy demands it from those practicing it. But the recently-traumatized are not known for their rational decision-making abilities. There's a reason we tell people to wait a year, or even longer, before making big decisions. There's a reason we devote whole branches of psychology to studying the effects of trauma. PTSD is no longer one monolithic thing, but a whole spectrum of defined conditions.
This, I think, is where the current phobias come from: a well-meaning but sorely misguided attempt to make decisions by empathizing with people who are in no condition to make those decisions. Pathos has its limits, and we have arrived at the current state by ignoring those limits. Certainly empathy has its place when it comes to the healing process, but when the time comes to make big decisions, we need to step back and look at things more rationally, even when rational thought means accepting the status quo.
I think the article gets one important point rather wrong. Those who take risks tend to be those coming out of the most secure backgrounds. This is pretty much the core observation leading to Plato's Republic. If you grow up at risk, you are less likely to chose risk than if you grow up secure. Now, our response to 9-11 might be too large, but it is not owing to being risk adverse. It is more a function of having a privileged and sheltered decider ready to risk a lot, even our civil liberties, to carry out a family vendetta.
Douglas Adams got it much closer. It was being sheltered and safe that led to the krikkit wars.
The fact is, for the western world, risk is largely eliminated. Plague, famine, pestilence, and war - all are pretty nonexistent in the civilized world.
We evolved to deal with immediate, natural risk.
I'd suspect that the human brain is rather good at this in the aggregate - witness, for example, the breadth of 'home remedies' or natural herbs etc that have been determined to actually have some sort of core chemical that (surprising to scientists) actually DOES have a beneficial effect.
So now we're reduced to worry, more than risk-management.
Rather than facing starvation, we worry that we're eating too much.
Rather than facing working day and night to barely survive, we worry that we're too sedentary.
Rather than face the constant risk of agonizing death from the billions of germs trying to kill us like Typhus and Diptheria, we worry that there *might* be a vanishingly small cumulative risk of cancer from the additives that make our food safe from spoilage, mold, etc.
Rather than facing the imminent pillage, rape, or murder by a neighbor village that's decided we have something they want, we worry that there might be some crazy zealot somewhere who might harbor some resentment vaguely against our society.
Seriously, I suspect that worry is endemic to the human creature. If we don't have actual things to be concerned about, we invent / inflate them to fill that psychological space.
Oh, and Cracked has a wonderful article on this: http://www.cracked.com/blog/7-reasons-news-looks-worse-than-it-really-is/
-Styopa