Liars and Outliers: Enabling the Trust that Society Needs to Thrive

With his latest book, Bruce Schneier continues to move away from his early work focusing on the underpinnings of technology to focusing on the social and cultural forces that shape our security in a hyper-connected society. The centrality of trust to society's function is insightfully demonstrated through a series of models and real world examples.

Economist will feel at home as Schneier digs into game theory covering the prisoner's dilemma, the hawk-dove game, the free-rider problem, and other scenarios. By building a foundation of understanding with these concepts, Schneier goes on to demonstrate the limited benefits of applying more and more of the same types of security pressures. Security discussed in terms of cost and benefit reveals the mistake of assuming that more spending on security system will result in greater and great security benefits. Risk will always involve trade offs but only the right mix of societal pressures will lead to trust and security.

The outliers that are discussed are the individuals in society that defect and go against what is in the group's interest. Defectors "never act well except through necessity: but where choice abounds and where license may be used, everything is quickly filed with confusion and disorder." (Niccolo Machiavelli) The presence of these defectors makes it rational that individuals give up freedoms to governments and institutions that will enforce restrictions against the defectors.  In this discussion of social contract theory Schneier makes it clear that many institutions are important to minimizing the bad acts of defectors.  

Schneier's comprehensive view of societal influences reminded me of Lawrence Lessig's book "Code" which explores markets, law, norms, and architecture as the framework for the behavior regulation.  Unlike Lessig's models, however, Schneier is less interested in what he calls the "honest majority" and much more focused on the "dishonest minority."  

For readers that enjoy Malcolm Gladwell's casual writing which typically involves a theory gently explained through interesting short stories, this book may be a bit too heavy to enjoy.  But for those that are willing to set aside some time to dig into the wide variety of ideas and research that have been knit together to form this text, the results will be rewarding.  

Image by Rob Pongsajapan

There are many great summaries of the new European Commission framework on data protection (see Details of EU Data Protection Reform Reveal Dramatic Proposed Changes by Bret Cohen or European Commission Publishes New Framework on Data Protection by the IAPP Staff)  But the most interesting article I have read on the topic was published by Jane Yakowitz and titled "More Crap From the E.U."  

Jane digs into the proposals and counters some of the common assumptions about the E.U. better protecting consumer privacy. I recommend reading her article but I will highlight two points she made that are worth thinking about.

1. Article 17 and the Right to be Forgotten 
   1. Generally, the right to be forgotten covers all publications of personal information and it will give E.U. residents a right to control and delete their personal information. While this right is somewhat limited by an exception for information necessary for historical, statistical and scientific research purposes, Jane points out that this ability to delete data crushes the value of personal information for E.U. residents which may reduce their ability to participate in the free-services-for-information business model that currently flourishes on the Internet. 
2. Articles 19 and 20 and the Right to Object to Automated Processing
   1. This will give E.U. residents the ability to opt out of profile creation by means of automated processing. Jane sees two possible unintended implications of opting out: 1) it labels the E.U. residents opting out as a risk and/or 2) predictive models become skewed when E.U. residents opt out and it decrease the efficiency of credit markets and other markets that rely on automated profiles to determine risk. 

Overall, every attempt to regulate will lead to unintended consequences and it is only by looking at the effects in the aggregate that the value of regulation can be understood. That said, I think it's important to bring the unintended consequences to light because it would be a shame to stunt the information economy in an attempt to promote it.

Antoine Jones is a night club owner who had a GPS tracking device attached to his car by government officials for 30 days.  The use of the GPS device led to the discovery of a stash of money and drugs.  In the U.S. v. Jones case, the government did get a warrant.  The issue was that the government attached the GPS device after the warrant had expired.  In deciding the case, the Supreme Court focused on the property rights of Antoine Jones as a way of justifying the need for a warrant.  The argument essentially states that the act of attaching the device to the vehicle was a trespass on the property of Antoine Jones.  Because this invasion is required, the government is required to have a valid warrant to carry out the tracking activity.

Given this ancient metaphor of physical invasion as the justification for the invasion of property, the scope of this warrant requirement may not be clear as it applies to other similar GPS tracking scenarios.   Looking to the concurring opinions from Justices Sonia Sotomayor and Samuel Alito shows that the court considered the right to privacy beyond the physical invasion model described by Justice Antonin Scalia in the majority opinion.  For example, Justice Sonia Sotomayor raises the possibility of collecting the same tracking information without the need for physical invasion by using GPS units built into the vehicle or by following a suspect's smartphones GPS signal.  In the absence of trespass, a Fourth Amendment search occurs "when the government violates a subjective expectation of privacy that society recognizes as reasonable.” (Kyllo v. United States, 533 U. S. 27, 33 (2001))  Perhaps the best quote that captures the tension between the majority and concurring opinions comes on page 11 of the opinion when Justice Antonin Scalia, writing for the majority, states: 

The concurrence faults our approach for “present[ing] particularly vexing problems” in cases that do not involve physical contact, such as those that involve the transmission of electronic signals.  We entirely fail to understand that point.  For unlike the concurrence, which would make Katz the exclusive test, we do not make trespass the exclusive test.  Situations involving merely the transmission of electronic signals without trespass would remain subject to Katz analysis. 

So is Katz a test that is applied or the test that is applied?  According to the majority, both property protections and the Katz “reasonable expectation of privacy” will remain viable protections.  The majority relied on the easier to define and more narrow property justification in this case.  Given the dual conception of protections from government tracking, it appears that there is more to be decided in future cases before we have a clear sense of whether tracking, absent physical invasion, will require a warrant.  

The Opinion: http://www.supremecourt.gov/opinions/11pdf/10-1259.pdf