4 ms·

I don't think a giant new source of income for insurance companies and slip and fall con artists will fix anything.. Each individual company might try to motiv

I don't think a giant new source of income for insurance companies and slip and fall con artists will fix anything.. Each individual company might try to motivate slightly better behavior in their own clients but overall they want their administrative percentage of a growth industry so they drive up absurd costs like the US health care industry.

eru 6y ago
You make an interesting point that with enough bad regulation, you can destroy any good and sensible idea.
- foolmeonce 6y ago
  Adding high value to stolen personal data is a sufficient bad regulation alone. The goal is to remove value so there's no expectations of ransom and therefore no thefts. If a company has to pay X for the loss off data, they would be fools not to pay x/100 to someone who breaks in, steals the data and promises not to report it.
  - eru 6y ago
    We have similar situation and incentives for eg poisoning a few jars in a food factory. (And I have read of some rare cases where that was actually a problem.) What keeps that from being too much of a concern? What similar factors apply in the data breach ransom scenario? What's different? (Just for clarification: if a bad actor poisons a few jars, the producer in question is probably not legally responsible; but they still face a significant cost in lower sales. So blackmail is just as possible.)
    - foolmeonce 6y ago
      That's the example I was thinking of, I'm quite happy with government concerning itself with regulations on options, etc, working closely with the food industry, and perhaps I'm alive only since no free marketeer was around to introduce an unconditional $10k fine per malicious tampering as a way to improve security during the painkiller scandals. Naturally, if free marketeers had created a market for food tampering that encouraged industry collusion with criminals instead of law enforcement, they would tell us it was an inevitable development and they are getting us the best outcome of many bad new realities.
      - eru 6y ago
        Your strawman seems a bit stupid. Real life companies are more long term greedy and ingenious. (Even if only because competition forces them to.) So even if there's an incentive to cooperate with a blackmail attempt that's already happening, there's also a strong incentive to get a reputation that prevents further blackmailing. If you have some time, listen to this podcast episode https://www.econtalk.org/anja-shortland-on-kidnap/ https://www.econtalk.org/anja-shortland-on-kidnap/ > Anja Shortland of King's College London talks about her book Kidnap with EconTalk host Russ Roberts. Kidnapping is relatively common in parts of the world where government authority is weak. Shortland explores this strange, frightening, but surprisingly orderly world. She shows how the interaction between kidnappers, victims, and insurance companies creates a somewhat predictable set of prices for ransom and creates a relatively high chance of the safe return of those who are kidnapped. The broad incentives in kidnapping cases are comparable to what we discussed. As far as I can tell the market for kidnapping insurance doesn't have any special regulation, so perhaps a good proxy for how a free market might operate. One of the main takeaways for me was that when eg an oil or mining concern buys kidnapping insurance for their employees, the insurance company strictly insists that employees not be told that there is insurance.
        foolmeonce 6y ago
        Here you seem to understand the basis for inference: > the insurance company strictly insists that employees not be told that there is insurance. The stated inference: >> Each individual company might try to motivate slightly better behavior in their own clients but overall they want their administrative percentage of a growth industry so they drive up absurd costs like the US health care industry The background concept that applies irregardless of whether a parasite is "criminal" or standard practice (of course every parasite can claim something symbiotic, maybe kidnapping is just freelance private security testing with post pricing): https://en.wikipedia.org/wiki/Parasite_load https://en.wikipedia.org/wiki/Parasite_load The insurance parasite/symbiote load as percentage of GDP, compare the 1980s to now: https://data.oecd.org/insurance/insurance-spending.htm https://data.oecd.org/insurance/insurance-spending.htm The percentage of GDP lost in ransom? 0%? Terrorist ransom was also popular in the 1980s but government interfered directly, preventing most private payments and that response was primarily with force. So, would a government demanding €10k for every kidnap of your employees they hear of fix a problem? No, it would make kidnapping more attractive. It would threaten to involve a larger parasite (clearly this is too late in the case of kidnapping in this century!) And you would have a permanent problem with a powerful parasitic market deriving more profit than the primary market of criminals. Luckily, for food conglomerates their stock price is uninsurable. Unluckily for humans, government hasn't stepped in to prevent a market and much more profitable secondary markets for kidnapping in this decade. Unluckily for private data most governments haven't come down on the use of laundered stolen private data (i.e. outlawing the sloppy US credit market, any unique pricing of insurance to a group, etc.) Luckily, they have not gone so incompetent as to add an incentive that makes all private data valuable.

eru 6y ago

You make an interesting point that with enough bad regulation, you can destroy any good and sensible idea.

foolmeonce 6y ago
Adding high value to stolen personal data is a sufficient bad regulation alone. The goal is to remove value so there's no expectations of ransom and therefore no thefts. If a company has to pay X for the loss off data, they would be fools not to pay x/100 to someone who breaks in, steals the data and promises not to report it.
- eru 6y ago
  We have similar situation and incentives for eg poisoning a few jars in a food factory. (And I have read of some rare cases where that was actually a problem.) What keeps that from being too much of a concern? What similar factors apply in the data breach ransom scenario? What's different? (Just for clarification: if a bad actor poisons a few jars, the producer in question is probably not legally responsible; but they still face a significant cost in lower sales. So blackmail is just as possible.)
  - foolmeonce 6y ago
    That's the example I was thinking of, I'm quite happy with government concerning itself with regulations on options, etc, working closely with the food industry, and perhaps I'm alive only since no free marketeer was around to introduce an unconditional $10k fine per malicious tampering as a way to improve security during the painkiller scandals. Naturally, if free marketeers had created a market for food tampering that encouraged industry collusion with criminals instead of law enforcement, they would tell us it was an inevitable development and they are getting us the best outcome of many bad new realities.
    - eru 6y ago
      Your strawman seems a bit stupid. Real life companies are more long term greedy and ingenious. (Even if only because competition forces them to.) So even if there's an incentive to cooperate with a blackmail attempt that's already happening, there's also a strong incentive to get a reputation that prevents further blackmailing. If you have some time, listen to this podcast episode https://www.econtalk.org/anja-shortland-on-kidnap/ https://www.econtalk.org/anja-shortland-on-kidnap/ > Anja Shortland of King's College London talks about her book Kidnap with EconTalk host Russ Roberts. Kidnapping is relatively common in parts of the world where government authority is weak. Shortland explores this strange, frightening, but surprisingly orderly world. She shows how the interaction between kidnappers, victims, and insurance companies creates a somewhat predictable set of prices for ransom and creates a relatively high chance of the safe return of those who are kidnapped. The broad incentives in kidnapping cases are comparable to what we discussed. As far as I can tell the market for kidnapping insurance doesn't have any special regulation, so perhaps a good proxy for how a free market might operate. One of the main takeaways for me was that when eg an oil or mining concern buys kidnapping insurance for their employees, the insurance company strictly insists that employees not be told that there is insurance.
      - foolmeonce 6y ago
        Here you seem to understand the basis for inference: > the insurance company strictly insists that employees not be told that there is insurance. The stated inference: >> Each individual company might try to motivate slightly better behavior in their own clients but overall they want their administrative percentage of a growth industry so they drive up absurd costs like the US health care industry The background concept that applies irregardless of whether a parasite is "criminal" or standard practice (of course every parasite can claim something symbiotic, maybe kidnapping is just freelance private security testing with post pricing): https://en.wikipedia.org/wiki/Parasite_load https://en.wikipedia.org/wiki/Parasite_load The insurance parasite/symbiote load as percentage of GDP, compare the 1980s to now: https://data.oecd.org/insurance/insurance-spending.htm https://data.oecd.org/insurance/insurance-spending.htm The percentage of GDP lost in ransom? 0%? Terrorist ransom was also popular in the 1980s but government interfered directly, preventing most private payments and that response was primarily with force. So, would a government demanding €10k for every kidnap of your employees they hear of fix a problem? No, it would make kidnapping more attractive. It would threaten to involve a larger parasite (clearly this is too late in the case of kidnapping in this century!) And you would have a permanent problem with a powerful parasitic market deriving more profit than the primary market of criminals. Luckily, for food conglomerates their stock price is uninsurable. Unluckily for humans, government hasn't stepped in to prevent a market and much more profitable secondary markets for kidnapping in this decade. Unluckily for private data most governments haven't come down on the use of laundered stolen private data (i.e. outlawing the sloppy US credit market, any unique pricing of insurance to a group, etc.) Luckily, they have not gone so incompetent as to add an incentive that makes all private data valuable.