Unauthorized Access

Front matter

UNAUTHORIZED ACCESS

The Crisis in Online Privacy and Security

Robert H. Sloan $ Richard WARNER

CHAPTER 1 » Introduction 1

CHAPTER 2 = An Explanation of the Internet, Computers, and Data Mining 13 CHAPTER 3 = Norms and Markets 53 CHAPTER 4 = Informational Privacy: The General Theory 75

CHAPTER 5 = Informational Privacy: Norms and Value Optimality 95

CHAPTER 6 » Software Vulnerabilities and the Low-Priced Software Norm 125

CHAPTER 7 = Software Vulnerabilities: Creating Best Practices 157

CHAPTER 8 = Computers and Networks: Attack and Defense 181

CHAPTER 9 » Malware, Norms, and ISPs 221 vi ™ Contents at a Glance

CHAPTER 10 » Malware: Creating a Best Practices Norm 251 CHAPTER 11 » Tracking, Contracting, and Behavioral Advertising 273 CHAPTER 12 » From One-Sided Chicken to Value Optimal Norms 303

INDEX, 355

Contents

Preface, xix Acknowledgments, xxi

Authors, xxiii

CHAPTER 1 = Introduction

CHAPTER 2 » An Explanation of the Internet, Computers, and Data Mining o N A ù N N NY HK] INTRODUCTION PRIMER ON THE INTERNET History viii = Contents

Nature of the Internet: Packet-Switched Network 17 End-to-End Principle and the “Stupid” Network 19

A More Technical View 22 Horizontal View: One Home’s LAN to the Backbone 22 Vertical View: Internet Protocol Suite 24 Internet Layer 25 Transport Layer 26 Application Layer 28 How the Layers Work Together: Packet Encapsulation 28 Numerical Addresses to Names: DNS 30 Putting It All Together 30 PRIMER ON COMPUTERS 31 Basic Elements of a Computer 33 Operating Systems 38 PRIMER ON DATA, DATABASES, AND DATA MINING 40 Data and Their Representation 40 Databases 43 Information Extraction or Data Mining 43 NOTES AND REFERENCES 48 FURTHER READING 49 CHAPTER 3 » Norms and Markets 53 INTRODUCTION 53 NORMS DEFINED 53 The Examples 53 The Definition 54 Why People Conform to Norms 54 Ought or Self-Interest? 55 How Do Norms Get Started? 55 COORDINATION NORMS 56 Examples 56 Definition of a Coordination Norm 58

Contents m ix

Conformity to Coordination Norms 58 Self-Perpetuating Inappropriate Norms 59 VALUE OPTIMAL NORMS 59 Justification and Optimality 59 Lack of Value Optimality: An Example 60 Why Does Value Optimality Matter? 61 A Terminological Point and an Example 61 We Are “Playing without a Helmet” 61 Inappropriate Norms versus No Norms 62 NORMS AND MARKETS 63 Detecting Norm Violations 64 Norm-Violation Detectors versus Norm-Inconsistent Sellers 65 Sellers’ Inability to Discriminate 65 The Profit-Maximizing Strategy 65 Perfect Competition 66 Perfect Competition or Close to It Will Force Sellers’ Compliance 67 NORMS AND GAME THEORY 67 Coordination Problems 68 Equilibria 70 Value Optimality 71 NOTES AND REFERENCES 72 FURTHER READING 73 CHAPTER 4 « Informational Privacy: The General Theory 75 INTRODUCTION 75 PERSONALLY IDENTIFIABLE: A DISTINCTION WITHOUT (MUCH OF) A DIFFERENCE 76 THE REQUIREMENT OF FREE AND INFORMED CONSENT 78 PROBLEMS WITH NOTICE AND CHOICE 79 Notice and Choice Does Not Ensure Informed Consent 80

Notice and Choice Cannot Possibly Ensure Informed Consent 80 Notice and Choice Aims at the Wrong Target 81 x m Contents

INFORMATIONAL NORMS 82 Role-Appropriate Informational Norms as Coordination Norms 84 ENSURING FREE AND INFORMED CONSENT 86 Informed Consent 86 Free Consent 87 The Argument That Consent Is Not Free 87 Radin’s Requirements Almost Fulfilled 88 But What about Contracts? 89 THE IDEAL OF NORM COMPLETENESS 89 Two Ways to Fall Short 90 How Norms Can Cease to Be Value Optimal 90 NOTES AND REFERENCES 91 FURTHER READING 92

CHAPTER 5 = Informational Privacy: Norms and Value

Optimality 95 INTRODUCTION 95 DIRECT MARKETING: RETAILERS AS INFORMATION BROKERS 96

Retailers as Information Brokers 97 Role-Appropriate Information Processing Norms 98 Retailers as Information Brokers Norm 99 The Norm Is Not Value Optimal 100 An Objection 101 A Consequence 102 INFORMATION AGGREGATORS 103 The Current Norm and Its Problems 106 Beyond Lack of Control 107 THE HEALTH INSURANCE INDUSTRY 107 The Norm 108

The Health Insurance Norm Is Not Value Optimal 109

Contents m xi

MORE EXAMPLES 109 Cookies 110 Cookies and Targeted Advertising 111

The Resort to the Illusion of Consent 112 Cloud Computing 113 Unresolved Questions and the Resort to Notice and Choice 115 Social Networking Sites 115 Blurring the Line 117 More Blurring of the Line 118

The Resort to Notice and Choice 119 COLLABORATE OR RESIST? 119 NOTES AND REFERENCES 120 FURTHER READING 122

CHAPTER 6 » Software Vulnerabilities and the Low-Priced

Software Norm 125 INTRODUCTION 125 WHAT BUYERS DEMAND 126

Vulnerability-Exacerbating Features of the Software Market 127 Negative Externality and Ways to Cure It 129 STRICT LIABILITY 130 NEGLIGENCE 132

Vulnerability-Reducing Practices for Software Development 134 Negligence Liability Will Not Lead to Adoption of Better

Practices 135

Why Developers Must Know How Much to Invest in

Reducing Vulnerabilities 137

Consequences of Not Knowing How Much to Invest in

Vulnerability Reduction 137 PRODUCT LIABILITY FOR DEFECTIVE DESIGN 138 THE STATUTORY ALTERNATIVE 139

WE ARE TRAPPED AND ONLY LEGAL REGULATION WILL RELEASE US 139 xii = Contents

THREE EXAMPLES OF VALUE OPTIMAL PRODUCT-RISK

NORMS 141 The Fitness Norm 141 The Negligent Design/Manufacture Norm 142 The Best Loss-Avoider Norm 145 A Key Feature: Norm-Implemented Trade- offs 145

THE LOW-PRICED SOFTWARE NORM 146 Fitness, Negligent Design/Manufacture, and Best Loss Avoider 147 The Low-Priced Software Norm Is Not Value Optimal 149

WE NEED TO CREATE A VALUE OPTIMAL NORM—BUT

WHAT SHOULD IT BE? 150

CHAPTER 7 » Software Vulnerabilities: Creating Best

Practices 157 INTRODUCTION 157 BEST PRACTICES DEFINED 157 BEST PRACTICES FOR SOFTWARE DEVELOPMENT 160

“To Some Extent”: An Important Qualification 161 CREATING THE BEST PRACTICES SOFTWARE NORM 162 Defining Best Practices 165 Statutory and Regulatory Options for Defining Best Practices 166 Norm Creation in Ideal Markets 168 Real-World Markets: Lack of Market Power, No Barriers to Entry or Exit, and Zero Transaction Costs 169 Five out of Six 170 The Perfect Information Barrier 170 NORM CREATION IN REAL MARKETS 171 What Markets Should We Regulate? 173

Should We Worry about a “Lemons” Market? 175

Contents m xiii

UNAUTHORIZED ACCESS: BEYOND SOFTWARE

VULNERABILITIES 177 NOTES AND REFERENCES 177 FURTHER READING 178

CHAPTER 8 » Computers and Networks: Attack and

Defense 181 INTRODUCTION 181 TYPES OF DOORS 182

Gates (Outermost Doors) 183 Doors into Our Computers 184 Unintended Doors 185 Zero-Day Attacks 186 The CIA Triad 186 ATTACKS ON AVAILABILITY 187 ATTACKING CONFIDENTIALITY: HANGING OUT IN THE NEIGHBORHOOD 189 Packet Sniffing 190 Session Hijacking 191 ATTACKS ON AUTHENTICATION 192 Password Cracking 193 ATTACKS ON INTEGRITY 194 Secret Doors 194 Unintended Doors: Software and Hardware Vulnerabilities 195 Unwanted Doors: Web Server Vulnerabilities 196 Doors We Are Tricked into Opening 201 MULTIPLYING, ELIMINATING, AND LOCKING DOORS 206 Multiplying Doors 207 Eliminating Doors 207 Locking Doors 208 POSTING GUARDS 209 Authentication 210

Firewalls 210 xiv m Contents

Intrusion Detection and Prevention Services 213 LOCKING AND GUARDING DOORS IS HARD AND WE DO A POOR JOB 214 Unlocked Doors We Don’t Know About 214 Doors We Don’t Realize We Should Lock 215 Limitations on Guards 215 SHOULD ISPS LOCK DOORS AND CHECK CREDENTIALS? 217 NOTES AND REFERENCES 217 FURTHER READING 219 CHAPTER 9 » Malware, Norms, and ISPs 221 INTRODUCTION 221 A MALWARE DEFINITION 222 Malware and Lack of Consent 223 Don’t We Just Mean Illegal, or at Least Harmful? 224 Making “Especially Objectionable” More Precise 225 Are Tracking Cookies Malware? 227 THE MALWARE ZOO 228 Viruses and Worms 229 Trojans 231 Rootkits 231 Bots and Botnets 233 Spyware 235 The Latest Trend 235 WHY END-USER DEFENSES ARE SO WEAK 236 The Limits of Detection 236 Poor Use of Poor Tools 237 The ISP Alternative 239 THE “END-USER-LOCATED ANTIVIRUS” NORM 240 Importance of Network Neutrality 241

Home-User-Located Antimalware Defense Is Not Value Optimal 242

Contents ™ xv

FIRE PREVENTION AND PUBLIC HEALTH 243 COMPARE MALWARE 244 IS BETTER PROTECTION WORTH VIOLATING NETWORK NEUTRALITY? 245 The Risk to Privacy 245 The Risk to Free Expression 246 THE VALUE OPTIMAL NORM SOLUTION 247 NOTES AND REFERENCES 247 FURTHER READING 249 CHAPTER 10 » Malware: Creating a Best Practices Norm 251 INTRODUCTION 251 CURRENT BEST PRACTICES FOR ISP MALWARE DEFENSE 251 Sample Current Technical Best Practices 252 The Other Categories of ISP (Best?) Practices 256 Why Current Best Practices Are Not All That We Need 257 AN ADDITIONAL WRINKLE: THE DEFINITION OF MALWARE IS NOT FULLY SETTLED 260 DEFINING COMPREHENSIVE BEST PRACTICES 261 Definitional Issues 261 CREATING THE NORM 262 Norm Creation in Perfectly Competitive Markets 262 No Market Power, No Entry/Exit Barriers, and No Transaction Costs 264 The Perfect Knowledge Barrier 264 NORM CREATION IN REAL MARKETS 265 No Worry about Lemons Market 266 THE END-TO-END AND NETWORK NEUTRALITY PRINCIPLES 267 HAS OUR FOCUS BEEN TOO NARROW? 268 WAS OUR FOCUS TOO NARROW IN ANOTHER WAY? 270 NOTES AND REFERENCES 270 xvi = Contents

CHAPTER 11 «a Tracking, Contracting, and Behavioral

Advertising 273 INTRODUCTION 273 BEHAVIORAL ADVERTISING AND THE ONLINE ADVERTISING ECOSYSTEM 275 HOW WEBSITES GAIN INFORMATION ABOUT YOU: STRAIGHTFORWARD METHODS 277

You Identify Yourself Using a Login ID 277 Websites Know Your IP Number 278 Cookies: A Deeper Dive into the Technology 279 Making a “Signature” out of Browser, OS, Fonts Installed, etc. 283 OTHER WAYS OF GETTING YOUR ONLINE INFORMATION 284 WHAT IS WRONG WITH BEHAVIORAL ADVERTISING? 285 Lack of Choice for Buyers 285 Acquiescence via Contract 286 Fixing What Is Broken 287 THE SECOND-ORDER CONTRACTUAL NORM 288 Compatibility 290 Are We Right? 292 HOW THE NORM ARISES IN IDEAL MARKETS 293 REAL MARKETS: HOW THE COORDINATION NORM ARISES 294 Buyers 294 Sellers 296 How Contracting Can Go Wrong 298 THE LACK OF CONSENT TO PAY-WITH-DATA EXCHANGES 298 NOTES AND REFERENCES 300 FURTHER READING 301 CHAPTER 12 » From One-Sided Chicken to Value Optimal

Norms 303

INTRODUCTION 303

Contents @ xvii

CHICKEN WITH CARS THE PAY-WITH-DATA GAME OF ONE-SIDED CHICKEN Buyers’ Preferences Sellers’ Preferences One-Sided Chicken Escaping One-Sided Chicken

NORM CREATION IN PERFECTLY COMPETITIVE MARKETS

Approximation to Perfect Competition in Pay-with-Data Exchanges

Approximation to Perfect Information in the Real World NORM CREATION IN THE REAL MARKET Buyers Will Use Blocking Technologies Advertising Revenue Will Decline Sellers Will Conform More Closely to Buyers’ Preferences Norms? Yes. Value Optimal? Yes, but...

DOES FACEBOOK PLAY ONE-SIDED CHICKEN?

As Goes Facebook, So Goes Google?

DO-NOT-TRACK INITIATIVES

MORE “BUYER POWER” APPROACHES TO NORM GENERATION

Mobile Apps Cloud Computing Summary of Our Norm-Generation Strategies So Far

TWO VERSIONS OF THE BEST PRACTICES STATUTE APPROACH

PRISONER’S DILEMMA Information Aggregators A Classic Prisoner’s Dilemma Prisoner’s Dilemma for Business Buyers How Many Players Are in This Game Anyway?

Trust and Commitment

303 305 306 307 308 308

320 320 322 322

THE NEED FOR TRUST Retailers as Information Brokers Health Insurance Employer Hiring Beyond Buying and Selling IF WE FAIL TO CREATE NORMS THE BIG DATA FUTURE

APPENDIX: A GAME THEORETIC ANALYSIS OF FACEBOOK’S PRIVACY SETTINGS

NOTES AND REFERENCES FURTHER READING

INDEX, 355

334 334 337 338 339

340 341

344 349 352

Preface

T BOOK GREW OUT of a course the two of us taught together about online privacy and security to an integrated group of computer science and law students. By teaching that course, we learned how to explain thorny legal issues to computer science students, as well as complex technical questions of computer security to law students who were once English and political science majors.

Privacy and security are, of course, affected by technological decisions made by the likes of Microsoft, Facebook, Google, and the major Internet service providers. However, many of their decisions are driven by legal, regulatory, and economic considerations, which are in turn profoundly influenced by public policy. This book considers what public policy should be for online privacy and security. In this book we take a step beyond works that present the issues and problems and we also propose specific solutions. People always point out drawbacks to solutions, and they will do so with ours, but creating a framework for this discussion is one of our central goals. We believe in our solutions, and we believe even more firmly that society will not resolve critical questions about privacy and security without an informed discussion.

An informed discussion must be a discussion among disparate disciplines—including, at a minimum, computer scientists, economists, lawyers, and public-policy makers. We hope that this book will bridge the gaps between these disciplines. We describe sophisticated technological, economic, legal, and public policy issues, but we write in plain English. Readers need no technical and no legal expertise. We emphasize the need to make trade-offs among the complex concerns that arise in the context of online privacy and security. We introduce the theme of trade-offs in the first chapter and we close with it in the last chapter. Our book is a call for reasoned compromise. Please critique our solutions.

Robert Sloan Richard Warner xix

Acknowledgments

E BENEFITED GREATLY FROM the work of Helen Nissenbaum and

James Rule. Nissenbaum deepened our understanding of norms and how they work, and Rule provided insight into the need for trade-offs and the complex issues they raise. We also gratefully acknowledge our debt to Lori Andrews. We benefited from her work, from discussions of privacy, and from her encouragement. Harold Krent read early versions of (what became) Chapters 3 through 7 and we benefited from his insights. Shai Simonson read later versions of Chapters 1 through 4 and provided much helpful feedback. Earlier versions of Chapters 4, 5, and 12 were presented at the 2011 and 2012 Privacy Law Scholars Conference, and we thank our audiences for helpful comments and encouragement. We thank Dan Bernstein, Jon Solworth, and Venkat Venkatakrishnan for helpful conversations and insights about a number of the fine points of computer security; Mark Grechanik for helpful conversations and insights about software engineering; and Bob Goldstein for providing the viewpoint of a senior IT manager on several security threats. We thank Daniel Saunders for his excellent help with our line drawings and other figures.

We thank the National Science Foundation and program officer extraordinaire Dr. Sylvia Spengler for support of our general research in this area, including the 2011 and 2012 Privacy Law Scholars papers (though not this book directly), under National Science Foundation Grant Number IIS-0959116. Of course, any opinions, findings, and conclusions or recommendations expressed in this book are those of the authors and do not necessarily reflect the views of the National Science Foundation.

We are indebted to our editors, Alan Apt and Randi Cohen of Taylor & Francis, for their time and expertise; we wish Alan a glorious retirement and thank him for originally signing this project.

Robert Sloan gratefully acknowledges the patience and kind understanding of his wife, Maurine Neiberg, and daughters, Rose and Emma

Xxi xxii m Acknowledgments

Neiberg Sloan, during the writing of this book. He further thanks older daughter Rose for some helpful proofreading and feedback, and Maurine (ScM, computer science, and JD) for extensive reading and commentary; he congratulates her for successfully walking the very narrow path between constructive criticism and inciting a riot.

Richard Warner gratefully acknowledges the unending patience and support of his wife, Ky Southworth, who made it possible for him to devote so much of the day to writing and from whose common sense about privacy he always profits. He would also like to thank Sip, the coffeehouse in which he did most of the writing, for its hospitality and coffee.

Authors

Robert H. Sloan is professor and department head in the Department of Computer Science of the University of Illinois at Chicago. For 2 years, starting in January 2001, he served as the program director of the Theory of Computing Program at the National Science Foundation. He has published extensively in the areas of computer security, theoretical computer science, and artificial intelligence. He holds a BS (mathematics) from Yale University and an SM and PhD from the Massachusetts Institute of Technology (computer science). He was a postdoctoral fellow at Harvard and also spent 1 year taking classes at Yale Law School.

Richard Warner is professor and Norman and Edna Freehling scholar at the Illinois Institute of Technology Chicago-Kent College of Law, where he is the faculty director of the Center for Law and Computers. Prior to joining Chicago-Kent, he was a philosophy professor, first at the University of Pennsylvania and then at the University of Southern California. He is visiting foreign professor in the law faculty at University of Gdansk, Poland. He is the director of the School of American Law, which has branches in Poland, Ukraine, and Georgia; editor-in-chief of Emerging Markets: A Review of Business and Legal Issues; and a member of the US Secret Service’s Electronic and Financial Crimes Taskforce. From 1994 to 1996, he was president of InterActive Computer Tutorials, a software company, and from 1998 to 2000, he was director of Building Businesses on the Web, an Illinois Institute of Technology executive education program. He holds a BA (English literature) from Stanford University; a PhD (philosophy) from the University of California, Berkeley; and a JD from the University of Southern California. His research interests include privacy, security, contracts, and the nature of values and their relation to action.

xxiii

CHAPTER 1

Many excellent books offer illuminating descriptions of the current crises in online privacy and security. We take the next step and offer solutions. Our solutions are public policy recommendations. Society needs innovative policies to reap the proper benefits from rapid technological change. We hope our recommendations will be adopted and be successful, but we also have another important goal: a shared understanding of the problems and a common language in which to discuss and analyze solutions. Finding adequate solutions to today’s online privacy and security problems requires combining a computer scientist’s expertise with a lawyer’s understanding of how to forge sound public policy and laws. You don’t need to be a legal scholar or to know any computer science to read this book, even though it contains sophisticated and accurate computer science and law. We have written as much as possible in plain English, but our plain English descriptions should be of interest even to experts. Solving the privacy and security problems means experts in one field have to find ways to communicate with experts in another.

We limit our discussion of privacy and security to the private sector. For security, this is not a significant limitation. Everything we say also applies to governmental computers and networks. Privacy is a different matter. Governmental intrusions into privacy raise legal and political issues that don’t arise when private businesses encroach on privacy. The governmental threat is serious and increasingly worrisome. However, the chorus of concern over government intrusion into our private lives is already large and strong. Moreover, the threat from private business merits consideration on its own. Indeed, as the New York Times said in a 2012 article, the database marketing firm Acxiom “knows who you are. It knows where you live. It knows what you do. It peers deeper into American life than the F.B.I. or the I.R.S”! Businesses routinely watch and record massive amounts of information about people’s Internet activities. Businesses now have the technological means to merge your online and offline footprints into profiles of surprising intrusiveness and accuracy. They can know where you work, how you spend your time and with whom, and even “with 87% certainty...where you'll be next Thursday at 5:35 p.m.”?

THE GOOD, THE BAD, AND THE IN BETWEEN

We divide the new twenty-first century world of rich online lives and vast computing power into the good, the bad, and the in between. We begin with the good and then turn quickly to our primary concern—the bad and the in between. We need a short way to refer today’s combination of online society, the entire World Wide Web, huge databases, data mining, and vast computing power, so, for this section only, we will call it “the Internet,” even though the Internet is only part of the world that concerns us.

The Good

Before the Internet, media-rich, worldwide communication was the prerogative of governments and well funded publishing companies. The Internet makes it possible for anyone with Internet access to communicate with anyone in the world and to access almost all the world’s information in an instant. People can communicate and coordinate no matter how geographically diverse, no matter how few or how many. Freedom of association and expression flourish, as does innovation. Novel achievements include, among many others, marvels of decentralized coordination like Wikipedia and communication platforms like Facebook. While such marvels of the Internet age have at times been double edged, society has benefited greatly from them.

The Bad

Hackers exploit the very information-sharing features of the Internet that have brought so much good. To gain access to people’s computers, they reuse old techniques in the new media, such as exploiting human gullibility. They also avail themselves of new tools, such as viruses, worms, Trojans, rootkits, cross-site scripting, and structured query language (SQL) injection. Unauthorized access to computers and computer

Introduction = 3 networks is rampant. Once hackers get into a computer, they deploy numerous threats, including denial-of-service attacks, packet sniffing, and session hijacking, and they commit crimes such as identity theft, extortion, theft of money or data, and industrial espionage. How can individuals, companies, and government together control crime while preserving everyone’s freedom to communicate and coordinate? Our suggestions focus on both improving software quality and eliminating malicious software, malware for short.

Current software development practices make it too easy for hackers to turn our own beneficial software against us and use it to infiltrate computers and networks. Richard C. Clarke, cyber security advisor to Presidents Clinton, Bush, and Obama, relates an anecdote that captures the severity of the problem. “When I asked the head of network security for AT&T what he would do if someone made him Cyber Czar for a day, he didn’t hesitate, ‘Software.”? But serious as it is, software is only part of the problem. Once hackers get inside a computer, they install their tool of choice—malware. Malware includes viruses, worms, and Trojans, but there are also other inhabitants of the “malware zoo.” We describe them in Chapter 9. Current defenses against malware are woefully inadequate.

Making things better is no simple task. The practices that make us all vulnerable also give us benefits. They give software developers and Internet service providers the freedom and flexibility they need to respond and innovate in a rapidly changing technological environment, and they ensure that both software and Internet access are inexpensive and easy to use. Securing users against Internet crime will decrease flexibility and innovation and make software and Internet access more expensive and more difficult to use. Throughout this book, we focus on finding the optimal trade-off between these costs and more security.

The In Between

A lot of activity on the Internet falls in our “in between” category: activity that makes many people uncomfortable, but about which, in the spirit of the Facebook age, we say, “It’s complicated,” rather than “It’s bad.” For example, let’s look at business and government surveillance. If the surveillance is illegal, it belongs in our “bad” category, but a vast amount of surveillance is legal or at least not clearly illegal. There are significant benefits: new services, conveniences, and efficiencies. But the price is deep inroads into privacy that threaten to destroy the freedom of association and expression the Internet has offered so far. The result of the legal surveillance is an ambiguous mix of positives and negatives that lies in between the clearly good and clearly bad. As we note in Chapter 5, 20+ years of studies and surveys show that people want to have their cake and eat it too. People want the benefits of personalization that increased computing power offers, but people also want their private information to stay private. Having both means finding trade-offs that give everyone enough of each.

MAKING TRADE-OFFS

A common feature of the trade-offs we examine is that they are unavoidable. For example, you must choose, if only by default, either to spend money on insurance against fraudulent impersonation—generally called identity theft—or not. To illustrate trade-offs, think about what is involved in explicitly making the decision. If you are a victim of identity theft, according to one recent report, it will take you about 12 hours and $354 to resolve the problem.‘ Let’s suppose you value your time at $200 an hour. You then face a total quantifiable financial loss of $2,754. However, the trade-offs that concern us involve both quantifiable and nonquantifiable costs and benefits, and this considerably complicates matters. Suppose you can buy insurance against identity theft for about $275 a year. Should you do so? The answer is easy if we just consider quantifiable factors. We just need to know how likely it is that you will be a victim of identity theft. The probability turns out to be low—about 5 percent. This makes your expected loss (the $2,474 discounted by the 95 percent probability of not being a victim) just under $138. So, as long as we consider only quantitative factors, it would be wasteful to buy the insurance because you would spend $275 to save $138.

Quantifiable concerns are not all that matter, however. Suppose, like many, you dislike taking risks. Imagine that if you were a victim, you would suffer from a very disturbing and long lasting sense of personal invasion resulting in significantly increased anxiety about online financial transactions. Is it worth spending $275 to save $138 and to get protection against these losses? It is extremely difficult, if not impossible, to quantify your sense of personal invasion in any meaningful way, so there is no quantitative calculation that can answer the question. Deciding whether to trade $275 for the protection offered requires finding a way to balance spending $275 against both quantitative and nonquantitative gains.

The trade-offs that will concern us when we consider software, malware, and privacy require balancing quantitative and nonquantitative

Introduction m 5 interests. Society as a whole, together with the software industry, must choose some trade-off between making mass-market software more resistant to malware attacks versus making software less expensive. Choosing a trade-off requires balancing economic efficiency, improved security, innovation, competition, freedom of expression, and a vast array of other concerns, including several implicated in privacy. Today, in most cases, consumers and government make very poor trade-offs in the areas of online security and privacy and often make the trade-offs implicitly, with very little thought. There is currently no consensus about how these tradeoffs should be made.

The lack of consensus would not matter much if we were still living in the mid-twentieth century, but, as is illustrated in Figure 1.1 and discussed at some length in Chapter 2, our world has changed. Before the Internet and modern digital technologies, security was largely a matter of protecting places and persons, and within the limits of the law, everyone could decide for himself or herself how much security was required. Sally’s decisions about security might still have affected Jim’s security, since if Sally’s house was extremely well protected, burglars might have preferred to target Jim’s, but Jim’s degree of security was still typically under Jim’s control because he could choose to protect his house better. As we illustrate in Chapters 6-10, in the Internet world everyone is interconnected in ways that make each person’s degree of online security highly dependent on the degree of security of others. If anyone individually is to have adequate security, then weak links in the chain must be avoided through a consensus about how much security everyone requires.

Similar remarks apply to privacy. In the mid-twentieth century, everybody had considerable power to ensure that what he or she thought should be private would in fact be so. Online data collection did not exist, although a precursor had appeared: Credit card companies kept reports on customers in manila file folders. Surveillance techniques were primitive by today’s standards. Today, as we discuss in Chapters 4, 5, 11, and 12, the Internet and an astonishing increase in information processing power have deprived people of the control over their privacy that they once had. To protect privacy adequately, society needs consensus about how to use the twenty-first century’s new information processing power. In Chapter 12 we present our solution, which is to design decision processes that will lead to more or less general agreement about which uses are legitimate. The following discussion of values provides background essential to developing our decision procedures.

Early 1940s

1993 1994

2007-2012

October 2012

FIGURE 1.1

First computers; processing speeds about 5 operations per second

ARPANET, experimental network that will become the Internet, goes online with four locations

First e-mail sent on ARPANET; high-end version of IBM System 370 mainframe has processing speed about 1 million operations per second (inexpensive modern laptops process billions of operations per second)

Many companies including Apple and Tandy sell early personal computers to hobbyists IBM introduces the 5150 PC with a processing speed of 5 million operations per second

Apple releases the $2500 Macintosh, with graphical user interface and processing speed of 6 million operations per second

Many research universities and government labs join the Internet; number of sites crosses 1000

Tim Berners-Lee releases what will become the World Wide Web to small group of computer users at the CERN research center in Switzerland

Mosaic released, first web browser popular with public

First Intel Pentium chips and computers, with processing speeds about 200 million operations per second

General US public becomes increasingly aware of Web; Amazon.com begins service Number of Internet sites passes 10 million

Google founded

Dot Com boom

Dot Com bust

Wikipedia founded

Percentage of individuals using the Internet in the US crosses 50%

O'Reilly Media hosts first Web 2.0 Conference

Facebook founded

Percentage of individuals using the Internet in the developed world crosses 50%

Inexpensive computers’ processing speeds are billions of operations per second; fastest computers’ processing speeds are trillions of operations per second

Facebook passes one billion active users

Time line of growth of the Internet and computer processing speed.

Introduction m 7

VALUES

Values always guide trade-offs. The decision whether to buy insurance against identity theft is a matter of making trade-offs among what you value—freedom from risk and protection against a sense of personal invasion against the other things for which you could use the money. A good nontechnical explanation of the ideal trade-off for you is that it is the one that is the best for you in terms of all the different things you care about: the trade-off that is the best justified in light of all your values. We discuss this in detail in Chapter 3. But people cannot always live up to that ideal. To begin with, there may be no single trade-off that is best justified. Your values might argue equally strongly in favor incompatible options: For example, you may value exercising after work and coming home earlier to your children equally. In such cases, our theory aims at choosing any of the equally good alternatives.