Opinion Piece: A business perspective on the #AntiSec movement from a libertarian and economic viewpoint touched by Asian “Tiger Culture”.
PayPal Chief Security Officer, Michael Barrett, has called on industry and government to track down and punish the individuals involved.
"They can be found, and for the continued safety of the internet, we must identify them and have legitimate law enforcement processes appropriately punish them.”
Is the internet in danger to warrant the inquisition and witch hunt that will follow? No. If we reference the The Ethics of Liberty by Murray N. Rothbard we come to an very important passage
The first point is that the emphasis in punishment must be not on paying one’s debt to "society," whatever that may mean, but in paying one’s "debt" to the victim. Certainly, the initial part of that debt is restitution. This works clearly in cases of theft. If A has stolen $15,000 from B, then the first, or initial, part of A’s punishment must be to restore that $15,000 to the hands of B (plus damages, judicial and police costs, and interest foregone).
If we approach the Internet as a society it is not under any threat. The users and companies that have presence on the Internet and they may be victims of the AntiSec movement, but in Rothbard’s view each entity would be handled on a case by case involvement, preferably with no involvement from The State or society.
Proportionality in Punishment
Or where is my private utility?
The current system provides little public utility at the large expense of private utility. Mr. Rothbard describes the issue well.
We must note that the emphasis of restitution-punishment is diametrically opposite to the current practice of punishment. What happens nowadays is the following absurdity: A steals $15,000 from B. The government tracks down, tries, and convicts A, all at the expense of B, as one of the numerous taxpayers victimized in this process. Then, the government, instead of forcing A to repay B or to work at forced labor until that debt is paid, forces B, the victim, to pay taxes to support the criminal in prison for ten or twenty years’ time. Where in the world is the justice here? The victim not only loses his money, but pays more money besides for the dubious thrill of catching, convicting, and then supporting the criminal; and the criminal is still enslaved, but not to the good purpose of recompensing his victim.
Suppose that, as in most cases, the thief has already spent the money. In that case, the first step of proper libertarian punishment is to force the thief to work, and to allocate the ensuing income to the victim until the victim has been repaid. The ideal situation, then, puts the criminal frankly into a state of enslavement to his victim, the criminal continuing in that condition of just slavery until he has redressed the grievance of the man he has wronged.
The criminal justice system and prison are public goods that are non-excludable, by virtue of the fact that anyone can go to prison it the US. Prison is rivalrous though. This is due to the fact that prison is first come, first served which explains why prisons are overflowing with non-violent offenders and violent offenders are automatically let out with an ankle bracelet GPS unit. This can be traced back to the fact that it is easier for law enforcement to apprehend non-violent drug users and petty criminals, rather than don their SWAT gear and take on violent criminals. The People are not getting their money’s worth under the current system and we should not be encouraging the justice system to allow violent criminals on the streets while non-violent criminals, petty thieves, and white collar criminals are incarcerated at the inefficient use of taxpayer funds.
This is important in arguing against hunting the AntiSec movement. The cost of the witch hunt does not bring economic utility to anyone except the government who can make the case for additional law enforcement and prosecution resources. This decreases private utility and gives us a bloated bureaucracy that doesn’t help us as individuals. But doesn’t ignoring AntiSec affect other stakeholders? To call someone a stakeholder would mean that there is a mutual interest, which there is not one. We can refer to the other people involved as externalities, not stakeholders. Remember if someone commits a crime against your neighbor, you should not be paying for it.
In a libertarian community everybody takes care of themselves and resists being dragged into someone else’s business. This keeps costs low for those that have no incidents, and when properly applying moral hazard places third parties at risk which continues to keep an individual’s cost basis low. When we extend the philosophical concepts of libertarianism to hunting down AntiSec there is little reason to fund such an effort. We as individuals have no private utility or incentive to provide support for someone that we are disinterested in, be it a corporation or a neighbor. Public utility is also inefficiently increased by taking private tax money and funding an unnecessary and undesirable growth of government to track down the offenders.
A Tax On Everyone
Some would say that the shift to restitution, away from incarceration is not the direction we want to take our society. The prison system in Georgia costs approximately $3 million per day to run. That is $3 million too much. Our new Governor has asked the legislature to find a legal mechanism to retroactively lower the sentences of the people in prison because there is not enough tax revenue to support the system. Counties and cities are shrinking their police and fire departments because there is not enough tax revenue coming in due to the housing crisis. Among all these problems Mr. Barrett wants to increase the size of the police state, which we can’t afford and increase the size of the prison system, which we are trying to actively shrink.
Who Pays For That?
Are we not our brother’s keeper? Are we responsible for creating a cohesive society and upholding justice? While there is some economic benefit to pooling resources and funding police, military, and social services it is improper to conclude that we should be our brother’s keeper or that conventional views of society should continue to be encouraged. All expenditures should be first approached from the private benefit perspective, and all contributions to public good or public benefit must net all people benefit at the same time. If you are not a Citigroup stock holder or customer you have no private utility from funding law enforcement, the judicial system, or the prison system in dealing with cybercriminals or physical bank robbers. Enabling the attitude that we as a society should chip in to maintain order and protect corporations from criminals has lead to the corporate welf
are state we live in and the proliferation of Too Big To Fail for any reason.
Who should pay for hunting down cybercriminals or any criminal for that matter? The direct stakeholders should be paying for it. In the case of private corporations this will come from the cash flow that they derive from normally conducting business and from the equity that the stockholders (public or private) provide. Applying risk transference to an insurance company along with moral hazard can also provide funds. Corporations have their own private security forces, both physical and infosec. Rather than involving the law enforcement and taxpayers who are not direct stakeholders, corporations should use their internal security resources to serve as detectives.
In the case of crimes that take place across state lines or international boundaries there is a solution that is available as well. These are not called FBI Agents. They are called Private Investigators (PI’s). A PI has the same ability as the FBI to go to another company’s datacenter where an attack originated and ask for logs. That company is free to refuse access PI, and they are free to bill the PI for their time involved who will then pass the cost back to his client. This provides private benefit for both the company assisting the investigation and if the PI adds a premium to his cost it provides him with benefit as well. The FBI with a warrant can not be refused. This takes away from the value of the recipient of a warrant and we should not be encouraging a system where an investigator gets a free ride. This serves to devalue the time of the professionals being served a warrant to assist in an investigation that they are not stakeholders in.
The most law enforcement should be involved is to compel an offender, once found by the PI or corporate security, to appear in civil court to sit before a judge or arbiter who will rule on appropriate damages to the victim which can include indentured servitude until the debt is repaid. The state’s expenses would be paid by the victim corporation and would be subject to reimbursement once the defendant is found to be at fault for the damages. Would this approach make winning a case easy? Of course not, but again unless you are a direct stakeholder there is no reason to care one way or another because your private utility is still zero. Supporting the current “throw everyone in prison on the planet” philosophy does not add to private utility.
What About The Other Victims?
In an infosec breach there may be other victims such as individuals whose personal data has been stolen. In a pure libertarian society bystanders have no incentive to get involved and we can see that once again for the bystander there is zero private utility to be gained by helping someone that they do not have a personal stake in. If there is no law enforcement witch hunt to help these victims then what do they do? Based on their contract with the corporation handling their data, they can sue both the corporation and the Jon Doe thief. This approach allows the secondary victims to obtain compensation for their loss and inconvenience. It also preserves private benefit to those who are not involved without depriving the victims of their right to restitution.
We Can’t Turn A Blind Eye To This, Can We?
“No one would suggest encouraging improved physical security in the real world by decriminalising breaking and entering and classifying it as a sport; why should the online world be any different?” he [Barrett] said.
Mr. Barrett is very late to the party with this statement. The libertarian movement is for decriminalizing many things and doing away with the failed notion of every crime in society being a crime against the state. The legalization movement is a prime example of where Mr. Barrett gets it wrong. Marijuana use and prostitution are victimless crimes, but are categorized as crimes against the state. The libertarian movement seeks to legalize these so called crimes. Once they are no longer crimes anyone involved in that activity so no longer a criminal, thus we lower the crime rate. In the case of a crime with a victim we can apply the same libertarian concepts to the relevant legislation. This would require reengineering the criminal code to state that there are no crimes against the state except Treason. Crimes against individuals or property can be handled in civil court with reparations paid to the victim. Damage of state property would be treated just like individual property damage. This can work and is working. Many states are rolling back their criminal statutes because prison and a large police state is unaffordable.
Failure to Understand The Free Market
Or my employer has a monopoly and you can’t leave us.
Barrett is employed by a payments company that attempts to assert a monopoly on the market. It can be clearly seen by his disagreement with people who believe AntiSec can force organizations to improve poor security practice.
The AntiSec movement had existed for around a decade and was loosely guided by a mission statement to reveal poor security practice and put an end to security exploit disclosure which it said gave ammunition to criminal ‘black hat’ hackers and put consumers in danger.
But that was a false philosophy, according to Barrett.
“While many of them claim to be defending the internet they love, in practice it would seem that they are only hastening its demise. A cynical interpretation would suggest that what most of them desire is actually their ‘fifteen minutes of fame’.”
He disagreed with some commentators who argued the AntiSec movement may be effective in its mission to force organisations to improve poor information security practice.
Failure can be a great educational tool, as well as the one espoused by Comrade Deng Xioping of China. It is very practical to force an organization to improve poor security practice and from a free market and economic perspective it should be encouraged, even at the cost of the demise of an organization, the unemployment of all its employees, and the inconvenience of its customers.
In the Tao we represent opposites through the symbolism of Yin and Yang. Good/Evil, Success/Failure, Light/Dark, etc. are all examples of of opposites depicted by Yin and Yang. This represents balance in the universe. These opposites are absolutes in relation to each other. In terms of success and failure these absolutes manifest themselves in our daily lives. For example, in commodities trading success or failure is absolute and is also a zero-sum game on a per transaction basis. In order for you t
o buy a commodity, there must be someone else willing to sell it to you and take the opposite bet that the value of that asset will go down. This is especially true if the seller is a short seller. When you sell the stake in the commodity you are betting that it will not continue to rise, but if it does you lose out on the opportunity while the person you sold it to benefits. To bluntly put it, the person opposite to your trade is experiencing absolute failure while you are experiencing absolute benefit. In order for one party to succeed another party must be subject to failure. Centuries of Asian wisdom can not be wrong.
As business leaders we can apply the same principles to companies in the same absolute terms. For example, If Bank of A has an infosec breach, its customers are free to do business with Bank of B or Bank of C instead. Customers and stock holders of Bank of C have incentive to see Bank of A collapse due to the exodus of customers. All other banks have incentive to see Bank of A fail because they can buy assets such as buildings or accounts receivable for cents on the dollar in bankruptcy court, in addition to their customers being up for grabs. Stock traders who are short Bank of A shares or who hold Put options also want to see it completely collapse to maximize the value of their position.
There is nothing wrong with wanting to see an institution fail. It is good business and if we follow the Tao we know that in order for a small community bank to grow into a regional or national bank it must come at the expense of that larger bank. In terms of biological organisms, the fit will survive while the unfit will perish. The same holds true in business and commerce. Our unwillingness to let go of Too Big To Fail continues to prop up weak institutions that keep making the same mistakes, while preventing smaller competitors that do it right from rising up to take their place. The use of public funds to enable law enforcement and the current justice system does nothing but set private benefit on fire and does nothing to place poorly run institutions in harms way to see if they can survive. What about the interim harm that may come to Bank of A’s customers while they’re failing? We can classify that as an economic externality and therefore rate its overall impact at zero. After all if it is not taking away from your private benefit, why get involved by devoting resources to the so called problem?
How Do We Turn Talk Into Action
To borrow more components from the Tao, we can implement Wu Wei. The concept means “action without action”. We can apply Wu Wei to the legislative and judicial process by promoting action by inhibiting the action of others.
Individuals can also take control of the run away police state and tax on the citizenry through the use of Jury Nullification. Georgia’s Constitution allows jurors to decide fact AND law. Jurors can put an end to the incarceration state by simply voting not guilty if it is a criminal case, which then leaves civil court as the only recourse. A juror can say that no crime was committed if a company had less than adequate security practices as viewed by the juror. That is legal to do and it should be encouraged.
We should also spend time to review relevant upcoming legislation. Any bill that introduces a new crime or increases the criminal penalty for an existing crime should be flagged. The State House or State Senator, along with the Governor is notified that the bill, if becoming law would create more taxpayer harm than benefit. Prison is a tax on law abiding citizens and as law abiding citizens we should be doing everything we can to keep people out of prison though decriminalization and promotion of restitution and rehabilitation, rather than incarceration. This also means defunding law enforcement and the district attorney’s office as a means to that end. With state and local budgets strained by the economy, nothing is off the chopping block. Now is the time to make our voices heard and take back our government through being involved politically, voting out politicians who steal from our private utility by growing the police state, and by stopping every District Attorney in his tracks through jury nullification.
Vote! Be politically active and support libertarian leaning candidates at all levels of government. Candidates who are willing to take the bold step of defunding the War on <insert noun here> and shrink the size of government in the name of freedom are the ones we should be supporting.
Mr. Garrett is wrong in his calling for an AntiSec hunt. Such activities strengthen the power of government, destroy private utility, contribute to our Prison Planet, keep small business under the thumb of mega-corporations, and weaken our sense of nationalism on the world stage by making us a nation of weaklings. He is wrong, not for the same reasons that pro-hacktavist supporters believe in, but the economic, libertarian, and Asian ethic points against his reasoning makes him more wrong than right on the issue.
Resources
Business and Society Ethics and Stakeholder Management 7E Carroll Buchholtz
Foundations of Microeconomics 4E Bade Parkin
Wikipedia
The Ethics of Liberty Ch 13 Punishment & Proportionality Rothbard
Disclaimer: This is an opinion piece. Nothing should be construed as fact unless independently verified. At time of writing your Dearest Leader does not hold long or short positions in his personal or business brokerage accounts with regard to any company mentioned in this article. Long or short positions may be initiated in the future without notice.