Monday, July 7, 2014

A little internet privacy is like being a yellow belt in karate

One of the things that Sam Peltzman most famously taught us (or perhaps reminded us) is that one should always pay attention to income effects, because they can show up in odd places.

Income effects are simple at a first pass - if I have more income I can buy more of a product. Most goods are normal goods, meaning that demand rises as income rises. Some goods are inferior goods, meaning that as incomes go up, people buy less of them (e.g. Walmart clothes), because they substitute to better alternatives. So far, so easy.

As microeconomists have known for a long time though, income effects can be induced by changes in the price of goods, rather than directly through income changes. If the price of rice increases, the first order effect is likely to be a substitution effect - rice is now expensive relative to wheat, so I buy more bread and less rice. But there is also an income effect: the real bundle of goods I can now purchase has shrunk, which is effectively a decrease in income.

As a result, the fact that income has decreased can induce other changes in demand which can partially or totally offset the original effect. In other words, the first pass effect is that rice consumption goes down (the substitution effect), but because I'm now poorer overall I have to cut my purchases of luxuries and buy more rice than I otherwise would. If the income effect is large enough to offset the substitution effect completely, the good is called a Giffen good - when the price of the good goes up, demand can actually increase. Robert Jensen and Nolan Miller carried out an experiment in China where they showed that for some really poor Chinese people, rice really is a Giffen good. When its price increases, they buy more of it, because they're now so poor it's the only way to get enough calories.

Which brings us to Mr Peltzman. He famously argued that income-like effects can lead to puzzling results in a wide variety of settings, most notably risk-compensation (which became known as the Peltzman Effect). If you spend government money to make roads safer or mandate seatbelt use, people will have a lower chance of dying from a given type of driving (similar to the substitution effect). But there's an income effect too - the budget set of allowable risky driving behavior has increased. Peltzman argued that this can in some cases totally offset the gains, as people drive in a more risky manner on the safer roads to maintain the same overall level of risk.

The classic case of Peltzman-like effects that people do seem to instinctively grasp is self-defence knowledge. In theory, knowing a little karate has only improved one's ability to fight relative to knowing zero karate. But the problem is the income effect. The ability to defend oneself can either be consumed entirely as an increase in safety, or it can be spent by substituting towards talking $#!& to bullies. Thus the overall level of safety can go up or down as a result of being able to fight back. The popular conception is that people overestimate their fighting ability and 'spend' more than they actually had, leading to Giffen-like behavior at low levels of self-defence knowledge.

And now it turns out that there's inadvertent Peltzman effects going on with internet privacy.

Several researchers with Tor have described how using the internet privacy software Tor results in your IP address receiving permanently much greater scrutiny from the NSA. Even searching for Tor online is enough to get you logged.

At high levels of security, this is still probably worth it if you value privacy. Tor is an incredibly powerful tool to avoid being tracked. Unfortunately there's still lots of other exploits they can use to target your computer, but Tor itself is pretty reliable.

Since the NSA doesn't like this, they are determined to raise the income effect stakes a lot. If you get slack and only use Tor sometimes, you have almost certainly increased the chances of your behavior being tracked and monitored. Before you had the blessing of anonymity. When you embark down the road of privacy, the NSA makes sure that goes away for good. Tor is a Basilisk - a single search for it is enough to get you permanently flagged. So if you're going to start down that road, it's got to be the full retard or nothing at all.

The reality is that maintaining anonymity is hard. Really hard. It is a form of tradecraft, as the spies put it. It needs an obsessive attention to detail, and a willingness to forgo a number of aspects of the internet (flash video, for instance, as well as dealing with slow loading times). And unfortunately, the predicament is quite similar to the position of the IRA viz Mrs Thatcher - the NSA only needs to get lucky once, whereas you need to get lucky every day.

The unfortunate reality is that for most people, no protection is probably safer than a little protection. And even then, the only reason that 'no protection' offers any protection is because the internet is simply too large for the NSA to be able to store everything that goes on there. On the other hand, they are able to store everything done by Tor users.

The one saving grace is that the NSA is not actually the NKVD. For the most part, the NSA is only interested in tracking terrorists, and passing the occasional Silk Road drug dealer onto the DEA. Not only that, they are reluctant to blow the details of the data collection process (any more than they already have) by having the details of it disclosed in court cases unimportant to the NSA's mission. So they're probably not going after you for buying that Adderall online, even though they could.

On the other hand, the Snowden disclosures have massively reduced the cost of the NSA using information at trials, since a lot of the details are now already known, so maybe that protection has decreased too.

Income effects are rarely counterintuitive once they're pointed out, but they have a tendency to be lurking in places that you weren't thinking hard about.

Unfortunately, none of them are good in this story.

No comments:

Post a Comment