Review:
Liars and Outliers, by Bruce Schneier
| Publisher: |
John Wiley |
| Copyright: |
2012 |
| ISBN: |
1-118-14330-2 |
| Format: |
Hardcover |
| Pages: |
285 |
One of the perils of buying a book written by a blogger one reads
regularly is that the book may be little more than a rehashing of their
blog, with insufficient original material to warrant the time investment.
Sometimes it's still nice to support them financially, but it may not make
sense to read the book. I've been following
Schneier's blog for years (as should
anyone with an interest in security), including through the entire process
of writing
Liars and Outliers, and was a bit worried that might be
the case here. Thankfully, I can reassure any other worried potential
readers that is not the case. This is substantial new material
establishing a firm framework for thinking about incentives and controls
in any society or organization.
Liars and Outliers talks about security mechanisms, but it's not,
at its core, a book about security. Rather, it's a book about incentives,
order, and how order is established. It's a comprehensive reductionist
analysis of how societies create predictability and compliance to allow us
to trust other people who we have never met before and will never meet
again. It's a unique (at least in my experience) combination of
anthropology, sociology, security analysis, and political science.
Schneier cuts across fields in an idiosyncratic but illuminating way that
reminded me of (on an entirely separate topic) Jane Jacobs.
This is not a prescriptive book, nor is a collection of answers,
solutions, or even deep analysis of particular problems. Rather, it's an
attempt to construct a general framework for analyzing societal dilemmas:
conflicts between individual desires and social good, how those conflicts
are resolved, and how societies can weigh the scales and influence the
statistical outcomes. The closest Schneier comes to telling the reader
how to solve problems is a checklist, at the end of the book, for
designing effective societal pressures. Its primary contribution is
vocabulary and structure. It also passes one of my litmus tests for any
book about human behavior: Schneier complicates, broadens, deepens, and
expands understanding, and points out complex interactions and complex
feedback in effects we're inclined to consider simple, rather than
simplifying or eliminating human complexity.
One point I found refreshing about this book is that Schneier is
scrupulous in refusing to define either society or individuals as good or
bad, to the point of carefully defining terminology used in all of the
social dilemmas. Following societal rules is called compliance; not
following those rules is called defection. In some cases, defection is
morally correct (Schneier's most frequent example is in the civil rights
struggles of the 1960s in the United States). In all cases, social
pressures are tools, which can be used to encourage compliance with moral
or immoral systems, and which are deployed by totalitarian dictatorships
and utopian communes alike. Schneier explicitly puts out of scope for
this book the questions of how societal goals should be determined, how
they change, and whether any given societal rule or interest is moral or
immoral. He focuses, rather, only on the mechanisms, with a primary goal
of informing and deepening debates over how best to encourage behavior
that societies want to encourage and discourage behavior societies want to
discourage.
He also emphasizes discourage, as opposed to eliminate. Early on,
Schneier shows some of the results of game theory, as well as basic common
sense, that indicate that no healthy society can totally eliminate
defection. Not only would that stifle valuable and important reform, such
as changes in civil rights, but the degree of pressure required is
immense. Defectors are natural and will always exist, and are sometimes
valuable and necessary. Rather, the goal of a society is to reduce
defectors to a level where most people can ignore their existence most of
the time, a state that leads to the level of risk and trust required to
have a functioning and healthy society.
The word society, similarly, is intentionally broad, and can refer to just
about any collection of people, from a circle of friends to a corporation,
institution, or country. However, as Schneier points out early in the
book, small societies rarely need much in the way of formal pressure and
appear almost magically self-governing. That's the first property that he
disassembles, resulting in a general classification of societal pressures
into four categories: moral, reputational, institutional, and security
systems. The last is an odd category that's partly orthagonal to the
other three.
Moral pressure is internalized conscience: the normal tendency of nearly
everyone to follow their own moral code, a code that's at least partly
constructed and certainly heavily influenced by the surrounding society.
Reputational pressure is, in a sense, externalized morality: it's the
informal reactions of others around one to one's past actions. Included
in reputational pressure is shunning of every kind, from cutting off a
friendship to boycotts against corporations, but it also includes
confrontation from another member of one's society, the more subtle
effects of our individual desires to be liked and respected, and all the
various aspects of "face", honor, and respect within a community.
Small communities are frequently self-governing, in Schneier's model,
because they're small enough that moral and reputational pressures are
sufficient and no other pressures are required. We're so used to applying
moral and reputational pressure to other humans almost unconsciously that
we sometimes don't even notice its existence, leading to that "magical"
self-governing property. But Schneier puts pressures in a sequence:
pressures that work extremely well with small groups often don't scale.
Moral pressure works best with small groups and reputational pressure with
somewhat larger groups, but when societies scale beyond the limits of
reputational pressure when, for example, one frequently interacts with
people whose reputations are unknown to you and whose subsequent opinion
of you will not be relevant institutional pressure is required to force
compliance. Institutional pressure is the sort of pressure that we all
tend to think of first when we look for ways to enforce rules: laws,
policies, contracts, and other codes of behavior that carry with them
formal punishments and some enforcement mechanism. But even in societies
so large that institutional pressures are frequently required, such as
whole countries, moral and reputational pressures still exist and are
extremely important. One of Schneier's most interesting points is his
analysis of how institutional pressures can paradoxically undermine
reputational and moral pressures, resulting in more defection than if the
institutional pressure hadn't existed.
This is just the basic framework of Schneier's analysis, hopefully giving
you a feel for the structure of the book. He goes much deeper into the
complicated interactions between the various levels of pressure, and then
dives into an extensive look at competing societal dilemmas: cases where
there is more than one society in play simultaneously, possibly demanding
contradictory actions.
Liars and Outliers also includes a
wonderful analysis of organizational entities within the same framework,
including their much-different reactions to moral, reputational, and
institutional pressures. One of the most cogent analyses of the
difficulties of regulating both corporations and governmental institutions
falls out of that analysis, once one looks at them in light of Schneier's
basic framework. Pressures quickly become complex and multi-layered, and
human reactions to pressures are frequently counter-intuitive. Schneier
draws extensively on game theory to show that some counter-intuitive
responses are actually emergent properties of logical analysis of the
situation, but that others are more uniquely human and have little or
nothing to do with a mathematical cost-benefit analysis.
I haven't even mentioned his discussion of security systems, and how they
can extend moral, reputational, and institutional pressures, as well as
add a new type of pressure (making a defecting action impossible) that
scales even better than institutional pressures.
Liars and Outliers has all of the supporting infrastructure you
would expect in a scholarly book: notes, extensive references, and a good
index. I suspect it will end up being used as at least additional reading
in college classes. The notes are, unfortunately, end notes, making the
full context of the book much harder to read than was necessary, but at
least Schneier does separate the notes from the references so that one
doesn't chase notes for further explanation and find a simple citation.
As with any book like this, one always wishes it could end in a simple
prescription to fix everything, but of course it doesn't. But that's also
a measure of a good scholarly work. Human and organizational motivations
are complex and tricky, and any framework for analyzing them needs to be
able to represent that complexity. Schneier here has constructed a very
powerful one, one that I started using in discussions before I'd even
finished the book. Perhaps the most valuable contribution of
Liars
and Outliers to public discussion is clear terminology and categories,
which can be of great help in finding the core components of a problem.
Liars and Outliers can be slow going, particularly early on when
Schneier is still defining terms and setting up the background of his
analysis. One can get a bit tired of the analysis matrices of societal
dilemmas. But stick with it through the groundwork, since the analyses of
competing societal dilemmas and of the impact of societal pressures on
organizations are exceptional.
Highly recommended, particularly for anyone who is designing or
implementing societal pressures: managers, political activists, or anyone
in a security-related field.
Rating: 8 out of 10
have I said before that we are running out of easy RC bugs? the list is a
bit short this week:
Why?
Have you ever heard someone talking extensively about Cloud Computing or generally Clouds? and have you ever noticed the fact many people (even the ones who present themselves as experts) don t really understand what a Cloud is at all? That happened to me multiple times and one of the most common misunderstandings is many see the Cloud as something being on the internet. Many companies add a little logo representing a cloud on their frontpage and without a single change on their infrastructure (but surely with a price increment) they start calling their products as being on the Cloud. Given the lack of knowledge about this specific topic people tend to buy the product presented as being on the Cloud without understanding what they really bought.
But what Cloud Computing really means? it took several years and more than fifteen drafts to the National Institute of Standards and Technology s (NIST) to find a definition. The final accepted proposal:
For more than ten years now, I am a regular and happy user of 
Here is a bit of simple (yet subtly-flawed) sql, which produces different answers on different database engines: 
