Schneier: Perverse incentives drive bad security decisions

Published 26 February 2009

Many security-related decisions are less than optimal because those who have to make the decisions face perverse incentives; in the post-9/11 era, we have to make sure the incentives driving security decisions are the right incentives

Contrariness serves a useful purpose: it forces us to rethink received wisdom and accepted convention. Bruce Schneier is an informed and insightful contrarian, so when he writes that reverse incentives lead to bad decisions in the security field, we should listen.

“Incentives explain much that is perplexing about security trade-offs,” Schneier writes, offering several examples:

  • Why does King County, Washington, require one form of ID to get a concealed-carry permit, but two forms of ID to pay for the permit by check? Making a mistake on a gun permit is an abstract problem, but a bad check actually costs some department money.
  • In the decades before 9/11, why did the airlines fight every security measure except the photo-ID check? Increased security annoys their customers, but the photo-ID check solved a security problem of a different kind: the resale of nonrefundable tickets. So the airlines were on board for that one.
  • Why does the TSA confiscate liquids at airport security, on the off chance that a terrorist will try to make a liquid explosive, instead of using the more common solid ones? Because the officials in charge of the decision used CYA security measures to prevent specific, known tactics rather than broad, general ones.
  • The same misplaced incentives explain the ongoing problem of innocent prisoners spending years in places like Guantanamo and Abu Ghraib. The solution might seem obvious: Release the innocent ones, keep the guilty ones, and figure out whether the ones we are not sure about are innocent or guilty. The incentives, however, are more perverse than that. Who is going to sign the order releasing one of those prisoners? Which military officer is going to accept the risk, no matter how small, of being wrong?
  • Schneider says that he read almost five years ago that prisoners were being held by the United States far longer than they should, because ”no one wanted to be responsible for releasing the next Osama bin Laden.” That incentive to do nothing has not changed. It might have even gotten stronger, as these innocents languish in prison.

The solution: change the incentive system. Easier said than done, but true.