[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[infowar.de] Todesstrafe für Virenprogrammierer?
Infowar.de, http://userpage.fu-berlin.de/~bendrath/liste.html
-------------------------------------------------------------
http://slate.msn.com/id/2101297/
Feed the Worms Who Write Worms to the Worms
The economic logic of executing computer hackers.
By Steven E. Landsburg
Posted Wednesday, May 26, 2004, at 2:14 PM PT
If we execute murderers, why don't we execute the people who write
computer worms? It would probably be a better investment.
Let's do the math. What do we get out of executing a murderer?
Deterrence. A high-end estimate is that each execution deters about 10
murders. (The highest estimate I've ever seen is 24 murders deterred per
execution, but the closest thing to a consensus estimate in the
econometric literature is about eight.) That's 10 lives saved, with a
value?again a high-end estimate?of about $10 million apiece. (The closet
thing to a consensus estimate in the economics literature is about $7
million per life. I am rounding up.) So let's say the benefit of
executing a murderer is roughly 10 times $10 million, or $100
million?and that's probably at the high end.
Compare that to the benefit of executing the author of a computer worm,
virus, or Trojan. There seems to be no good name for such people, so
I'll make one up?at least until some reader sends in a better
suggestion, I'll call them "vermiscripters." It's estimated that
vermiscripting and related activities cost the world about $50 billion a
year. So if a single execution could deter just one-fifth of 1 percent
of all vermiscripting for just one year, we'd gain the same $100-million
benefit we earn by executing a killer. Anything over one-fifth of 1
percent, and any effects that last beyond the first year, are gravy.
Continue Article
So much for benefits. What about costs? The cost of an execution is one
life?usually (one hopes) the life of the guilty, but occasionally the
life of a wrongly convicted innocent. The question is: Which is worth
more: the life of the average convicted murderer or the life of the
average convicted vermiscripter?
Plausibly, the latter. Compared to murderers, vermiscripters might be
easier to rehabilitate (the author of the Sasser worm is, by all
reports, still a teenager) and probably have more skills that can be put
to good use. (Offsetting this, though, is the prospect that those same
skills can be put to further bad use.) Let's bias things very strongly
against the conclusion I'm driving at by valuing the average murderer's
life at zero and the average vermiscripter's life at $100 million?the
same value we earlier attributed to 10 lives.
Then to rate the vermiscripter's execution as a better investment than
the murderer's, you'd have to expect it to deter at least $200 million
worth of computerized vandalism?enough to cover the $100 million value
of executing the murderer plus the $100 million value of the
vermiscripter's life. That's twice our earlier estimate, but still just
two-fifths of 1 percent of one year's worth of worm and virus damage?and
still a plausibly easy hurdle to clear.
Conclusion: On a pure cost-benefit basis, we should be quicker to
execute a vermiscripter than a murderer. But of course we're not. Which
raises the question: Why not?
Here's one answer: "These things can't possibly be reduced to numbers.
Who cares if some economist said a human life was worth $7 million or $8
million or $10 million? A chemist will tell you that the elements in
your body have a collective market value of about $10. You might find
these numbers interesting in some abstract academic sort of way, but
they have nothing at all to do with making wise policy decisions."
The problem with that answer is that it's wrong. To understand why it's
wrong, you have to understand how economists come up with these numbers
in the first place. When we say that a human life is worth $10 million,
we mean nothing more or less than this: A typical person, faced with a
1?in-10-million chance of death, seems to be willing to pay about a
dollar to eliminate that risk. We know this not from theory but from
observation?by looking, for example, at the size of the pay cuts people
are willing to take to move into safer jobs. On this basis, Harvard
professor Kip Viscusi estimates the value of a life at $4.5 million
overall, $7 million for a blue-collar male and $8.5 million for a blue
collar female. (Viscusi acknowledges that it's puzzling for a
blue-collar life to be worth more than a white-collar life, but that's
what the data show.)
If we can deter one random murder in America, we make you a little bit
safer: Your chance of being a murder victim shrinks by about 1 in 300
million (because that's how many Americans there are). If we can execute
one killer and deter 10 random murders, the enhancement to your safety
is multiplied by 10: Your chance of being a victim shrinks by 1 in 30
million. When we say that your life is worth $10 million, we mean
precisely that you'd be willing to pay about one-thirty-millionth of $10
million?about 33 cents?for that much extra safety. (Actually, you'd
probably be willing to pay slightly less, because each execution, while
making you safer on the street, also enhances the risk that you yourself
will be falsely convicted and executed someday.)
On the other hand, suppose we can execute one vermiscripter and thereby
eliminate, oh, say, 1 percent of all computer viruses for one year.
Assuming that half the $50 billion cost of malicious hacking is
concentrated in the United States and that you bear your proportionate
share of that cost, we're putting about 83 cents in your pocket.
Which would you rather have, the safety or the cash? Almost every
American would take the cash; that's exactly what we learn from studies
like Viscusi's.
Executing the murderer means giving you the safety. Executing the
vermiscripter means giving you the cash. You'd rather have the cash than
the safety. Ergo, executing the vermiscripter is better policy.
There's one exception to this reasoning: Maybe there's an alternative
and less drastic punishment that is highly effective against
vermiscripters and not against murderers. If we can effectively deter
malicious hackers by cutting off their supply of Twinkies or crippling
their EverQuest avatars, then there's no need to fry them. Whether that
would work is an empirical question.
Some might argue that capital punishment has moral costs and benefits
beyond its practical consequences in terms of lives lost and lives
saved. Those who make such arguments will want to modify a lot of the
calculations in this column. As for myself, I hold that the government's
job is to improve our lives, not to impose its morality. In this, I take
my stand with the president of the United States, who, in a 2000 debate
against Al Gore, said quite explicitly that nothing other than
deterrence can justify the death penalty.
There's also the fact that all the arithmetic in this column is very
much back-of-the-envelope. I implicitly assumed that we're all equally
likely to be random murder victims when in fact some of us (i.e., the
poor) are more susceptible than others. I used numbers that are rough
approximations to the truth. And I probably omitted a consideration or
two that I'm sure I'll hear about from astute readers.
But this essential point remains: Governments exist largely to supply
protections that, for one reason or another, we can't purchase in the
marketplace. Those governments perform best when they supply the
protections we value most. We can measure their performance only if we
are willing to calculate costs and benefits and to respect what our
calculations tell us, even when it's counterintuitive. Any policymaker
who won't do this kind of arithmetic is fundamentally unserious about
policy.
Steven E. Landsburg is the author, most recently, of Fair Play: What
Your Child Can Teach You About Economics, Values, and the Meaning of
Life. You can e-mail him at www.landsburg.com.
---------------------------------------------------------------
Liste verlassen:
Mail an infowar -
de-request -!
- infopeace -
de mit "unsubscribe" im Text.