Jamus wants losses and responsibility to be shared.
13 h ·
Parliament recently debated a motion on improving online security. The
#workersparty contributed to the discussion by stressing the importance of getting this right, given the growing crisis of confidence in digital systems. On my part, I spoke about the current state of online fraud and scams. The government had recently released a paper on the Shared Responsibility Framework (SRF), for apportioning liability for losses incurred. For me, the major issue with the SRF, as it currently stands, is that it absolves financial institutions and telecommunications providers from losses, so long as they have done their part in taking precautions to prevent such scams.
But as anyone who deals with strategy knows, attacks always go for the weakest link in the chain. These are often individuals. To make matters worse, these are also the ones least prepared to guard against sophisticated fraudsters, compared to institutions. Moreover, the SRF only sets guidelines for responsibilities, rather than outcomes. Sometimes, accidents happen, even with the most careful exercise of cyber hygiene. You may be tired, or the spoof may be very believable, or the trickster especially convincing. In practice, what this almost certainly means is that customers will bear the brunt of losses, as long as corporations can show that they’ve implemented the latest security features and tools. Once losses occur, cost sharing is almost never fair.
So how do we get to a situation where losses—not just responsibilities—are more equitably distributed? It comes down to the need to have telcos and banks absorb some of the share. And importantly, by “share” I mean proportional to their respective abilities to bear them.
But that’s actually just the first step. What’s neat about such a solution, other than equity, is that it also spawns longer-term changes in the financial ecosystem. The most typical change of this nature is the emergence of an insurance (and reinsurance) market. Once this happens, it opens up the possibility of limiting liability (like all insurance schemes do). We could cap the exposure of customers, say, to $100 or $500 (or whatever may be actuarially sustainable).
Would this open up the risk of more careless behavior by customers? Sure, that’s the nature of all insurance. Economists even have a name for this phenomenon: moral hazard (if someone pays for the cost of an accident, you’re likely to drive more carelessly). That’s why there’s often such a thing as a co-pay (which is the $100 or $500). I don’t know about you, but if I might lose 500 bucks, I’ll do what I can to avoid it. Would I be more careful with a larger amount? Sure. But $500 is enough to make most folks very careful.
Could this embolden criminals, since there’s now a backstop that would pay out for the scams? Sure, but it’s not clear to me why the likely victims would be all that different (recall, nobody wants to be scammed, even for a small amount). And if you’re saying that crooked scammers could try to game the system by posing as unwitting customers, well, there’s such a thing as insurance fraud. Criminals may not care about this, but that’s where the ecosystem evolution argument comes in.
Companies that facilitated fraudulent purchases may care more about doing so, lest they get their electronic payments taken away. Banks would more carefully scrutinize transfer counterparties, as well as their own “mule” accounts. Blacklists would be actively consulted and refined. It is true that everyone would have to pay a little more for such insurance. But if we can get a system going at the national level, the costs are likely to be much more manageable.
We actually see such ecosystems in place already, for deposit insurance and credit card fraud, both here and in other parts of the world. Other jurisdictions, like the UK, are making even more aggressive proposals for limiting consumer liability for scams. When we are able to harness not just public sector policing efforts, but also private sector incentives, the system becomes stronger and safer for all. But it begins with a first step, of ensuring that losses, not just responsibility, is shared.
#makingyourvotecount