Today’s book review is Liars and Outliers: Enabling the Trust that Society Needs to Thrive, by Bruce Schneier.
Bruce Schneier is an internationally renowned security guru (he even has his own internet meme). He started out as an expert on cryptography, but he now has much wider security interests.
Liars and Outliers is a book that at its core is about trust. What is the optimum level of trust for a society, and how do we make it work for us? How do complex changes in the way our society works change that trust and the trade-offs between cooperating with the group interest and defecting from it?
These are questions in many different areas of our lives, and Schneier talks about many of them, with a framework that helps think through many of our trade-offs between trust and verification.
As Schneier says,
Three critical functions are performed by trust:
- It makes social life more predictable
- it creates a sense of community and
- it makes it easier for people to work together
In some ways, trust in society works like oxygen in the air… The more trust is in the air, the healthier society is and the more it can thrive…. This book explains how society enforces, evokes, elicits, compels, encourages… trustworthiness, through systems of societal pressures… coercive mechanisms that induce people to cooperate, acti in teh group interest, and follow group norms.
Optimal societal pressures balance the need to induce cooperation (to avoid murder, terrorism, theft, industrial pollution, etc) with the need to avoid oppression and injustice, allow innovation, and avoid stagnation.
Societal pressure comes from four broad categories:
- Moral pressure – what our own heads are telling us to do
- Reputational pressure – pressure to do something because otherwise our reputation will be tarnished (sometimes there is quite a thin line between moral and reputational pressure
- Institutional pressure – generally rules or laws – both government ones, and rules inside smaller groups (like the uniform rules at my sons’ schools) or larger groups (like the Universal Declaration of Human Rights)
- Security systems, such as fences, guards, alarms and forensic systems.
If a government agency exists only because of the industry, then it is in its self-preservation insterest to keep that indusry flourishing. And unles there’s some other career path, pretty much everyone with the expertise necessary to become a regulator will be either a former or future employee of the industry, with the obvious implicit and explicit conflicts.
…a battle between diffuse and concentrated interests. If you assume that specific regulations are a trade-off between costs and benefits, a regulatory institution will attempt to strike a balance. On one side is the industry, which is both powerful and very motivated to influence the regulators. On the other side is everyone else, each of whom has many different concerns as they go about their day and none of whom are particularly motivated to try to influence the regulators.
What does matter is that the overall scope of perfection is low enough that the overall level of trust is high enough for society to survive and hopefully thrive.
- understand the societal dilemma – what is the group norm, what is the group interest?
- consider all the ways in which societal pressures can be brought to bear – many people commonly think that morals, or reputation pressure are enough, but this is rarely true, even if reputational pressure is the most cost effective way of ensuring compliance
- pay attention to scale – different societal pressures work best at different scales
- foster empathy and community, which improve the effectiveness of moral and reputational pressures. These pressures are still responsible for most of the cooperation in a functioning society
- use security systems to scale moral and reputational pressures
- Reduce concentrations of power
- Require transparency – which maximises the effect of reputational pressures
Jennifer,
I was really pleased to find you’re blog.
Your observations are so correct. Measurement, policy and management are aspects of risk management. Rather as risk management becomes a profession like any other and not just a collection of tools and ‘rules of thumb’ it is paramount that we understand the social implications that are present in any profession.
As the role of the CRO becomes as important as the rest of the CXO suite we need to broaden our perspective. Regardless of the GFC but as a result of risk is a key business driver and businesses are people and their actions and behaviours.
Thanks again for the post I look forward future ones!
All the best,
Mark.
Thanks Mark, and great to hear from you. Understanding people is definitely a key part of any risk manager’s role.