More Security or Less Insecurity (Transcript of Discussion)

This is actually work done by Partha, it’s his talk, but the UKBA decided we could do without him, which is why it’s me talking rather than him. The purpose of this talk is to explore the possibility of an exploitable analogy between approaches to secure system design and theories of jurisprudence. The prevailing theory of jurisprudence in the West at the moment goes back to Hobbes. It was developed by Immanuel Kant and later by Rousseau, and is sometimes called the contractarian model after Rousseau’s idea of the social contract. It’s not the sort of contract that you look at and think, oh gosh, that might be nice, I might think about opting in to that, it’s more like a pop up licence agreement that says, do you want to comply with this contract, or would you rather be an outlaw. So you don’t get a lot of choice about it. Sometimes the same theory, flying the flag of Immanuel Kant, is called transcendental institutionalism, because the basic approach says, you identify the legal institutions that in a perfect world would govern society, and then you look at the processes and procedures, the protocols that everyone should follow in order to enable those institutions to work, and then you say, right, that can’t be transcended, so therefore there’s a moral imperative for everyone to do it. So this model doesn’t pay any attention to the actual society that emerges, or to the incentives that these processes actually place on various people to act in a particular way. It doesn’t look at any interaction effects, it simply says, well you have to behave in this particular way because that’s what the law says you have to do, and the law is the law, and anybody who doesn’t behave in that way is a criminal, or (in our terms) is an attacker. In the vanilla model of secure systems design that we find in books for children, we advocate the same kind of approach; you have a security policy, you identify the institutions and protocols that are going to implement this policy, and you say, well people have to behave in accordance with the security policy because otherwise they are policy breakers, and that’s the definition of an attacker. And the problem with these assumptions is not only do they make systems hard to use, and unpleasant, but they also have the effect of building in the weak links to the system. Paulo Verissimo: Would you say that those weak links are proportional to what we might call the realism of the assumptions, meaning you want it to be, that’s why it’s not possible? Reply: Precisely so, that is where the tension comes from. We put the assumption in because we need to do a proof, but that assumption means that we