The Psychology of Security and Real ID

Bruce Schneier's keynote this morning at Computers, Freedom, and Privacy was on The Psychology of Security, and one of the topics he discussed was which risks people tend to exaggerate and which they tend to downplay. People exaggerate risks that are spectacular, rare, personified, beyond their control, talked about, morally offensive, without redeeming value, and unfamiliar. He also talked about how the fear that these things trigger kick in at the instinctual and reflexive level, and while it's possible to override them at a more analytical level, it's a lot of effort.

One of the things I flashed on was the Real ID Town Hall webcast. Gina Scott described this well in her GovTech article:

Unfortunately, many people were put on the defensive at the meeting when, in the opening remarks, a picture of the Florida driver's license of one of the 9-11 highjackers was put on the overhead screen. The apparent attempt to show the ease in which such terrorists were able to attain state-issued identification drew the proverbial line in the sand for the state DMVs. For the regular citizens, many saw the use of the highjacker's card as a threat. One citizen commented that the use of the photo was offensive, especially "in a time when we are going through a period of distrust in this country."

Intentionally or not, showing the hijacker's ID card triggers all of these factors that lead people to overestimate risks: it personifies the risk; relates it to a rare, spectactular, much-talked-about event; etc. etc.

In the Q&A after the talk, I asked what approaches we should use to counter this -- basically to get people into a framework where they're getting beyond their instinctual fears to think through the security tradeoffs at a public policy level in a way that better reflects the real risks. "It's hard," he replied. "Fear is so visceral, so powerful." I suggested that one of the things we should look at is countering with more positive emotions (Stephen Duncombe's Dream: Reinventing Progressive Politics in an Age of Fantasy makes a similar suggestion in a more general context). He agreed that this was worth looking at, as well as various framing approaches ... and I agreed that it's really difficult -- especially when the mass media's coverage tends to reinforce the fear.

Schneier's essay on the subject covers the same ground as his talk, in somewhat more detail, looking at research from behavioral economics, pscyhology of risk, neuroscience. Strongly recommended.

jon