Security and Hygiene theatre: the cost of a rule

ID: 6f241445-24bb-429b-9eb9-66c4316f0b69
REVIEW_SCORE: 0.0
MTIME: [2024-12-25 Wed 15:54]

• enforcing a specific behaviour widely is much hard.
• it gets easier for the authority when there is a turnstile whose control can be acquired and exploited
  • BUT that causes "traffic" - the things that happens when error-bars on compliance are added into a queue.
• it's much costlier to enforce individual-compliance things on a decentralized system, but much easier to comply with.
  • what drives or reinforces decentralized compliance?
• rule enforcement is as difficult as testing for rule violations.
  • think of mask-wearing enforcement. checking for whether everyone in a public space is wearing a mask is impossible without surveillance capabilities that remain infrastructurally and politically out of reach for the moment. so how do you make sure folks wear their mask?
    • naive statistical questions
      • how many people need to wear their mask to slow down spread sufficiently? how forgiving is that number (what is the deviation of outcome over %-mask-wearers?)
      • how much effort / cost goes into enforcing some marginal %-mask-wearers? what is the efficiency of effort-to-compliance?
    • the numbers above are all lossy of detail about how the large system evolves.
      • say you have
        • civilians, who have their own lives, and slightly disprefer most of the things enforcers tell them to do
        • enforcers, that can tell civilians what to do, and catch people not-complying
        • a centralized Command with an ability to tall enforcers what to do, that can depose noncompliant enforcers and impose penalties on noncompliant civilians
      • this game is shaped much like a Lotka-Volterra but with differences around coalition-forming.
        • Players can conspire to noncompliance, and if tyhe conspiracy is big enough one can call it defiance, ie that Command ha failed to successfully implement a new rule.
        • Command's incentive is to successfully implement a mechanism that causes the system to have a specific property.
          • with mask-wearing, the goal is to design a system where the ratio of new cases to civilian traffic starts dropping.
      • some naive strategies
        • associate really high fines with violation of the rules
          • the penalty itself becomes a bargaining chip with which your enforcers can play games, making in-the-moment-justifiable exceptions at too high a rate.
            • leniency to signal cooperation in hopes that the other will reciprocate
            • leniency because the expense of the penality is prohibitive for the violator
            • a legitimate reason like an emergency, and/or abuse of the emergency loophole
            • bribe taking
        • police and check / punish at random
          • "random" will prefer very public locations for enforcement, and people will notice that they suffer much less risk of being caught outside the most trafficked places; and continue to flout the rule.
        • create checkpoints, check / punish at random
        • incentivize enforcers to punish at high rates - you will get a lot of false-positives and corner-case-positives, like arresting legal front-of-line workers, so that the metric being incentivized looks good
    • new rules or rule changes become very difficult to propagate down the system, because your enforcer-agents are also experiencing standards intertia - they need to make judgment calls about exceptions and individual cases too often for the internalizing of new rules to be cheap. each new rule needs a new strategy.
      • airport security theatre, otoh, has created a centralized environment, where enforcement is very easy.
        • thus they get to enforce and change all sorts of arbitrary rules, that change airport-to-airport, because the enforcement environment is so simple.
          • otoh the efficiency of the rules (security theatre) - relative to the goal (to reduce security threat) keeps dropping, because there isn't any selection pressure away from inefficient rules. the simplest encoding that can probably approximately address a new threat is what ends up being implemented, eg. "one must remove one's shoes at the security check" or "one cannot carry external batteries onto a flight"