[Paleopsych] Slate: Feed the Worms Who Write Worms to the Worms

[Premise Checker]

Feed the Worms Who Write Worms to the Worms
[E-mailed to me by Slate, which did not supply the URL]

everyday economics 
Feed the Worms Who Write Worms to the Worms 
The economic logic of executing computer hackers. 
By Steven E. Landsburg 
Posted  Wednesday, May 26, 2004, at 2:14 PM PT

If we execute murderers, why don't we execute the people who write 
computer worms? It would probably be a better investment.

Let's do the math. What do we get out of executing a murderer? Deterrence. 
A high-end estimate is that each execution deters about 10 murders. (The 
highest estimate I've ever seen is 24 murders deterred per execution, but 
the closest thing to a consensus estimate in the econometric literature is 
about eight.) That's 10 lives saved, with a valueÿÿagain a high-end 
estimateÿÿof about $10 million apiece. (The closet thing to a consensus 
estimate in the economics literature is about $7 million per life. I am 
rounding up.) So let's say the benefit of executing a murderer is roughly 
10 times $10 million, or $100 millionÿÿand that's probably at the high 
end.

Compare that to the benefit of executing the author of a computer worm, 
virus, or Trojan. There seems to be no good name for such people, so I'll 
make one upÿÿat least until some reader sends in a better suggestion, I'll 
call them "vermiscripters." It's estimated that vermiscripting and related 
activities cost the world about $50 billion a year. So if a single 
execution could deter just one-fifth of 1 percent of all vermiscripting 
for just one year, we'd gain the same $100-million benefit we earn by 
executing a killer. Anything over one-fifth of 1 percent, and any effects 
that last beyond the first year, are gravy.

So much for benefits. What about costs? The cost of an execution is one 
lifeÿÿusually (one hopes) the life of the guilty, but occasionally the 
life of a wrongly convicted innocent. The question is: Which is worth 
more: the life of the average convicted murderer or the life of the 
average convicted vermiscripter?

Plausibly, the latter. Compared to murderers, vermiscripters might be 
easier to rehabilitate (the author of the Sasser worm is, by all reports, 
still a teenager) and probably have more skills that can be put to good 
use. (Offsetting this, though, is the prospect that those same skills can 
be put to further bad use.) Let's bias things very strongly against the 
conclusion I'm driving at by valuing the average murderer's life at zero 
and the average vermiscripter's life at $100 millionÿÿthe same value we 
earlier attributed to 10 lives.

Then to rate the vermiscripter's execution as a better investment than the 
murderer's, you'd have to expect it to deter at least $200 million worth 
of computerized vandalismÿÿenough to cover the $100 million value of 
executing the murderer plus the $100 million value of the vermiscripter's 
life. That's twice our earlier estimate, but still just two-fifths of 1 
percent of one year's worth of worm and virus damageÿÿand still a 
plausibly easy hurdle to clear.

Conclusion: On a pure cost-benefit basis, we should be quicker to execute 
a vermiscripter than a murderer. But of course we're not. Which raises the 
question: Why not?

Here's one answer: "These things can't possibly be reduced to numbers. Who 
cares if some economist said a human life was worth $7 million or $8 
million or $10 million? A chemist will tell you that the elements in your 
body have a collective market value of about $10. You might find these 
numbers interesting in some abstract academic sort of way, but they have 
nothing at all to do with making wise policy decisions."

The problem with that answer is that it's wrong. To understand why it's 
wrong, you have to understand how economists come up with these numbers in 
the first place. When we say that a human life is worth $10 million, we 
mean nothing more or less than this: A typical person, faced with a 
1ÿÿin-10-million chance of death, seems to be willing to pay about a 
dollar to eliminate that risk. We know this not from theory but from 
observationÿÿby looking, for example, at the size of the pay cuts people 
are willing to take to move into safer jobs. On this basis, Harvard 
professor Kip Viscusi estimates the value of a life at $4.5 million 
overall, $7 million for a blue-collar male and $8.5 million for a blue 
collar female. (Viscusi acknowledges that it's puzzling for a blue-collar 
life to be worth more than a white-collar life, but that's what the data 
show.)

If we can deter one random murder in America, we make you a little bit 
safer: Your chance of being a murder victim shrinks by about 1 in 300 
million (because that's how many Americans there are). If we can execute 
one killer and deter 10 random murders, the enhancement to your safety is 
multiplied by 10: Your chance of being a victim shrinks by 1 in 30 
million. When we say that your life is worth $10 million, we mean 
precisely that you'd be willing to pay about one-thirty-millionth of $10 
millionÿÿabout 33 centsÿÿfor that much extra safety. (Actually, you'd 
probably be willing to pay slightly less, because each execution, while 
making you safer on the street, also enhances the risk that you yourself 
will be falsely convicted and executed someday.)

On the other hand, suppose we can execute one vermiscripter and thereby 
eliminate, oh, say, 1 percent of all computer viruses for one year. 
Assuming that half the $50 billion cost of malicious hacking is 
concentrated in the United States and that you bear your proportionate 
share of that cost, we're putting about 83 cents in your pocket.

Which would you rather have, the safety or the cash? Almost every American 
would take the cash; that's exactly what we learn from studies like 
Viscusi's.

Executing the murderer means giving you the safety. Executing the 
vermiscripter means giving you the cash. You'd rather have the cash than 
the safety. Ergo, executing the vermiscripter is better policy.

There's one exception to this reasoning: Maybe there's an alternative and 
less drastic punishment that is highly effective against vermiscripters 
and not against murderers. If we can effectively deter malicious hackers 
by cutting off their supply of Twinkies or crippling their EverQuest 
avatars, then there's no need to fry them. Whether that would work is an 
empirical question.

Some might argue that capital punishment has moral costs and benefits 
beyond its practical consequences in terms of lives lost and lives saved. 
Those who make such arguments will want to modify a lot of the 
calculations in this column. As for myself, I hold that the government's 
job is to improve our lives, not to impose its morality. In this, I take 
my stand with the president of the United States, who, in a 2000 debate 
against Al Gore, said quite explicitly that nothing other than deterrence 
can justify the death penalty.

There's also the fact that all the arithmetic in this column is very much 
back-of-the-envelope. I implicitly assumed that we're all equally likely 
to be random murder victims when in fact some of us (i.e., the poor) are 
more susceptible than others. I used numbers that are rough approximations 
to the truth. And I probably omitted a consideration or two that I'm sure 
I'll hear about from astute readers.

But this essential point remains: Governments exist largely to supply 
protections that, for one reason or another, we can't purchase in the 
marketplace. Those governments perform best when they supply the 
protections we value most. We can measure their performance only if we are 
willing to calculate costs and benefits and to respect what our 
calculations tell us, even when it's counterintuitive. Any policymaker who 
won't do this kind of arithmetic is fundamentally unserious about policy.

Steven E. Landsburg is the author, most recently, of Fair Play: What Your 
Child Can Teach You About Economics, Values, and the Meaning of Life. You 
can e-mail him at armchair at troi.cc.rochester.edu.