[Paleopsych] Slate: Feed the Worms Who Write Worms to the Worms
checker at panix.com
Sat Jan 29 16:51:59 UTC 2005
Feed the Worms Who Write Worms to the Worms
[E-mailed to me by Slate, which did not supply the URL]
Feed the Worms Who Write Worms to the Worms
The economic logic of executing computer hackers.
By Steven E. Landsburg
Posted Wednesday, May 26, 2004, at 2:14 PM PT
If we execute murderers, why don't we execute the people who write
computer worms? It would probably be a better investment.
Let's do the math. What do we get out of executing a murderer? Deterrence.
A high-end estimate is that each execution deters about 10 murders. (The
highest estimate I've ever seen is 24 murders deterred per execution, but
the closest thing to a consensus estimate in the econometric literature is
about eight.) That's 10 lives saved, with a valueÿÿagain a high-end
estimateÿÿof about $10 million apiece. (The closet thing to a consensus
estimate in the economics literature is about $7 million per life. I am
rounding up.) So let's say the benefit of executing a murderer is roughly
10 times $10 million, or $100 millionÿÿand that's probably at the high
Compare that to the benefit of executing the author of a computer worm,
virus, or Trojan. There seems to be no good name for such people, so I'll
make one upÿÿat least until some reader sends in a better suggestion, I'll
call them "vermiscripters." It's estimated that vermiscripting and related
activities cost the world about $50 billion a year. So if a single
execution could deter just one-fifth of 1 percent of all vermiscripting
for just one year, we'd gain the same $100-million benefit we earn by
executing a killer. Anything over one-fifth of 1 percent, and any effects
that last beyond the first year, are gravy.
So much for benefits. What about costs? The cost of an execution is one
lifeÿÿusually (one hopes) the life of the guilty, but occasionally the
life of a wrongly convicted innocent. The question is: Which is worth
more: the life of the average convicted murderer or the life of the
average convicted vermiscripter?
Plausibly, the latter. Compared to murderers, vermiscripters might be
easier to rehabilitate (the author of the Sasser worm is, by all reports,
still a teenager) and probably have more skills that can be put to good
use. (Offsetting this, though, is the prospect that those same skills can
be put to further bad use.) Let's bias things very strongly against the
conclusion I'm driving at by valuing the average murderer's life at zero
and the average vermiscripter's life at $100 millionÿÿthe same value we
earlier attributed to 10 lives.
Then to rate the vermiscripter's execution as a better investment than the
murderer's, you'd have to expect it to deter at least $200 million worth
of computerized vandalismÿÿenough to cover the $100 million value of
executing the murderer plus the $100 million value of the vermiscripter's
life. That's twice our earlier estimate, but still just two-fifths of 1
percent of one year's worth of worm and virus damageÿÿand still a
plausibly easy hurdle to clear.
Conclusion: On a pure cost-benefit basis, we should be quicker to execute
a vermiscripter than a murderer. But of course we're not. Which raises the
question: Why not?
Here's one answer: "These things can't possibly be reduced to numbers. Who
cares if some economist said a human life was worth $7 million or $8
million or $10 million? A chemist will tell you that the elements in your
body have a collective market value of about $10. You might find these
numbers interesting in some abstract academic sort of way, but they have
nothing at all to do with making wise policy decisions."
The problem with that answer is that it's wrong. To understand why it's
wrong, you have to understand how economists come up with these numbers in
the first place. When we say that a human life is worth $10 million, we
mean nothing more or less than this: A typical person, faced with a
1ÿÿin-10-million chance of death, seems to be willing to pay about a
dollar to eliminate that risk. We know this not from theory but from
observationÿÿby looking, for example, at the size of the pay cuts people
are willing to take to move into safer jobs. On this basis, Harvard
professor Kip Viscusi estimates the value of a life at $4.5 million
overall, $7 million for a blue-collar male and $8.5 million for a blue
collar female. (Viscusi acknowledges that it's puzzling for a blue-collar
life to be worth more than a white-collar life, but that's what the data
If we can deter one random murder in America, we make you a little bit
safer: Your chance of being a murder victim shrinks by about 1 in 300
million (because that's how many Americans there are). If we can execute
one killer and deter 10 random murders, the enhancement to your safety is
multiplied by 10: Your chance of being a victim shrinks by 1 in 30
million. When we say that your life is worth $10 million, we mean
precisely that you'd be willing to pay about one-thirty-millionth of $10
millionÿÿabout 33 centsÿÿfor that much extra safety. (Actually, you'd
probably be willing to pay slightly less, because each execution, while
making you safer on the street, also enhances the risk that you yourself
will be falsely convicted and executed someday.)
On the other hand, suppose we can execute one vermiscripter and thereby
eliminate, oh, say, 1 percent of all computer viruses for one year.
Assuming that half the $50 billion cost of malicious hacking is
concentrated in the United States and that you bear your proportionate
share of that cost, we're putting about 83 cents in your pocket.
Which would you rather have, the safety or the cash? Almost every American
would take the cash; that's exactly what we learn from studies like
Executing the murderer means giving you the safety. Executing the
vermiscripter means giving you the cash. You'd rather have the cash than
the safety. Ergo, executing the vermiscripter is better policy.
There's one exception to this reasoning: Maybe there's an alternative and
less drastic punishment that is highly effective against vermiscripters
and not against murderers. If we can effectively deter malicious hackers
by cutting off their supply of Twinkies or crippling their EverQuest
avatars, then there's no need to fry them. Whether that would work is an
Some might argue that capital punishment has moral costs and benefits
beyond its practical consequences in terms of lives lost and lives saved.
Those who make such arguments will want to modify a lot of the
calculations in this column. As for myself, I hold that the government's
job is to improve our lives, not to impose its morality. In this, I take
my stand with the president of the United States, who, in a 2000 debate
against Al Gore, said quite explicitly that nothing other than deterrence
can justify the death penalty.
There's also the fact that all the arithmetic in this column is very much
back-of-the-envelope. I implicitly assumed that we're all equally likely
to be random murder victims when in fact some of us (i.e., the poor) are
more susceptible than others. I used numbers that are rough approximations
to the truth. And I probably omitted a consideration or two that I'm sure
I'll hear about from astute readers.
But this essential point remains: Governments exist largely to supply
protections that, for one reason or another, we can't purchase in the
marketplace. Those governments perform best when they supply the
protections we value most. We can measure their performance only if we are
willing to calculate costs and benefits and to respect what our
calculations tell us, even when it's counterintuitive. Any policymaker who
won't do this kind of arithmetic is fundamentally unserious about policy.
Steven E. Landsburg is the author, most recently, of Fair Play: What Your
Child Can Teach You About Economics, Values, and the Meaning of Life. You
can e-mail him at armchair at troi.cc.rochester.edu.
More information about the paleopsych