A smoking gun?

In a previous post we mentioned how risk-risk trade-offs can make it tricky to measure the overall cost of trying to manage a risk. In some cases, the measures taken to reduce a risk actually cause more damage than they eliminate, making them cause a net loss rather than a net gain. Requiring drivers to wear seat belts in cars is probably a good example of this. Studies have suggested that people feel safer while wearing a seat belt and compensate by driving less carefully than they would otherwise and that this riskier driving actually kills more people than the seat belts save. In the face of complications like this, it's extremely difficult to create an effective risk-management program.

Another problem can be caused by the fact that it can be hard to accurately measure the total costs in many situations because unexpected benefits can sometimes accompany the costs. The recent legal battles between the American states and tobacco companies provide an example of this.

The basis for the multi-billion-dollar settlement between the states and the tobacco companies was the notion that the tobacco companies are causing the states to experience higher costs, and that the tobacco companies should compensate the states for these costs. A closer look at this situation, however, shows that the tobacco companies really aren't causing any net additional costs for the states at all. They're actually decreasing the states' costs.

Studies estimate that states incur medical costs associated with smoking cigarettes of roughly $0.58 per pack. There are also other costs like about $0.43 per pack in foregone taxes because of smokers dying early, higher life insurance costs of about $0.14 per pack, the cost of additional sick leave taken by smokers of about $0.02 per pack fires and the cost of fires caused by cigarettes of about $0.01 per pack. These add up to about $1.18 per pack of cigarettes.

On the other hand, the fact that smokers tend to die before non-smokers mean that they also tend to not be around to cause some costs. In particular, the lower retirement pension costs amount to about $1.26 per pack and the lower cost of nursing home care to about $0.24 per pack. This means that there’s a benefit to the states of about $1.50 per pack that's caused by smokers dying earlier than non-smokers. This means that there's actually a net benefit of $0.32 per pack of cigarettes to the states. So although there are very good reasons to reduce smoking, the costs that the states incur from smokers probably isn't one of them.

Is information security exempt from this particular problem? It's hard to imagine a case where the damage caused by being hacked is outweighed by the benefits that the hacking might bring. On the other hand, there are certainly security technologies that probably aren't worth their cost.