Schneier on Security

Clive Robinson • February 13, 2020 5:15 PM

@ kiwano,

still kinda wish it had said “people” or “individuals”.

Firstly “people” are only “individuals” in the biological or physical sense[1] a point most don’t consciously realise even though they behave otherwise all the time…

Secondly have you ever heard the expression “any person legal or natural”?

The EU love it for one reason or another and it pops up all over the place. If you have not read the defining articles of the EU then you are going to misinterpret what the Directives actually mean[2].

Yes it’s a legalistic conceit to make an organisation such as a limited liability company equivalent to a real flesh and blood person “in the eyes of the law”. Whilst that might work with civil law where harms are equated to money, it only works partially under criminal law, where the punishment tariff is a fine only. At the end of the day there is no meaning in “locking up a company” as it is at the end of the day nothing more than a contract (articles of association). Thus if a company is wilfully negligent and somebody dies, “Who goes to jail?”. Well crudely the law works on the notion of “A directing mind” so if there is a piece of paper with a name on the bottom in theory it should be them. But whilst soldiers nolonger have the “acting under orders” defence, nearly all employees in a company still have it (unless officers of a company or of professional standing). The lower down the greasy pole the more that defence works for you. Company law and case law have put the onus on officers of a company to be “all seeing and all knowing” which is again another legal conceit. Which is why senior company officers never make original decisions as individuals[3]. They instead have a meeting and it’s the consensus decision “of the board” and they delegate to one or two individuals who were preferably not present who then expand on that consensus decision as given in the minutes or other brief writen note. With care –and thats what the big bucks are for– legaly you can demonstrate that there was no individual directing mind… So nobody to go to jail just a bank balance to lighten… Even sociopathic control freeks like one or two big Silicon Vally Corps know how to play this game, whilst absolutly being the directing mind. One such trick is to start a meeting say in agreed terms what you want then be called away before the meeting gets to the decison and delegation phase (on paper at least).

[1] From the non physical viewpoint a person is “the sum of their experiences” but we have many facets to our lives we are some peoples children we may also have our own children we have social lives that involve others who may have no relationship to others we socialise or work with. These are best described as “roles” that is as physical individuals we have many roles in life many of which are unrelated. It is a conceit of governments, organisations and software engineers to think of people as “physical bodies with identiry tags” because each role in our life realy is a seperate identity. Try treating your boss as you would your child and you will fairly quickly see that the role relationship is wrong (even if you are the bosses dad or mum).

One of my pet peves is software developers of muti-tasking programs like web browsers assuming that the person at the physical interface is an “individual, with one identity” not a “multi-roled entity with each role having one or more identities”. That is if you like there is you, customer of bank1 with A, current account, B, savings account C, credit card account. The bank treats the three accounts almost entirely seperatly for good reason so why oh why should some code cutter decide otherwise?.. The same notion applies to services that you have, mostly they are entirely seperate from each other for good reason, but apparently not good enough for a code cutter. In essence the code cutter is forcing a model for their convenience that does not exist in the real world. Most security faults can be traced back to some code cutter forcing their convenience on a world where it realy is a gross mismatch.

[2] They are written this way because each Directive has to be translated into 27 languages as well as having exactly the same meaning under 27 different legal system (EU members plus EFTA members). Few ordinary people actually get their heads around this even in EU member states.

[3] Hence the joke/truism of “A good manager ensures they are never in the same room as a decision”. A point others would be wise to follow.