[117441] in Cypherpunks
Sham insurance, natural enemies, and why TRUSTe is a scam
daemon@ATHENA.MIT.EDU (Robert Hettinga)
Fri Sep 3 09:21:43 1999
Mime-Version: 1.0
Message-Id: <v04210141b3f572381e22@[204.167.100.138]>
Date: Fri, 3 Sep 1999 08:40:30 -0400
To: cypherpunks@cyberpass.net
From: Robert Hettinga <rah@shipwright.com>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Reply-To: Robert Hettinga <rah@shipwright.com>
--- begin forwarded text
Date: Fri, 3 Sep 1999 03:06:50 -0400
Reply-To: Law & Policy of Computer Communications
<CYBERIA-L@LISTSERV.AOL.COM>
Sender: Law & Policy of Computer Communications
<CYBERIA-L@LISTSERV.AOL.COM>
From: Seth Finkelstein <sethf@MIT.EDU>
Subject: Sham insurance, natural enemies, and why TRUSTe is a scam
To: CYBERIA-L@LISTSERV.AOL.COM
Status: U
> Eric Grimm <ericgrimm@SPRINTMAIL.COM> set forth the following clever idea:
> The more interesting question than what would I pay for privacy insurance is
> . . . What are merchants willing to pay for privacy insurance so they can
> tell customers that, in the event of a privacy lapse (1) the customers get
> compensated and (2) the merchant's privacy insurance rates go up. Creates
> incentives for the merchant that the customer can clearly appreciate. Other
> question is -- how much will the insurance companies offer to compensate
> aggrieved policyholders?
Very nice. I wasn't going to write a long TRUSTe-is-a-scam
article tonight (it's late, long weekend coming up). But why the above
concept is doomed is perhaps the other side of that point. Now, it's
clever, but some merchants are even *more* clever than that. Remember
my advice on thinking about potential outcomes. Don't stick strictly,
religiously, to your rules - perturb the architecture a *little bit*,
see what happens.
Suppose some merchants hear you out. Then, after you leave,
they say to themselves. "What a brilliant idea. But let's change it
around a little. Instead of a *real* insurance company, backed by
actual guarantees, let's set up a shell organization which just
pretends to do enforcement. And think, all the money we'd spend on
premiums, we can then spend on marketing for our shell, which is an
advertising machine for how much we respect privacy. If no-one catches
us lying, well and good. If we get caught, the shell issues a
hair-splitting explanation about how we really didn't do anything
wrong and we won't do it again. The beauty of it is that we get to
spend all the money on creating the *perception* of doing something,
which is so much easier and more controllable than actual penalties
for us. Instead of a watchdog, we get a pet lapdog for much less
money! We might even get an alleged civil-liberties group to be an
Effluvia Fronting Fountain for us, those come very cheap". Viola! TRUSTe.
There's your answer - merchants are much more willing to pay
for a glorified PR firm than real compensation. Which, on examination,
seems almost obvious, it's much better flacking bang-per-buck.
If anyone thinks I'm merely ranting, I offer the following
references to the antics of TRUSTe:
Is TRUSTe Trustworthy?
http://www.spectacle.org/998/mccarthy.html
Microsoft Off Truste's Hook
http://www.wired.com/news/news/technology/story/18639.html
Truste clears Microsoft on technicality
http://www.news.com/News/Item/0,4,34114,00.html
TRUSTe is useless
http://www.deja.com/=dnc/[ST_rn=ps]/getdoc.xp?AN=397714889&fmt=text
----------------==-----------------------------------------------------------
Seth Finkelstein Consulting Web Programmer, with a *special* love for TRUSTe
----------------==-----------------------------------------------------------
"Again, please take this warning seriously. You are knowingly or
negligently making provably false statements about TRUSTe with intent
to harm their reputation. That's libel. You can get sued for that.
Don't go there. TRUSTe's legal resources are better spent making sure
participant compies adhere to their contracts, and I'm sure you have
better things to do with your time & money."
- Stanton McCandlish, Program Director of the *Electronic Frontier Foundation*,
to me some time ago, on a mailing list.
--- end forwarded text
-----------------
Robert A. Hettinga <mailto: rah@ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
