Daniel G. Conway

The evolution of metanorms: quis custodiet ipsos custodes?

How are norms maintained? Axelrod (in Am. Political Sci. Rev. 80(4): 1095–1111, 1986) used an evolutionary computational model to proffer a solution: the metanorm (norm to enforce norm enforcement). Although often discussed, this model has neither been sufficiently replicated nor explored. In this paper we replicate and extend that model. Results were generally supportive of the original. Speculations in the original regarding the requirement to link sanctions underlying the metanorm structure were not supported, as differentiating punishment likelihoods against defectors from punishment likelihoods against shirkers (non-enforcers of the norm against defection) lead to more efficient and effective sanctioning structures that allowed norm emergence. Replications of the Groups game (two groups differing in numbers and power) generally supported the original reports, but true norms against defection emerged only if sanctioning structures were differentiated, resulting in the Strong group developing a dominant norm against others defecting (Metavengeance). That is, when groups are involved with differential power, Metanorms fail unless a more sophisticated sanctioning structure (Metavengeance) is supported.

What We Got for Christmas

Columnists Dan Geer and Dan Conway present the numbers side of the security field.

Hard Data Is Good to Find

Indices are a common and useful way to summarize a changing field for both the lay and the specialist reader, and its time that we had them for information security.

A life is short, a half-life is forever

It is observed that when something undergoes a constant relative rate of change, theres an exponential function behind the observation. This paper explains that for exponential declines, we tend to report the half-life; think radioactive decay.

Nothing ventured, nothing gained [Cybersecurity]

Investors at all levels are pulling back from cybersecurity, which has serious consequences if and only if investment in cybersecurity matters. If it does, then trouble is brewing. If it does not, then radically different tactics are called for. Definitive numbers are scarce, but indicative numbers are self-evident.

Risk Concentration

Nature takes a variety of approaches regarding risk concentration. Stationary life tends to bend but not break, whereas mobile life tends toward risk concentration with stout border protection. Client and network devices tend to follow the latter model.

Security Is a Subset of Reliability

Reliability measures the deviation between the system and the specification. Security involves a subspace of reliability-only particular deviations-thus, security must be easier than reliability. Hastening over the delicate premise that the specification is always accurate and up-to-date, we can roughly align security with the subset of reliability where the cost of deviation per unit time is very high. This makes us wonder about measuring how risk tolerance scales and consequently where to point our our thumbs.