Learning to Shrug

Yesterday, as reported by Decrypt, public bodies in Finland, the Netherlands, and France had taken websites offline as a precaution.¹ The reason was two newly found vulnerabilities in PHP, a programming language that powers about 70 per cent of the websites whose software can be identified from outside. These flaws could let anyone run code on a server without a password. Cloudflare, which filters traffic for millions of websites, said it was already seeing early attacks, almost six hours before the patch shipped.²

»The alarm only worked if it was loud enough to reach those it was meant for, which is exactly why it sounded absurd to everyone else«

That sounded pretty alarming in the news, as if Lex Luthor had found the master key to the Internet and Superman was nowhere to be seen. But Superman exists. He’s just not you. He’s the site operators, the hosting providers, and the engineers who maintain the systems underneath, busy installing updates. For the rest of us the realistic outcome is very mild indeed: an exposed email address, perhaps a password to change. The vulnerabilities are not even new. They sat in the code for years. What changed is that more people now know about them.

The headlines were a lot louder than that. Decrypt’s said the bugs put 70 per cent of the Internet at risk; the text that headline accompanied said something narrower, adding that ordinary users had nothing to install. So why does an alarm that means so little to most of us get cranked up to volume levels that seem ridiculous? Because that alarm was never meant for us. A warning has to be loud enough to reach the few who can act, which means it’s also heard by the many who can’t.

Engineers who design alarms know the trade-off. It’s formalised in signal detection theory: the more a missed warning costs, the lower the threshold for sounding it, and the more false alarms you must accept.³ A good alarm is often wrong.

The sociologist Niklas Luhmann drew a useful distinction. Harm that follows from your own decision is a risk; harm that comes from someone else’s decision is a danger.⁴ The operator, deciding whether to patch or pull the plug, faces a risk: if the site is breached, the fault is theirs. The rest of us face only a danger, one we cannot influence. Hence the mismatch: the operator thinks our shrug is careless, and we think the shutdown is hysterical.

Luhmann also observed that modern societies keep turning dangers into risks, as more harm is traced to someone’s decision. A flaw that sat unnoticed for years was a danger; once it was known, leaving it unpatched became a decision. And the operator is not worried about a leaked email address. A hacked server can be held to ransom, used to spread malware, or become a door into the network behind it. Being offline for a day is cheap; being compromised is costly, and the blame falls on whoever didn’t act.

Both flaws scored 9.2 out of 10 on the beautifully named Common Vulnerability Scoring System, a score for how bad the flaw is, not for the harm to any single person. Anthropologist Gregory Bateson defined information as a difference that makes a difference.⁵ By that test, the 9.2 is information for the operator, because it changes what they do: they patch, or they pull the plug. For the rest of us it changes nothing, because there’s nothing we can do. We hear the number, but have nothing to act upon.

But the signal doesn’t stay with those who need it. The psychologist Shlomo Breznitz, who studied false alarms, found that each one lowers the credibility of the next.⁶ An alarm tuned for the few teaches the many to discount it. We learn to shrug. The shrug is rational, and it is also how the next, real warning gets ignored. Each alarm spends a little of the trust the next one needs.

Was the volume justified? Perhaps. Cloudflare’s early attacks suggest the danger wasn’t imaginary, and if the noise moved enough administrators to patch, a quieter notice might have been ignored. The PHP Foundation’s own announcement was restrained; the amplification happened downstream, in headlines written for the many.

There is a last twist. If the patching works, little will happen, and the whole episode will look like noise. Success erases its own evidence. The alarm only worked if it was loud enough to reach those it was meant for, which is exactly why it sounded absurd to everyone else.

The alarm did its job. It reached the few who could act, and on its way it passed through everyone else, leaving a small habit behind. The next time it rings, we will shrug a little sooner.

References