Pylimitics

There’s a saying, probably old: If you can’t spot the sucker at the poker table, you’re the sucker. And there’s another saying, which I think is pretty recent, at least in regard to computer security: Defenders have to be lucky every time. Attackers only have to get lucky once.

Those sayings are obliquely saying that no matter who you are or how careful and well-informed you try to be, sometimes you’re going to get tricked. Here’s a prime example: Troy Hunt runs HaveIBeenPwned.com. It’s all about computer security breaches; where they’ve happened, how they work, and how to avoid them. In a recent post, Hunt describes how he, an international computer security expert, got scammed, and not even by a new or super-sophisticated scheme.

Getting tricked and scammed isn’t just about computer security, of course. Liars, con men, and thieves have been running scams practically forever. Another old saying, he bought a pig in a poke, is all about a scam centuries ago in local markets. You want to buy a young pig, pick one out (presumably), hand over some guilders, and you’re given a sack containing a wiggling piglet. Except what’s really in your sack is a stray cat.

English turns out to be chock-full of warnings about liars, con men, and thieves. Chicanery, pettifoggery, humbug (prior to Scrooge), skullduggery, and many more are words about scams. Falling for a scam can happen to anybody, and there’s ample evidence that it’s been happening throughout history.

But there’s another old saying: fool me once, shame on me. Fool me twice, shame on you. That is, we’re supposed to learn our lesson after being scammed by somebody. If you buy a nice-looking used car from Honest Abe’s Car Lot, only to find out that it’s a rustbucket underneath, you wouldn’t go back to Abe for a second car, right? And if you do a business deal with somebody and get cheated — or even if you find out that other people (maybe a lot of them) got cheated by the same person, you wouldn’t deal with them again, right?

Well…evidently not. Honore de Balzac said “behind every great fortune is a great crime.” But sometimes it’s not just one great crime, it’s a lot of them. What is a “crime,” of course, is a question that every con artist can nitpick better than any grammar scold. Maybe they’ve “never personally hurt anyone,” meaning, I guess, that they stole from lots of people but never punched any of them in the nose. Holders of great fortunes can also afford to hire plenty of lawyers to tangle things up to the extent that it takes years to arrive at what they really did. Or they can afford to hire plenty of lobbyists to get the regulations changed and the regulators replaced. When they’re faced with what they’ve done and how they’ve stolen from so many people, they may just claim “that makes me smart.” Anybody who values moral and ethical behavior over “smartness,” well, they’re just not smart enough, right?

The creation, a long time ago, of the idea of a “corporation,” is another way to avoid responsibility. A more recent version is the “LLC,” or “limited liability corporation.” The name says it all: personal responsibility is curtailed. Just gone; no longer a factor. If you can convince people that your car company should be valued an order of magnitude more than car companies have ever been, hey, “that makes you smart,” right? You can use your great fortune to buy a media company for an order of magnitude more than it’s worth, then you can run it into the ground. And then you can decide that your car company, which is still valued far above any other car companies for no reason other than your bafflegab, should buy your media company for far more than it’s still worth (although less than you paid for it).

One of the things con artists frequently claim when faced with what they’ve done is to argue that there’s no “victim.” It’s one of their favorite lies, backed up by nitpicking lawyers in their employ, who argue that the actual victims “don’t have standing” to sue — or if they might, well, before anything else they have to prove that. More entanglements in the service of delay.

But the shenanigans of con artists, taking for example the car company/media company two-step, certainly do have victims: everybody who believed them and lost money. Avoidance of responsibility steps in once again, naturally. “Investors” are supposed to be “sophisticated,” which obliquely means they’re too clever to be taken in by a scam. But as we’ve seen, nobody is that clever, not all the time. And if you’re investing, you’re supposed to know, and accept, that you might lose your invested money, whether to a scam or just to chance. So only people who can afford to lose some money should be investing, right? Well, sure, except thanks to the holders of great fortunes who years ago, hired lawyers and lobbyists, if you want to gather a retirement nest egg in the US, you have to rely on investments. A 401K plan or something like it. There isn’t much alternative any more, and the days are long gone when part of your compensation package for your job might have been a pension that was guaranteed. Those pension plans, gosh, they were just too expensive for corporations, right? But as corporations, nobody was really responsible when all that went away.

A big question underlying all the shenanigans is why people are so prone to falling for scams, cons, lies, and being cheated. I think it’s partly because of our nature and partly because of what we learn. To fall back on another old saying, or at least an old story: the scorpion and the frog. The scorpion agrees not to sting the frog in exchange for a ride on the frog’s back, across a river. The scorpion stings the frog anyway, and before they both drown explains that “it’s my nature.” It was the frog’s nature, too, to trust what the scorpion said. That’s us; normal people have empathy for those around us. We learn that those around us have empathy too, and we learn to trust what they say.

But not everybody around us is normal. Some people — and maybe the term “people” shouldn’t be so easily tossed around — don’t have any empathy. They’ll say anything that gets them what they want from us. Some of them will do anything, too. The ones who will do anything are much more likely to be found and dealt with than the ones who discover they only need to say anything and they’ll be believed. They really do conclude that “this makes them smart.” Maybe the term “smart” shouldn’t be so easily tossed around, either. Maybe the relatively new terms “psychopath” and “sociopath” need more colloquial equivalents that slide more comfortably into everyday conversation. “Evil” and “immoral” might have been a bit more useful once, but they have kind of lost their currency. For irredeemable people who feel no empathy and will say anything to get what they want, maybe we should go with “musky” and “trumpy.”