Learning from Obesity: Dance Your Ass Off

What Combating Obesity in the U.S. Can Teach Us About Software Assurance

A majority of Americans (an estimated 60 percent or more) are fat. Fully 30 percent are obese; that is, obese individuals are more than 30 percent heavier than what is considered healthy for a person’s ratio of height and weight.  In a recent article by the Wall Street Journal, Cost of Treating Obesity Soars, the estimated cost of treating obesity-related diseases such as cancer, diabetes, and stroke may be as high as $147 billion in 2008 alone. Ooomph.

Shows like Dance Your Ass Off and The Biggest Loser, are, pardon the metaphor, largely eye candy for television audiences; a saccharine representation of the plight of being fat and what you could do if only you too had a dedicated gym, personal trainer, and strictly controlled menus and workout regimes – many of the things most people, including the participants, lack in everyday life.  The high transactional cost of severe interventions makes for great TV, but is simply not sustainable outside the studio.

In light of the growing obesity problem, Thomas Frieden, the director for the Center for Disease Control (CDC) has set the direction of preventing and combating obesity more aggressively for the United States. The CDCs actions are important because studies show that if Americans do not alter current eating behaviors, as much as 90 percent of Americans could be overweight or obese by 2030. “The numbers underscore the urgent need for deeper interventions in society and the environment that will make it easier for people to maintain normal weight,” Mr. Frieden stated at a conference on obesity in Washington, D.C. (as reported by WSJ).

Mr. Frieden’s probable “interventions” include:

• A penny-an-ounce tax on sugar-sweetened drink (arguably the biggest contributor to obesity).
• Requiring restaurants to post calorie counts on menus.
• Instituting smaller portion-sizes in venues such as government offices, and
• Requiring physical education in schools (almost 30 percent of American children are overweight).

The first two are most interesting to me from a software assurance perspective; namely, how do you alter the behavior of a populace that has shown a propensity towards creating large negative externalities (and I do mean, “large”).

In the case of obesity, the negative externality is the gargantuan healthcare-related costs associated with caring for, well, gargantuan people. In the case of software assurance, the negative externality is the gargantuan costs associated with manufacturing and consumption of insecure software (estimates range upwards of $100 billion or more).

So how do you change individual behavior on a significant enough scale such that large negative externalities are corrected?

The first technique is to raise the private cost of the behavior, which the "penny-an-ounce" tax attempts to accomplish. Mr. Frieden argues that a 10 percent price increase on sugared beverages could reduce consumption by as much as 7.8 percent. The penny-an-ounce taxation model is the same approach used in preventing and combating tobacco use. In fact, California recently raised taxes on cigarettes by 150 percent. This is an attempt to raise the private cost of the behavior and has two effects:

• High taxation dis-incentives current and would-be smokers. While it doesn’t deter them completely, it does make the behavior monstrously expensive.

• It pays for the negative externalities (the social costs, such as hospitalization) created by smokers that smoke regardless of the expense.

Imagine if we employed a similar flat taxation model for software? Say, a penny-per-thousand-lines-of-code (or penny-per-KLOC) tax model. This would increase the price of software, such as Microsoft Windows XP with an estimated 30 million lines of code, by at least $300. A hefty sum indeed. But think about the consequences:

• High-taxation would disincentivize the creation of “bloat code,” reducing the tendency of software manufacturers to add features and complexity to software and thus reduce the likelihood of introducing vulnerabilities.

• It pays for the negative externalities (the social costs) created by people who insist on making and buying insecure software.

But the word “tax” in America has always been a four-letter word, so an “obvious tax” on sugared drinks or software vulnerabilities, like that on smoking, raises the hackles of most everyone.

The more interesting model, and the one I tend to like, is the coaxing model. The coaxing model is alluring because instead of relying on regulations that limit, replace, or burden free-market transactions, as a direct taxation intervention promises, a coaxing model (which is more frequently implemented in America than Europe) gently pushes markets to address public needs and reward actions that will almost certainly help dealing with core issues. One such example in combating obesity is requiring restaurants to post calorie counts on menus; the second intervention proposed by Mr. Frieden. 

On July 1st, my home state of California began enforcing just such a requirement. The reason: people tend to underestimate the calorie content of food. The California menu-labeling law requires chain restaurants with 20 or more branches to post calorie counts on their menus. As reported by The Economist on July 23rd, Kelly Brownell of Yale’s Rudd Center for Food Policy and Obesity, stated, “you have labels on your clothes to tell you what’s in it and where it’s made,” you should have it for your food also.

The interesting consequence is that where menu-labeling has gone into effect (California, New York, Oregon, Maine, and Massachusetts) it has substantially altered the behavior of restaurant chains; now restaurants offer better options for lower calorie foods, smaller portions, and healthier items where previously they did not (or did not aggressively innovate to do so).

In turn, menu-labeling has made it easier for customers to make better decisions regarding nutrition, thus altering their behavior and potentially mitigating the large negative externalities of weight gain. According to The Economist:

“National chains like Starbucks, McDonald’s, Denny’s and Dunkin’ Donuts have all introduced less calorific items since menu labeling went into effect …Changes in consumer taste, [the chains] say, not menu labeling, are the reason for these changes. But worries about having to print supersize calorie counts on their menus may have played some part [my emphasis]. The proof is in the reduced-fat pudding.”

Indeed, making calorie counts obvious has altered behavior in the food service market; such is the power of making visible that which is hidden or obscure. Mr. Frieden’s approach through the CDC would likely advocate making menu-labeling a national requirement rather than State-dependent.

Now, imagine if Microsoft, Apple, or Google had to print vulnerability counts on their software packaging? Oh, I know printing vulnerability counts is a silly idea, but what would happen if we made software assurance, or the lack thereof, obvious to customers? What might be the effect?

I argue that it would be generally positive, altering the behavior of both producers and consumers of software. If clothing and food have labels “telling you what’s in it and where it’s made,“  which in turn compels positive changes in the respective markets, then maybe we should strongly consider it for software also.

People tend to underestimate the calorie content of food, this much is true. But they also tend to underestimate the security of their software. Speak with the typical Apple follower, and they will likely insist that Apple is more secure than Microsoft, even when Apple’s vulnerabilities have been skyrocketing since 2006 (according to an 2008 IBM X-Force Trend report Apple took top spot, surpassing Microsoft in percentage of vulnerability disclosures).

In short, labeling helps overcome cognitive biases to a far better extent than people’s gut feelings, approximations, or, ahem, blind adoption of vendor assertions and savvy marketing campaigns. A labeling regime, whether for food, clothing, or software is also gentler than full-fledged regulation; it nudges and coaxes markets toward better behaviors and rewards us all. Whether it is addressing a national crisis of obesity, or the national crisis of software insecurity, labeling is certainly a more effective approach than the saccharine approaches so far.

We in cybersecurity have our own version of Dance Your Ass Off, it’s called PCI, FISMA, HIPAA, and just about any other compliance mandate that requires wild, almost unnatural gyrations by its participants along with vigilant monitoring by experts and auditors alike. The sad fact is, just as in Dance Your Ass Off, most particpants will come up short, embarrassingly short. And while it can be argued that contestants at least showed some improvement by their involvement, it makes for great theater, but not much else, leaving the rest of us to scratch our heads wondering, “do we have go through all that for a speck of improvement?!?”  I hope not.