“…fraud is endemic to modern capitalism,” so said Professor Edward Balleisen at a National History Center talk on his excellent, comprehensive, thoughtful Fraud: An American History from Barnum to Madoff. We need histories of consumer protection. Balleisen provides one such history, focusing on the idea of fraud—specifically those wrought by businesses against consumers and investors. The concept of “fraud” is complex, it is defined differently through disciplinary lenses, and when we think about FTC privacy and many other consumer protection efforts, we are addressing conduct that is different from Balleisen’s focus. Yet, Balleisen’s book offers lessons for consumer protection more broadly and I learned a great deal from it.

Balleisen’s observation of the policy pendulum of anti-fraud efforts is most clearly stated on page 309, and anyone involved in modern debates on the FTC will recognize it:

Forceful antifraud tactics tended to generate complaints about autocratic governance that ran roughshod over individual rights and American values, which then prompted adoption of procedural protections, which in turn limited the effectiveness of administrative remedies. Post–World War II proceduralism deepened the democratic legitimacy of antifraud regulation, but at the cost of extending the rights of accused businesses, whether in criminal or administrative contexts.

My copy of Balleisen’s book is heavily marked up. So here are two key questions answered by the book and some other reflections–

Why, despite our rich information environment and seeming greater accountability brought about by technology and institutions, do frauds still persist, largely in five basic forms (pump and dump, pyramid scheme, bait and switch, advanced fee frauds, control fraud)?

• There are businesses committed to fraud. The proceduralism described by Balleisen allowed committed fraudsters (Holland Furnace, Fritzel Television) to slow down intervention.
• Committed fraudsters keep a “squawk” fund to “cool of the mark” by paying the consumers who do complain.
• Especially in areas where products/services are new and norms do not yet exist, new market entrants have more space for deception.
• Concerns about the pace of innovation and creating breathing room for it makes tolerance for fraud a part of a dynamic economy.
• A turn to individualism in the 1970s caused institutions such as the BBB to embrace squawk fund approaches—instead of pursing big, collective actions, BBB started remedying individual claims, thus leaving the target free to continue operations.
• Frauds are often small scale and your typical collective action problems emerge in policing them (daunting costs of representation, limited recovery, risk of countersuit or retaliation, embarrassment, and the problem of “unclean hands”).
• Information asymmetry still exists!
• Fraudsters can take advantage of the biases and heuristic reasoning approaches that most of us use.
  • We are strongly moved by forms of social proof over more objective evidence.
  • We are overconfident, especially when we have a little knowledge of a subject. There is the problem that many of us cannot recognize our own incompetence (the Dunning-Kruger effect).
  • We reason through “available” examples—easily recallable fraud events. As old frauds (such as the lightning rod sales of the last century) are interdicted, we forget about them and their lessons.
  • We are vulnerable to anchoring, which skews our perception of price.
  • We are loss adverse—and so when we anchor to a price, we act impulsively to capture discounts from the anchored price.
  • We are not good at separating bundles, and so sellers that engage in bundling can influence our perception of value (act now and get not one, but two non-stick pans!).
  • We are optimistic.
• Gullibility, dreams of quickly-acquired wealth.
• Only a small number of people need to fall for a fraud for the enterprise to be successful.
• The Holder in Due Course doctrine—obliterated by the FTC in the 1970s, the ability for a seller to transfer a debt obligation to a third party created intense incentives for fraudulent sales.
• On some level, we admire the guile of fraudsters—think about our centuries-long fascination with stories such as Reynard. The OED has over 300 words to describe deception, deceit, and trickery.
• And there are many, many ways of cheating. Balleisen covers the many ways 19th century companies defrauded each other—wetting cotton to make it heavier, enclosing a low-value project within an envelope of high-quality material, and so on.
• We are unwilling to criminally prosecute many consumer frauds, and when we do, convicted defendants receive laughably small sentences in light of the scale of their thefts.
• On some level, we resent victims of fraud, and suspect that victims were somehow complicit in the scheme. The OED has 200 words for dupes.

Related to the above, what are the tensions/tactics that enable fraud today?

• Product complexity. Complexity makes quality assessment difficult, leading us to fall back upon easily-manipulated signals, such as social proof.
  • This is, by the way, one reason why I think institutions such as Yelp will aid consumer protection little. Yelp—and even the BBB—are easily manipulated. There are even services that will do it for you, just like buying “puffs” from a 19th century newspaperman.
• Economic complexity. As our economy becomes more complex, we have to rely and trust people we do not know—even people not in our own country.
• Agreement complexity. Basic business models such as compounding interest cannot be defined by many consumers.
• Corporate secrecy.
• The ability to quickly incorporate.
• Being able to acquire the “trappings of success.” Ponzi was known to have bought the most expensive car in production—merely possessing it offered proof of his legitimacy. Balleisen shows other examples—the importance of fraudsters to claim having a prestigious address, of having been in operation for many years, of having trademarks or other signals of brand.
• Disclosure pollution. If a regulatory regime requires disclosure of some fact pointing to a problem, “pollute” the communication by making tons and tons of disclosures. I suspect that drug companies do this with side effects of prescription medicines.

Some final reflections–

I was surprised to learn of the historical vigor of the Better Business Bureau. I’ve long thought it to be not the most agile or effective institution. But Balleisen recounts decades when it was a serious force for consumer protection enforcement. In its heyday, it was a key actor in big fraud investigations, and it assisted public authorities in prosecutions. Balleisen shows how a conservative faction asserted control over its priorities, defanged it, and in the process, made it slouch into a kind of arbitration service for individual claims, and an opponent of anything but self-regulatory approaches. Some of the problems that Balleisen paints in the 1970 takeover, such as the problem of adverse selection in BBB membership, replicated themselves in the self-regulatory regimes for the internet.

Thoughts of “fraud” conjure images of Ponzi and Madoff. Conservatives and liberals alike disapprove of fraud as such. A problem that arises is that we use the same institutions and laws to pursue pure fraudsters as we do companies that do not live up to their advertising promises. This brand of FTC target sees himself as an honest businessman not to be painted with the same brush as hucksters. Balleisen gives the historical example of Macy’s and its promise that all of its prices were 6% lower than competitors—we know that this claim cannot be true in all situations. Macy’s saw deviance from the 6% target as just an imperfection that does not amount to deception or wrongdoing. Today, when companies like LabMD react viscerally to FTC intervention, it acts out just as its forebears. It rightly sees itself as a honest business–why is the federal government breathing down its neck? Businesses that read the situation that way always do the same thing—they accuse the FTC of pinkoism and of standing on an insecure constitutional foundation. Balleisen’s point is that their interventions introduce more and more proceduralism, but they rarely limit the substantive authorities of consumer protection institutions.

Balleisen’s book does not end in a bang. He adheres to the idea that there is no “silver bullet” to fraud, that many institutions and legal tools are needed to contain it, and that prevention (incentives for truthfulness, public education, consumer friendly defaults) should be the strategy rather than ex post remedy. He does carefully present the conservative reaction to the FTC but seems unconvinced of its cogency, or perhaps unconvinced that the critiques justify dismantling of new institutions.

The seal has been lifted on the complaint in the D-Link case. This document highlights the previously redacted portions in yellow.

Yesterday (April 3, 2017), D-Link filed a motion to dismiss that includes the initial hearing transcript.

Practitioner friends, the Department of Commerce just released their checklist for Privacy Shield applicants.

Update (4/14/17): received a “no records” response from DOC–ITA on procedures for removal from the Privacy Shield.

Professor Kenneth Rogoff’s Curse of Cash convincingly argues that we pay a high price for our commitment to cash: Over a trillion dollars of it is circulating outside of US banks, enough for every American to be holding $4,200. Eighty percent of US currency is in hundred dollar bills, yet few of us actually carry large bills around (except perhaps in the Bay Area, where the ATMs do dispense 100s…). So where is all this money? Rogoff’s careful evidence gathering points to the hands of criminals and tax evaders. Perhaps more importantly, the availability of cash makes it impossible for central banks to pursue negative interest rate policies—because we can just hoard our money as cash and have an effective zero interest rate.

What to do about this? Rogoff does not argue for a cashless economy, but rather a less cash economy. Eliminate large bills, particularly the $100 (interesting fact–$1mm in 100s weighs just 22 pounds), and then moving large amounts of value around illegally becomes much more difficult. Proxies for cash are not very good—they are illiquid, heavy, or easily detectable. And what about Bitcoin?—not as anonymous as people think. Think Rogoff’s plan is impossible? Well, India Prime Minister Modi just implemented a version of it, eliminating the 500 and 1,000 rupee notes.

As you might imagine, Rogoff’s proposal angers many privacy advocates and libertarians. His well written, well informed, and well argued book deserves more than its 2 stars on Amazon.

My critique is a bit different from the discontents on Amazon. I think Rogoff’s proposal offers a good opportunity to think through what consumer protection in payments systems might look like in a less-cash world—this is a world I think we are entering. Yet, Rogoff’s discussion shows a real lack of engagement in the payments and especially the privacy literature. For Rogoff’s proposal to be taken seriously, we need to revamp payments to address the problems of fees, cybersecurity, consumer protection, and other pathologies that electronic payments exacerbate.

The Problem of Fees

One immediately apparent problem is that as much as cash contributes to crime and tax evasion, electronic payments contribute to waste as well, in different ways. The least obvious is the cartel-like fees imposed by electronic payments providers. All consumers—including cash users—subsidize the cost of electronic payments, and the price tag is massive. In the case of credit cards, fees can be as high as 3.5% of the transaction. I know from practice that startups’ business models are sometimes shaped around the problem of such fees. Fees may even be responsible for the absence of a viable micropayment system for online content.

Fees represent a hidden tax that a less-cash society will pay more of, unless users are transitioned to payment alternatives that draw directly from their bank accounts. Rogoff seems to implicitly assume that consumers will chose that alternative, but it is not clear to me that consumers perceive of the fee difference between standard credit card accounts and use of debit or ACH-linked systems. For many consumers, especially more affluent ones, the obvious choice is to choose a credit card, pay the balance monthly, and enjoy the perks. Rogoff’s policy then means more free perks for the rich that are subsidized by poorer consumers.

Taking Cybercrime Seriously

Here’s a more obvious crime problem—while Rogoff is quick to observe that cash means that cashiers will skim, there is less attention paid to the kinds of fraud that electronic payments enable. Electronic payment creates new planes of attack for different actors who are not in proximity to the victims. A cashier will skim a few dollars a night, but can be fired. Cybercriminals will bust out for much larger sums from safe havens elsewhere in the world.

The Problem of Impulsive Spending and Improvidence

Consumers also spend more when they use electronic payments. And so a less cash society means that you’ll have…less money! Cash itself is an abstract representation of value, but digital cash is both an abstraction and immaterial. One doesn’t feel the “sting” of parting with electronic cash. In fact, there is even a company making a device to simulate parting with cash to deter frivolous spending.

The Problem of Cyberattack

Rogoff imagines threats to electronic payment as power outages and the like. That’s just the beginning. There are cybercriminals who are economically motivated, but then there are those who just want to create instability or make a political statement. We should expect attacks on payments to affect confidentiality, integrity, and availability of services, and these attacks will come both from economically-motivated actors, to nation states, to terrorists simply wanting to put a thumb in the eye of commerce. The worst attacks will not be power-outage-like events, but rather attacks on integrity that undermine trust in the payment system.

Moving From Regulation Z to E

The consumer protection landscape tilts in the move from credit cards to debit and ACH. Credit cards are wonderful because the defaults protect consumers from fraud almost absolutely. ACH and debit payments place far more risk of loss onto the consumer, theoretically, more risk than even cash presents. For instance, if a business swindles a cash-paying customer, that customer only loses the cash actually transferred. In a debit transaction, the risk of loss is theoretically unlimited unless it is noticed by the consumer within 60 days. Many scammers operate today and make millions by effectuating small, unnoticed charges against consumers’ electronic accounts.

The Illiberal State; Strong Arm Robbery

Much of Rogoff’s argument depends on other assumptions, ones that we might not accept so willingly anymore. We currently live in a society committed to small-l liberal values. We have generally honest government officials. What if that were to change? In societies plagued with corruption and the need to bribe officials, mobile payments become a way to extract more money from the individual than she would ordinarily carry. Such systems make it impossible to hide how much money one has from officials or in a strong-arm robbery.

Paying Fast and Slow

Time matters and Rogoff is wrong about the relative speed of payment in a cash versus electronic transaction. Rogoff cites a 2008 study showing that debit and cash transactions take the same amount of time. This is a central issue for retailers and large ones such as Wal-Mart know to the second what is holding up a line, because these seconds literally add up to millions of dollars in lost sales. Retailers mindful of time kept credit card transaction quick, but with the advent of chip transactions, cash clearly is the quickest method of payment. It is quite aggravating to wait for so many people charging small purchases nowadays.

Mobile might change these dynamics–not not anytime soon. Bluetooth basically does not work. To use mobile payments safely one should keep their phone locked. So when you add up the time of 1) unlocking the phone, 2) finding the payment app, 3) futzing with it, and 4) waiting for the network to approve the transaction, cash is going to be quicker. These transaction costs could be lowered, but the winner is going to be the platform-provided approaches (Apple or Android) and not competitive apps.

Privacy 101

Privacy is a final area where Rogoff does not identify the literature or the issues involved. And this is too bad because electronic payments need not eliminate privacy. In fact, our current credit card system segments information such that it gives consumers some privacy: Merchants have problems identifying consumers because names are not unique and because some credit card networks prohibit retailers from using cardholder data for marketing. The credit card network is a kind of ISP and knows almost nothing about the transaction details. And the issuing and acquiring banks know how much was spent and where, but not the SKU-level data of purchases.

The problem is that almost all new electronic payments systems are designed to collect as much data as possible and to spread it around to everyone involved. This fact is hidden from the consumer, who might already falsely assume that there’s no privacy in credit transactions.

The privacy differential has real consequences for privacy that Rogoff never really contemplates or addresses. It ranges from customer profiling to the problem that you can never just buy a pack of gum without telling the retailer who you are. You indeed may have “nothing to hide” about your gum, but consider this—once the retailer identifies you, you have an “established business relationship” with that retailer. The retailer than has the legal and technical ability to send you spam, telemarketing calls, and even junk fax messages! This is why Jan Whittington and I characterized personal information transfers as “continuous” transactions—exchanges where payment doesn’t sever the link between the parties. Such continuous transactions have many more costs than the consumer can perceive.

Conclusion

Professor Rogoff’s book describes in detail how cash leads to enabling more crime, paying more taxes, and how it hobbles our government from implementing more aggressive monetary policy. But the problem is that the proposed remedy suffers from a series of pathologies that will increase costs to consumers in other ways, perhaps dramatically. So yes, there is a curse of cash, but there are dangerous and wasteful curses associated with electronic payment, particularly credit.

The critiques I write here are well established in the legal literature. Merely using the Google would have turned up the various problems explained here. And this makes me want to raise another point that is more general about academic economists. I have written elsewhere that economists’ disciplinarity is a serious problem, leading to scholarship out of touch with the realities of the very businesses that economists claim to study. I find surprisingly naive works by economists in privacy who seem immune to the idea that smart people exist outside the discipline and may have contemplated the same thoughts (often decades earlier). Making matters worse, the group agreement to observe disciplinary borders creates a kind of Dunning–Kruger effect, because peer review also misses relevant literature outside the discipline. Until academic economists look beyond the borders of their discipline, their work will always be a bit irrelevant, a bit out of step. And the industry will not correct these misperceptions because works such as these benefit banks’ policy goals.

What can fit in 2170×60?

🙂 Thank you, jonathanhher for your Nyan Cat logo.

Behold the newest self-regulatory group, the “Coalition for Better Ads,” which claims that it will, “improve consumers’ experience with online advertising. The Coalition for Better Ads will leverage consumer insights and cross-industry expertise to develop and implement new global standards for online advertising that address consumer expectations.” How? They will:

• Create consumer-based, data-driven standards that companies in the online advertising industry can use to improve the consumer ad experience

• In conjunction with the IAB Tech Lab, develop and deploy technology to implement these standards

• Encourage awareness of the standards among consumers and businesses in order to ensure wide uptake and elicit feedback

  The Coalition will draw upon consumer research in shaping the standards.

What are “better” ads? Certainly more secure ads would be welcome, in the sense that modern web advertising is not a billboard but rather code that can introduce insecurity. But what about privacy? Wouldn’t it make sense for ads to be more respectful of users privacy? How about advertisers’ use of data brokers to merge data online and off–something that NAI promised would not happen back in 2000?

These are dangerous questions to ask. So dangerous, that the fearless leaders of Facebook wouldn’t even ask them. Recall last month when Facebook announced it would circumvent ad blockers? Facebook’s Andrew Bosworth wrote:

For the past few years at Facebook we’ve worked to better understand people’s concerns with online ads. What we’ve heard is that people don’t like to see ads that are irrelevant to them or that disrupt or break their experience. People also want to have control over the kinds of ads they see.

Well, I think those conclusions are correct. Obviously no one wants disruptive ads–the emergence of the popup blocker is testimony to that. And if you are going to have advertising, you might as well have relevant ads. The elephant in the room is privacy–how did a company that tracks people on about 40% of the public web, intermediates the conversations, and tracks them physically not raise privacy issues? The answer is that Facebook didn’t ask about privacy.

Turning to the Coalition for Better Ads, it did not mention privacy anywhere in its discussion of ads. Nor did Pagefair in its 2015 study of ad blocking, nor did IAB’s primer on ad blocking. The closest that any ad group will get to the question appears to be Secret Media, which in a 2016 report wrote, “It is our hypothesis that advertising technologies are negatively impacting publisher websites and causing users to be frustrated by slow page load, tracking that exploits personal data, and the over exposure to ads.”

I am honored and delighted to have my book reviewed by EUI’s Bilyana Petkova, who wrote in part:

…the work of Hoofnagle stands out by offering both a welcome description of the applicable law and a broad contextual framework…Chris J. Hoofnagle takes over fifteen years of experience in American consumer protection, information, and privacy law and converts them into an absorbing, in-depth institutional analysis of the agency.
[…]
Overall, Chris Hoofnagle’s Federal Trade Commission Privacy Law and Policy is a fascinating read and a treasure trove of useful references for further research.

The full cite is: Bilyana Petkova, Book Review: Federal Trade Commission Privacy Law and Policy, 14(3) Int J Constitutional Law 781–783 (2016) doi:10.1093/icon/mow053

In LifeLock, the FTC alleged that the company “failed to establish and maintain a comprehensive information security program…” as required by a 2010 order. Lifelock settled the case for over $100M, despite the fact that the company claimed it had a clean bill of health from a reputable third party PCI assessor, and according to Commissioner Olhausen, LifeLock suffered no breach. Much of LifeLock was sealed, and so the case is a bit of a puzzle–how could it be the case that a company that receives a clean PCI-DSS assessment could also fail to establish a security program?

I hear we’re going to learn more specific details on the case soon, but in the meantime, the FTC just released to me LifeLock’s initial (2010) assessment. It contains a comical “public version” which is completely redacted and a largely unredacted “non-public” version.

More to come soon, but bear in mind that the FTC gave Wynhdam a kind of safe harbor if the company obtains a clean PCI assessment. If other respondents ask for similar treatment, these assessments are going to become more important than ever.

Few have shed as much light on data science than Cathy O’Neil. The former Barnard math professor, author of Doing Data Science, and hedge fund quant has now published Weapons of Math Destruction (Crown 2016).

Weapons of Math Destruction (WMDs) are perversions of data science that increasingly influence our lives. O’Neil shows how sloppy mathematical processes, designed for efficiency and lacking any consideration of fairness, are being used to sort people. Why is this a problem? WMDs are focused on the poor, while the rich get to rely on old-school methods reputation and decisionmaking—the letter of recommendation, the personal interview, and so on. Why are WMDs worse than ordinary human decisionmaking, with all of its foibles? O’Neil argues that WMDs lack feedback loops and that WMD users are much more concerned about doing things well enough rather than correctly. To demonstrate these points, O’Neil walks the reader through anecdotes including the scoring of teachers based on student exam performance, the pathologies that have arisen from U.S. News & World Report’s rankings of colleges, the online advertising that leads people to subprime loans and for-profit colleges, use of algorithms to sentence criminals, use of predictive policing to allocate cops on the beat, the use of information to set personalized insurance rates, and Facebook’s potential to influence our mood and votes.

Our livelihoods increasingly depend on our ability to make our case to machines

O’Neil points out time and again that people learn to game the algorithm. So, why isn’t that enough to solve the problems that O’Neil elucidates? The gaming creates perverse incentives and gross outcomes. Teachers help their students cheat in order to perform well on test-score-based algorithms; the honest who do not get fired. Colleges “hire” highly-cited professors on a part-time basis only to list them on their website in order to improve the school’s ranking.

In other cases, individuals cannot game the system and they suffer for it. Poor neighborhoods with nuisance crimes get more and more police attention, and in turn, more arrests, which feeds into other systems that predict that the poor are more likely to be recidivists. People who do not comparison shop are identified and charged more because companies can. And finally, we face the risk that Facebook will use its platform to shape how we view the world, to encourage us to vote or not, and so on.

O’Neil discusses baseball data science extensively, showing how the reams of information from games can be used to make interesting predictions and alter gameplay strategy. According to O’Neil, baseball analytics are fair for several reasons: the system does not use proxies (indirect measures of player skill) for performance and instead relies on direct evidence such as number of runs hit. The inputs of baseball analytics are transparent: anyone can see and record them. In addition, whatever machine learning that is occurring is relatively transparent as well. Finally, the system can incorporate lessons from its predictions and adjust accordingly.

How would one improve on O’Neil’s assessments of WMDs? I would suggest several additional factors. First, taking baseball as an example, there are no pathological incentive conflicts in such analyses. Baseball teams want their players to perform well. O’Neil’s book details just how conflicting incentives are in other contexts, such as when your bank analyzes your value as a customer. Second, to the extent there are conflicts (after all, the baseball teams are in competition), they are in rough equilibrium. Two well-resourced teams are competing, and we can assume that each can anticipate and react to the predictive power of the other. On the other hand, I am at a total disadvantage with respect to my bank’s analytics. In theory, competition among banks protects me, but in reality, transaction costs in switching, the erosion of fiduciary duty to customers, and so on makes our relationship with banks a form of competitive conflict.

Weapons of Math Destruction makes a good case that efficiency is not an unqualified good. O’Neil shows how increasingly, WMDs are used to create efficiencies for companies that come at the cost of our dignity and to the fairness of our society. She suggests several interventions that would deepen the responsibility the data scientist has for the data subject. But under my suggested framework above (incentive conflict and equilibrium), I think a needed solution is to bring back competition—radical competition. The challenge is to bring back this competition in a society that has bought into the platform, a society that can say with a straight face that ISPs are competitive, and that ignores the obvious transaction costs involved in putatively competitive markets. If we could get away from using a single company for search, email, social networking, online videos, ecommerce, advertising, a browser, an app market, and an operating system, there would be one less company that could so deeply evaluate us and control how we experience the world.

I am so delighted with Joshua Cohen’s Book of Numbers that here I’ve picked out my favorite neologisms from the work (earlier post on the book here).

• Adverks sales: The industrial activity of advertising—onvertising, online advertising
• Recs, rectards, rectarded, recy: One of the most colorful and widely used descriptors in the book. Techs are sophisticated users, and then there’s recs, recreational ones. For instance, Principal describes the company’s new New York office as being filled with “Divisions requiring minimal intelligence. Minimal skill. Not techs but recs.” And Principal’s father as having subscribed to a “cruft of rectarded netservices whose chief goal was to keep their users within the walled garden by providing a sense of community, along with local news and weather, only so as like not to lose them to the wilds of the web…”
• Lusers: Loser users
• Plastiwicker: Those cheap plastic chairs formed to look like wicker
• Laptopped: Your probable current condition, dear reader
• Fannypackers: Wearers of fanny packs
• Acqhires: Workers “hired” through acquisition of their company
• Lotused: Something that Steve Jobs might do
• Comptrasting: To both compare and contrast
• Octalfortied: Forgotten
• Concentives: The name Cohen gave to a mystery shopper company. Seems perfect for a social media marketing company
• Crustaceate: A crabwalk. To index internet sites like a crab, compare with “spider” or “crawl”
• Glomars: Presumably a reference to the Glomar Explorer—a project so secret that one cannot disclose its existence or non-existence. We learn from the book that Tetration is spying on its users and perhaps framing them for crimes by suggesting content.
• Lynchrims: “…situations in which one human hangs lynched without clothes from a tree while another human stands just below and rims their anus.”
• Compocalypse: Computer related disaster

Useful words I learned from Book of Numbers

Resensed

Pantophagy

Steatopygous

Goutish

Verbigeration 🙂