Yale Law Professor Arthur Leff wrote a powerful, market-structure analysis of consumer fraud in his 1976 Swindling and Selling. That work is more or less lost to history. Leff explained that con artists attempted to impose a false economy on marks. In a perfect congame, such as the Spanish Prisoner, this false economy was a bilateral monopoly. But in other, less perfect congames, the con artist moved the mark into some otherwise undesirable market relationship, such as an oligopoly.

An analysis of Arthur Leff’s Swindling and Selling

Regular selling is sometimes difficult to distinguish from swindling, because selling often incorporates minor deceptions. But the difference is that those deceptions occur in ordinary, competitive consumer marketplaces, where consumers have more choice among sellers, and in turn sellers are making offers to all consumers rather than to a targeted individual.

This article contributes to Leff’s work by placing modern, internet-based congames in his market structure framework. It argues that most congames have been refactored into advanced fee email schemes, and that these are much more powerful because con artists can easily target people worldwide, because they can lead marks into a long con without ever encountering the mark in person.

How the internet alters age-old swindles.

Ponzi schemes still exist on the internet, despite the availability of information that might help marks see them as such. Bubble logic and the claques of early investors who win in Ponzi schemes still make these cons profitable. As an example, cryptocurrencies share the character traits of earlier Ponzi schemes, right down to Leff’s claim that they must offer a “grey box” business model to swindle people. The blockchain is a perfect grey box—technically transparent but actually inscrutable to the retail investor.

Finally, online behavioral advertising has been critiqued for many reasons. This article adds a new way of thinking about OBA: if we want to realize the promises of OBA, we have to place consumers into a monitoring environment characterized by monopoly, a complete one where nothing is secret to the advertising platform. That is, OBA requires a bilateral monopoly market structure.

Recognizing that OBA has the same fundamental dynamics as the Spanish Prisoner or the bait and switch might cause use to decide to reject OBA, or to subject OBA to rules similar to those imposed on other monopoly actors.

Every one now has a stake in the healthy functioning of communications and control networks, in the devices and services dependent on network, and by implication, in all the complicated infrastructure required to keep networks, devices, and services operating. As we have become more affluent and as the economy has become more interconnected, we are interdependent in ways never thought possible.

The proper functioning of communications networks, which carry everything from banal social updates to the second-by-second valuations of companies to the intelligence that shapes governments’ posture in conflicts, is now a central problem. But it is also an insoluble problem. Cybersecurity is a wicked problem. Cybersecurity is an unbounded problem that cannot be cleanly extricated from an array of social problems and interests. In managing cybersecurity there are few unqualified good approaches, but rather a series of contests and choices among important values. Cybersecurity will also never be solved definitively; instead concerns about whether we can trust devices, networks, and the information present in them will persist and need to be managed.

This is a textbook project with LSU Computer Science Professor Golden Richard III. We explain how cybersecurity has come to encompass these complex interests, how cybersecurity is conceptualized, and how cybersecurity concerns and rules are diffusing through the public and private sectors. Our textbook will introduce students to the technology, political dynamics, theory, and legal practice of cybersecurity.

Representative publications:

• FTC Regulation of Cybersecurity and Surveillance, in The Cambridge Handbook of Surveillance Law (David Gray and Stephen Henderson, eds)(Cambridge University Press 2017)
• An Economic Map of Cybercrime (with Alvaro A. Cárdenas, Svetlana Radosavac, Jens Grossklags, & John Chuang), TPRC 2009.

How privacy is a one-way ratchet.

In this essay for a lecture at Stanford University, I attempt to explain consumer privacy as a deterrence theory strategy.

I argue that privacy does have methods of analysis, based in fair information practices, while popular use of the term “privacy” is loose, a shibboleth representing uncertain values.

This wide-ranging essay then goes on to explain how privacy is a rational strategy based in deterrence theory concepts. This is because giving companies data and attention transfers power to companies. The consumer becomes vulnerable to a class of adversaries with mixed, changing, and even unknowable motives. Data and attention enables companies to shape our interests, tastes, and activities. In some cases, this shaping is cooperative but in others, companies are in competition with consumers’ interests (most obviously when that shaping stokes insecurities, addiction, or encourages other irrational behavior). I tie this interest in shaping to the creation of audiences, and show how platforms’ incentives are to create user groups comprised of miserable people—the kind of people who scroll and click all day.

Platforms have high power incentives to recognize [people vulnerable to extremism] and then to turn them into engaged platform users. Understood this way, our struggles with disinformation, both left- and right- wing, can be seen as a symptom of business competition for attention.

The Web really is just television.

Prediction is the other risk that drives privacy concern. We might want others to predict our greatest needs and wants. But upon inspection, that’s only the case when others care for you. As Zuboff points out, platforms don’t care for one’s welfare. They are indifferent to our situation, so long as it involves eyeballs on their site. This is why YouTube is a cesspool—YouTube lacks incentives to clean up its platform because there is an audience for any kind of terrible content. Platforms can monetize disinformation about vaccines or videos that challenge your children to see how long they choke themselves or terrorist recruitment material. They make money based on how much you watch rather than what you watch.

Another theme surrounds the normative values of technology executives. I recount how Scott McNealy’s “you have no privacy” statement was descriptive—he was recounting what he believed to be the state of play given the rise of a Database Nation. But by the time Google becomes dominant, the statement became  platforms’ normative commitment about privacy. My proof of this comes from the wealth of research that shows that technology executives know that consumers want less tracking, and so they lie or dissemble to distract the consumer from technological realities—even degrading the security of systems in order to keep up user surveillance. What Zuboff calls the “hiding strategy” comes from executives who think consumers do not deserve privacy, so it is okay to lie to consumers.

Technology executives see nothing wrong with the the logic of complete surveillance and the need to hide it from consumers. Why? Because technology executives do not see privacy as a legitimate interest. Remember Scott McNealy’s point was descriptive and now it is normative. Companies do not think you deserve privacy.

How executive strategy on privacy has changed to a “collect it all” mentality—and why it is okay to lie to consumers about it.

Hoofnagle & Garfinkel, Law and Policy for the Quantum Age (CUP 2022)

Quantum technologies use quantum effects to provide some utility. These capabilities are so different from our conventional intuition that quantum technologies seem to ride the fine border between science fiction and fantasy—yet many quantum technologies can be commercially purchased today, and more are just around the corner.

With Simson Garfinkel, I recently completed Law and Technology for the Quantum Age (Cambridge University Press 2022). This book decomposes quantum technologies into quantum sensing, computing, and communications. It critically evaluates the trajectories of each of these technologies and predicts, using scenario analysis, the strategic effects of each. We come to some surprising conclusions: that quantum sensing is the “killer app” in the field; that quantum computing is not only overhyped, it is more likely than not that we are entering a “quantum computing winter;” and that a more promising (and more dangerous) technology exists in the shadows of quantum computer: quantum simulation.

Representative publications:

• Simson L. Garfinkel and Chris J. Hoofnagle, ACM TechBrief: Quantum Computing and Simulation, in: ACM TechBriefs (2022).
• Chris Jay Hoofnagle and Simson L Garfinkel, Quantum Sensors—Unlike Quantum Computers—Are Already Here, in: DefenseOne (June 2022). 
• Chris Jay Hoofnagle and Simson L Garfinkel. Quantum Cryptanalysis: Hype and Reality, in: Lawfare: Hard National Security Choices (Feb. 2022).
• Chris Jay Hoofnagle and Simson L Garfinkel, What if quantum computing is a bust?, in: Slate Future Tense (Jan. 2022).
  

  Now available in audiobook from Audible

In a trio of articles (for NSF-TRUST), I showed how identity theft is an externality of credit granting, where costs of fraud are spread among victims, merchants, and society generally. For instance, the image below is summary data on an identity theft victim who I interviewed–the impostor in the case made numerous errors in pretending to be the victim. Yet mortgage lenders were willing to grant huge loans in the victim’s name, despite mismatches in personal information and the presence of fraud alerts.  This incident of identity theft, and many others, are crimes committed by bad actors, but they are also incidents where credit grantors’ pursuit of profit causes them to overlook evidence of fraud.

In this work, I explain the economic incentives that lead grantors to overlook fraud. Understood as a problem of incentives, different public policy options could be sought. Instead of prescriptive rules proposed by privacy advocates, I argued that credit grantors should be liable for identity theft victims’ lost time and financial costs.  These costs should be allocated to credit grantors, because they are least cost avoiders in the identity theft context, and because consumers cannot control the credit granting process nor insure against identity theft losses efficiently.

My analysis shows that consumer education cannot be effective at stemming identity theft, because the most forms of the crime cannot be prevented through consumer action or inaction.  Further, criminalization largely failed to address the problem, because of law enforcement priorities, a lack of training, and reluctance among businesses to participate in investigations.

• Internalizing Identity Theft, 2010 UCLA Journal of Law & Technology 1 (2010)
• Toward a Market for Bank Safety, 21 Loyola Consumer Law Review 101 (Fall 2008)
• Identity Theft: Making the Unknown Knowns Known, 21 Harvard Journal of Law & Technology 97 (Fall 2007)