The economic logic of executing hackers.

The economic logic of executing hackers.

The economic logic of executing hackers.

How the dismal science applies to your life.
May 26 2004 5:14 PM

Feed the Worms Who Write Worms to the Worms

The economic logic of executing computer hackers.


If we execute murderers, why don't we execute the people who write computer worms? It would probably be a better investment.

Let's do the math. What do we get out of executing a murderer? Deterrence. A high-end estimate is that each execution deters about 10 murders. (The highest estimate I've ever seen is 24 murders deterred per execution, but the closest thing to a consensus estimate in the econometric literature is about eight.) That's 10 lives saved, with a value—again a high-end estimate—of about $10 million apiece. (The closet thing to a consensus estimate in the economics literature is about $7 million per life. I am rounding up.) So let's say the benefit of executing a murderer is roughly 10 times $10 million, or $100 million—and that's probably at the high end.


Compare that to the benefit of executing the author of a computer worm, virus, or Trojan. There seems to be no good name for such people, so I'll make one up—at least until some reader sends in a better suggestion, I'll call them "vermiscripters." It's estimated that vermiscripting and related activities cost the world about $50 billion a year. So if a single execution could deter just one-fifth of 1 percent of all vermiscripting for just one year, we'd gain the same $100-million benefit we earn by executing a killer. Anything over one-fifth of 1 percent, and any effects that last beyond the first year, are gravy.

So much for benefits. What about costs? The cost of an execution is one life—usually (one hopes) the life of the guilty, but occasionally the life of a wrongly convicted innocent. The question is: Which is worth more: the life of the average convicted murderer or the life of the average convicted vermiscripter?

Plausibly, the latter. Compared to murderers, vermiscripters might be easier to rehabilitate (the author of the Sasser worm is, by all reports, still a teenager) and probably have more skills that can be put to good use. (Offsetting this, though, is the prospect that those same skills can be put to further bad use.) Let's bias things very strongly against the conclusion I'm driving at by valuing the average murderer's life at zero and the average vermiscripter's life at $100 million—the same value we earlier attributed to 10 lives.

Then to rate the vermiscripter's execution as a better investment than the murderer's, you'd have to expect it to deter at least $200 million worth of computerized vandalism—enough to cover the $100 million value of executing the murderer plus the $100 million value of the vermiscripter's life. That's twice our earlier estimate, but still just two-fifths of 1 percent of one year's worth of worm and virus damage—and still a plausibly easy hurdle to clear.

Conclusion: On a pure cost-benefit basis, we should be quicker to execute a vermiscripter than a murderer. But of course we're not. Which raises the question: Why not?

Here's one answer: "These things can't possibly be reduced to numbers. Who cares if some economist said a human life was worth $7 million or $8 million or $10 million? A chemist will tell you that the elements in your body have a collective market value of about $10. You might find these numbers interesting in some abstract academic sort of way, but they have nothing at all to do with making wise policy decisions."

The problem with that answer is that it's wrong. To understand why it's wrong, you have to understand how economists come up with these numbers in the first place. When we say that a human life is worth $10 million, we mean nothing more or less than this: A typical person, faced with a 1–in-10-million chance of death, seems to be willing to pay about a dollar to eliminate that risk. We know this not from theory but from observation—by looking, for example, at the size of the pay cuts people are willing to take to move into safer jobs. On this basis, Harvard professor Kip Viscusi estimates the value of a life at $4.5 million overall, $7 million for a blue-collar male and $8.5 million for a blue collar female. (Viscusi acknowledges that it's puzzling for a blue-collar life to be worth more than a white-collar life, but that's what the data show.)

If we can deter one random murder in America, we make you a little bit safer: Your chance of being a murder victim shrinks by about 1 in 300 million (because that's how many Americans there are). If we can execute one killer and deter 10 random murders, the enhancement to your safety is multiplied by 10: Your chance of being a victim shrinks by 1 in 30 million. When we say that your life is worth $10 million, we mean precisely that you'd be willing to pay about one-thirty-millionth of $10 million—about 33 cents—for that much extra safety. (Actually, you'd probably be willing to pay slightly less, because each execution, while making you safer on the street, also enhances the risk that you yourself will be falsely convicted and executed someday.)