The Myth and Reality of Risk

Click here to receive your FREE subscription to Campus Technology

Home > The Myth and Reality of Risk

Opinion

The Myth and Reality of Risk

7/25/2008

By Doug Gale

Just when my retirement investments were falling like a lead bricks the EPA informed me last month that I'm not worth as much as I was five years ago. While some of my skiing friends may heartily agree, that wasn't the basis for the EPA's judgment. They have determined that the "value of a statistical life" is $6.9 million--a drop of more than a million dollars in the last five years.

Government agencies do the same kind of quantitative risk analysis that we do in the security arena; risk is a combination of the probability of event and the undesirable consequences of the event. In the case of the EPA they were comparing the cost of implementing tighter pollution regulations versus the value of reducing pollution, in this case the number of lives saved times the value of each life, $6.9 million.

The details of these calculations can have important policy implications. For example, if a proposed regulation will cost an industry $15 billion to implement but will save 2,000 lives, the cost ($15 billion) outweighs the benefits ($13.8 billion) if we use the new "value of a statistical life." But if we use the old value, $7.8 million, the benefits ($15.6 billion) outweigh the costs.

Where did the $6.9 million value come from, and why did it change? The EPA figure didn't come from an individuals estimated earnings or societal value. (My spouse has assured me that I am worth more than $6.9 million.) It was based on what people are willing to pay to avoid risk as measured by how much extra employers pay workers to do more risky jobs. The actual value was the result combining two studies: one that came up with a value of $8.9 million and the other between $2 million and $3.3 million.

The variance in the two studies resulted from subtle differences between comparing risky jobs and comparing risky industries. I don't know about you, but I don't have warm and fuzzy feeling about the methodology or the fact that the answers varied by a factor of four. Neither did some of the members of the EPA's Science Advisory Board. According to Granger Morgan, chair of the Board and engineering and public policy professor at Carnegie Mellon University, "This sort of number-crunching is basically numerology."

Risk Management
That got me thinking about how we quantify risk as we do IT security. When we get to the final cost-benefit ratio everything may seem logical, but does it make sense, or is it just numerology?