In the field of risk management, risk-risk tradeoffs can be important. If you try to decrease one risk, you may get unintended consequences that increase other risks, perhaps ending up making things worse instead of better. Studies have shown, for example, that drivers of cars equipped with safety features like seat belts, anti-lock brakes or air bags actually drive more carelessly that drivers in less safe cars. In some cases, this increased recklessness can more than compensate for the benefits from the safety features, creating an actual net loss from the safer cars.
Unintended consequences can often occur in unexpected ways. An example of this is the way in which treating some parasitic infections can cause an increase in allergies. This connection was noticed by Eric Ottesen, when he visited the tropical island of Mauke in 1972. On this visit, he treated the inhabitants for infections by parasitic worms. Being a specialist in both parasites and allergies, Ottesen noticed that the Mauke islanders had both a high rate of parasitic infection as well as a very low rate of allergies. His follow-up study found that while the infections by parasites had been dramatically reduced by 1992, the rate of allergies had become very high. This made him suspect a connection between the seemingly unrelated phenomena.
Subsequent research verified that there is indeed a connection between infections by certain parasitic worms and allergic reactions, leading some researchers to believe that allergies are an unfortunate and unintended consequence of the way in which our bodies deal with the parasites. The theory is that when parasites are rare, our bodies’ defenses tend to overreact to lesser threats, like pollen or dust mites, because they are not being used to fight off parasites, and that we experience the effects of this overreaction as allergies.
Some researchers have even suggested using an intentional infection by safe types of parasitic worms as a treatment for serious allergies, a technique which has shown to be effective in mice. In many cases, people may find infection by parasitic worms to be less appealing that suffering the effects of allergies, but it will certainly depend on how severe the allergies are. People with life-threatening allergies may not mind a few worms living in their bodies if the worms make it safe for them to live more normal lives, for example.
Information security products can come with their own set of unintended consequences. These unintended consequences are probably not as unintuitive as the connection between parasites and allergies, but some of them do require some careful analysis to understand. In the next few days, I’ll talk about the different risk-risk tradeoffs that can make creating a good information security strategy more difficult than it first looks.