In this week’s Guardian column, “The real cost of free,” I reply to last week’s broadside by my fellow Guardian columnist Helienne Lindvall, who accused me of charging enormous fees to encourage creators to give their works away. After correcting the record on fees (most of my talks are free, a small number are paid for, and a tiny fraction of those are paid for at large amounts), I go to the meat of the issue: what is it that I tell people when they ask me to speak at their events?

But I don’t care if you want to attempt to stop people from copying your work over the internet, or if you plan on building a business around this idea. I mean, it sounds daft to me, but I’ve been surprised before.

But here’s what I do care about. I care if your plan involves using “digital rights management” technologies that prohibit people from opening up and improving their own property; if your plan requires that online services censor their user submissions; if your plan involves disconnecting whole families from the internet because they are accused of infringement; if your plan involves bulk surveillance of the internet to catch infringers, if your plan requires extraordinarily complex legislation to be shoved through parliament without democratic debate; if your plan prohibits me from keeping online videos of my personal life private because you won’t be able to catch infringers if you can’t spy on every video.

And this is the plan that the entertainment industries have pursued to in their doomed attempt to prevent copying. The US record industry has sued 40,000 people. The BBC has received Ofcom’s approval to use our mandatory licence fees to lock up its broadcasts with DRM so that we can’t tinker with or improve on our own TVs and recorders (and lest you think that this is no big deal, keep in mind that the entire web was created by amateurs tinkering with systems around them). What’s more Apple, Audible, Sony and others have stitched up several digital distribution channels with mandatory DRM requirements, so copyright holders don’t get to choose to make their works available on equitable terms.

In France, the HADOPI “three strikes” rule just went into effect; they’re sending out 10,000 legal threats a week now, and have promised 150,000 a week in short order. After three unsubstantiated accusations of infringement, your whole family is disconnected from the Internet –from work, education, civic engagement, distant relatives, health information, community. And of course, we’ll have the same regime here shortly, thanks to the Digital Economy Act, passed in a three-whip washup in the last days of parliament without any substantive debate, despite the thousands and thousands of Britons who asked their legislators to at least discuss this extraordinarily technical legislation before passing it into law.

The real cost of free

I’m doing a live online chat today (Thu) with the CBC’s Book Club at 8AM Pacific/11AM Eastern/4PM UK. Hope to catch you there!

My latest Guardian column, “Promoting statistical literacy: a modest proposal” discusses the way that state-sponsored lotteries and sloppy financial regulation promote a dangerous kind of statistical illiteracy; dangerous because it subverts our ability to assess and mitigate risk.

For example, my own bank, the Co-op, recently updated its business banking site (the old one was “best viewed with Windows 2000!”), “modernising” it with a new two-factor authentication scheme in the form of a little numeric keypad gadget you carry around with you. When you want to see your balance, you key a Pin into the gadget, and it returns a 10-digit number, which you then have to key into a browser-field that helpfully masks your keystrokes as you enter this gigantic one-time password.

Don’t get me wrong: two-factor authentication makes perfect sense, and there’s nothing wrong with using it to keep users’ passwords out of the hands of keyloggers and other surveillance creeps. But a system that locks users out after three bad tries does not need to generate a 10-digit one-time password: the likelihood of guessing a modest four- or five-digit password in three tries is small enough that no appreciable benefit comes out of the other digits (but the hassle to the Co-op’s many customers of these extra numbers, multiplied by every login attempt for years and years to come, is indeed appreciable).

As if to underscore the Co-op’s security illiteracy, we have this business of masking the one-time Pin as you type it. The whole point of a one-time password is that it doesn’t matter if it leaks, since it only works once. That’s why we call it a “one-time Pin.” Asking customers to key in a meaningless 10-digit code perfectly, every time, without visual feedback, isn’t security. It’s sadism.

Promoting statistical literacy: a modest proposal

I’m delighted to announce that I’ll be interviewing William Gibson, live and on stage for London’s Intelligence^2 event on Oct 4. Bill and I always have great conversations, and this one should be a lot of fun, since I’ve been bugging his old friends for interesting conversational veins that go beyond the usual. Plus there’s the fact that his latest novel, Zero History, kicked eleven kinds of ass (I hope that we will be able to enumerate all eleven of them, but I’ll settle for one or two). Hope to see you there!

William Gibson on ‘Zero History’

Thomas Gramstad sez, “I’ve started a web page with an overview of Norwegian translations of your texts. Norwegian titles in bold, English original titles in parenthesis. The list also includes some interviews with you and reviews or summaries of your work (when substantial).”