First off, I’m just going to be clear: I don’t think this concept has a lot to do with privacy and security in itself. I just think it’s under-appreciated and interesting to think about. I do think there are lessons we can learn from it that apply to that, of course, and I go through those, but the tie is pretty thin.
System Justification Theory (SJT) is a theory that essentially posits that people – to varying extents – are motivated to justify the status quo, including defending the systems that we are entwined within as necessary, just or otherwise good, even if they are transparently awful. It posits that this is not necessarily related to one’s position within the system; while those who benefit from it have an obvious motivation to defend the system, sometimes even people who are being exploited by or suffering under the system can also do this
I don’t know how to describe the construct here. I’m going to call it “status-quo-justifying” or SQJ, just for ease, but I’m almost sure that’s not what it’s called. I haven’t seen it called anything anywhere, so I’m going to name it that.
The scale most commonly used to measure this includes items like:
In general, you find society to be fair
In general, the American political system operates as it should
American society needs to be radically restructured (reverse-scored)
The United States is the best country in the world to live in
Most policies serve the greater good
Everyone has a fair shot at wealth and happiness
Our society is getting worse every year (reverse-scored)
Society is set up so that people usually get what they deserve
So you can see a lot of these are common ideas in conservative narratives and worldviews. This is not a co-incidence, conservative people tend to be pretty SQJ. I’m not sure if conservatism causes SQJ, SQJ causes conservatism, or there’s some third variable that causes/contributes to both (probably this, if I had to bet), but ultimately that’s irrelevant to our point today. Let us intone the ritual words “correlation does not imply causation” and move on with our lives.
The cognitions and behaviours described in SJT are related to the “just-world hypothesis”, which basically describes when people believe that in some important way, we get what we deserve, and we deserve what we get. So a person who does well is doing so because they worked hard or was smart or talented, while a person who is not doing well is lazy or stupid. This is obviously untrue (or at least oversimplified and incomplete), if nothing else because it ignores the role of luck in outcomes. But it is a common idea, and before we bang on it too much (because it can cause pretty serious harms, as well as being false), it’s important to bear in mind that it does serve an important psychological function. One such function is that it helps us not be paralysed by fear and anxiety, moving through a potentially hostile world. In a world where it’s not too much of an exaggeration to say that our every move is tracked and monitored, it’s easy to become paranoid or overcome with despair, which apart from not being fun, is really not helpful in improving one’s situation. So being able to say “well, of course you got stalked, you’re posting everything on Facebook” is a really great mechanism, even if it’s not great in terms of actual reality.
SJT has obvious political implications, which we’re not touching on today in order to avoid people getting distracted. Suffice it to say that those who are more conservative tend to behave in ways that are more supportive of the status quo, even if they are objectively worse off under it. For example, in the US, among gay people, conservatism is associated with stronger anti-gay positions and less likely to support pro-gay policies. That said, people who are well-off within a system are more likely to justify it
What is more interesting – and less likely to lead to arguments that go nowhere except bad feeling – is why people do this. That depends on the individual and context, but one is what’s called the “existence bias”, which I hadn’t heard of before. This posits that people tend to view things that they believe are common or long-lasting as more subjectively pleasing than things they believe are uncommon or new. In one study, people were given a drink to taste-test, and told it had been on sale since 1903 or 2003. People who were told it had been around since 1903 rated it as tastier. In another test, people were shown a pseudo-random collection of dots, and told it represented the configuration of stars in a galaxy. Some were told that it was a common configuration, some were told it was uncommon – the people who were told it was common described it as more aesthetically pleasing.
From this perspective, the system we exist within is obviously present, and plays a larger role in our day to day life than systems that aren’t present. The longer the system has been around – say the social or economic systems and hierarchies we exist within – the stronger this effect will be. On the surface this makes sense; any system has as a value to perpetuate itself, so a social order that breaks down after a short time is probably less desirable to adopt on a large scale than an order which lasts a comparatively long time. But while this makes sense, it doesn’t explain why a pseudo-random collection of dots allegedly representing a common or uncommon galaxy is more or less aesthetically pleasing. Astronomical implications aside, it doesn’t really have any implications for life on Earth whether this particular pattern of stars is common or uncommon. It definitely doesn’t explain why a given drink is more or less tasty just because the recipe has been around longer – plenty of food from a century ago really doesn’t suit the modern palate. Remember, it was the same pattern or drink in both cases, so theoretically it should have the same aesthetic value.
This is related to the “status quo bias”, which is the tendency of people to prefer the situation as is, even if switching is easy and clearly better. They’re obviously very similar, and I would naively expect people high on one to be high on the other, but I see the difference as one of passive preference vs actively exerting effort, even if that’s only cognitive effort.
Example scenario: me and a friend (Chris) are at an ice cream cafe, and for some reason Chris got strawberry ice cream and I got chocolate, even though I ordered strawberry. I don’t dislike chocolate, but I prefer strawberry. Chris offers to swap; they are pretty apathetic between the two flavours, so swapping is clearly the better option. Status quo bias is me refusing to swap, and just eating the chocolate ice cream; I don’t really exert any energy either way, I just kind of accept the situation in front of me. If I were highly SQJ, I would attempt to argue that actually, chocolate is better, and the server was actually trying to fix this greater problem, or swapping is bad because it creates potential disease vectors, or whatever.
In the status quo bias scenario, I just kind of passively go with whatever is in front of me. In SJT, I exert energy to defend the status quo. In extreme cases this might manifest as taking physical or political action to do so, but I suspect this is relatively uncommon. Again, I’d expect these two variables to be positively correlated, but I haven’t seen any specific measurements of this.
Relation to Privacy Behaviours
I said that I didn’t think this is particularly related to privacy and security, and I do think that. But in the interests of keeping this semi-actionable, I think this might be part of what keeps people from making even small changes to improving their online privacy. The more options a person is presented with, the more likely they are to stick with what they perceive as the default (often, the existing setup). So, let’s say someone hears about one of the dozens of breaches to happen this month, and decides that they can’t trust companies to secure their data from bad actors, so they want to try to make some small changes. They decide to start with e-mail; Google has had a few big data breaches (although nothing recent that I’m aware of), so they decide to go with a provider that has a better track record; Google’s security is pretty good, but they openly scan basically everything you do for advertising, so it’s only a matter of time. They look up “secure e-mail provider” on DuckDuckGo, and find…
Oof. OK, that’s a lot. For reference, in the first three pages, I found 20 recommended unique services, about half of which I hadn’t even heard of before, and at least one of which doesn’t exist anymore (CTemplar). Honestly, I feel relatively comfortable navigating things like this, and I’m intimidated with the sheer deluge of options. Don’t get me wrong, options are good, I’m glad there’s options, but it does come with a kind of choice overload, especially for Bob Average. They don’t know what makes a good e-mail; they’ve heard the term “end-to-end encrypted” and maybe the term “zero knowledge encryption”, but they have at best a very shaky grasp on what they actually mean. Add in the sheer number of companies that flat-out lie about that kind of thing, and frankly Bob doesn’t realistically have a hope. Add in all the extra effort involved in changing your e-mail, and… yeah. It’s not happening for Bob, is it?
True story: when I started using e-mail aliases (mostly to manage spam, slightly to reduce tracking), it took me over two weeks to change all the accounts that I could. Many I still haven’t changed, mostly because I can’t for whatever reason (which is part of why I still have a G-Mail account). And I was way more comfortable doing that than Bob would be. So honestly, if Bob said “blow that for a game of soldiers, that’s way too much work” I honestly would be hard-pressed to disagree with Bob.
This is part of why threat modelling is so important, and part of why I think it’s such a horrible oversight of the privacy “community” that it’s overlooked and not emphasised enough. Because a lot of what some people will tell you is necessary is just a stupid amount of work, for what is very plausibly minimal or zero gain. I have a lot of aliases, and while I don’t mind doing that, if someone forced me to justify it in terms of actual concrete benefits, I’d honestly struggle. By far the biggest source of spam is that old G-Mail account that I cannot close for reasons outside my control, and honestly my aliasing habit has caused me more stress than allowed me to control spam. I do enjoy the feeling of control it gives me, and for me that’s enough, but I wouldn’t recommend it to Bob, at least not to the extent I do it. Maybe SimpleLogin or AnonAddy’s free tier for “risky” accounts, but definitely nothing more extensive.
So, in terms of take-aways, if someone’s asking questions or wants to do something, I’d recommend providing them with only a couple of options, ideally the most user-friendly and easy ones. People have a natural – and justifiable – bias towards things that are more familiar to what they already know. Some people are different and enjoy things as far outside their wheelhouse as possible, but they’re pretty unusual. Most of the time, closer to the status quo is a better strategy.