[dragonwriter]

> Yes, child abduction/predation is unlikely ... because we've adopted a huge number of countermeasures that close of this vector.

Actually, most of the social "countermeasures" were adopted after high-profile single incidents in the 1990s (perhaps largely because the larger 1960s-1980s crime wave that had been the pretext for expanding government powers in the law enforcement arena previously was ending, and a new pretext was needed) and later, when the overall rate of incidents had been dropping for decades (since, IIRC, the 1950s or 1960s), but media attention to them -- and hence public perception of the prevalence of incidents -- had, at the same time, been increasing.

AFAIK, there is little-to-no evidence that any of the "countermeasures" have had any significant effect on the prevalence of child abduction/predation.

[SilasX]

The problem in claiming "the evidence says..." in cases like this is that the body of potential perpetrators is intelligent and adaptive.

Say someone cracks a major bank account by guessing "password" as the password. The bank changes the password.

I claim that the weak password was a security risk, and changing it was the right response.

Someone comes a long and gives me a data-intense lecture about "well, electronic bank theft was already declining, and it accounts for only a tiny fraction of financial losses, so changing the password was a waste of time, and was in the context of the IT department using a bunch of pretexts to order people around".

How would you refute that, given all the evidence on their side?

[Bjartr]

I'm having trouble building an internally consistent response because of things like how "changing a password" is a trivial change, i.e. I'm struggling to take into account the hypothetical in a way consistent with your intent and with what reality would have to work like for the hypothetical, as given, to hold true.

Mind trying again with a different example?

[SilasX]

The smallness of the change doesn't affect the point I was making. [1] The point is that you can't simply look at the raw incidence rates and conclude that specific added countermeasures are unnecessary or irrelevant to the attacker's incentives.

If you agree with that, then you agree with my general point and it's just an issue of which specific countermeasures survive a CBA.

[1] In fact, I chose a small change specifically to highly the absurdity of being bound by low/declining attack rates.