Ask HN: How to disclose something without disclosing it?
A while back I came across an interesting problem that I've been thinking about off and on. Let's say I am thinking about taking a job working for a large company, but in some relatively dangerous part of world. I don't think I would take the job unless, among other things, I knew that the employer had kidnap and ransom insurance for its employees. However, some K&R policies prohibit the employer from telling the employee that the coverage exists. Is it possible for the employer to prove that they have the insurance without telling the prospective employee?
62 comments
[ 1.7 ms ] story [ 46.2 ms ] threadThe reason they can't tell you is that you may then 'kidnap' yourself to collect on it.
By even "accidentally" disclosing it's exustence they would be giving the employee information that would help them to steal from the company, since their rates would increase after the fraud.
A more reasonable answer might be "We promise to do whatever we can to help any employees who find themselves in such a situation, but can't provide details as to the form that help might take as every situation is different."
I don't think you know how this insurance works.
Conceptually, I feel like there might be a connection to zero knowledge proofs (https://en.wikipedia.org/wiki/Zero-knowledge_proof), so perhaps you can look there for inspiration if you haven't heard of it.
I think the best way is likely Social Engineering/asking someone.
Here's how it goes: "To disclose something" is only a comprehensible term for the citation of something that is disclosable. But it's get very blurry, when you only paraphrase. It get's even more blurry at the point, where the paraphrasing is chosen so smart, that only other very smart people can see, that someone actually disclosed something. But: At a jury, you can play the innocent and a little bit naive person, that didn't know what he _actually_ said. Since the people tend to say about a person "He's propably not that smart, rather than naive!", because otherwise they would admit another person is way smarter then them, you are save.
Compare it to those logic-puzzles where you have set of sentences given and can derive a definitive answer by logical-deduction thru the interference of the sentences only. That would be my approach.
Mathematically no. But this isn't a mathematical question, it's a legal one: "some K&R policies prohibit".
You need to nitpick the legal agreement and figure out the loopholes.
Your employer will have to assist you with that, since you have no access to the agreement.
For example as part of the employment agreement you write: "Company shall expend whatever resources are necessary to recover employee in case of kidnap, etc, etc". There is no mention of insurance, just that the company will get you back. How they do it is their problem. (Obviously you're going to need a lawyer to help you write it.)
It is a threat that is included in the insurers threat model.
> It seems like there would be easier ways for an unscrupulous employee to defraud their company.
Probably, but not an easier way for them to defraud the K&R insurer. It's an insurer policy, not employer policy.
Like rdtsc said, pointing to times when they did guarantee the return of an employee would be pretty close. Not entirely foolproof, since past performance is not indicative of future results (if they got the insurance policy without telling anyone, they could easily drop the insurance policy without telling anyone).
In a broader sense, the way this (disclosure without disclosure) is usually done is escrow of some sort. There is an agreement with a third party that the agreement will be upheld, with money down to that third party. If the money is required to be issued from the first party to the second party, the second party does not need to rely on the first party to uphold their end of the agreement. The third party (escrow service) has already assured that, and now the third party is responsible for issuing the payment. For example, if I'm promised payment for source code and I want to ensure I get the payment upon delivery of the source code, the company submits the payment to escrow and I submit the source code, and the escrow company is responsible for ensuring the payment and code get swapped appropriately.
I'm not sure if proving an escrow policy of "we will make sure you get home" and putting down $1m just in case of ransom violates that K&R clause or not. But without a contract saying specifically "we will get you home no matter what", there is no real assurance. Escrow might be the closest you'll come.
If you really want the job, ask for an extra for paying the insurance yourself. That way you are 100% sure you go coverage (if you don't forget to pay the insurance!)
Personally, I wouldn't take that job, even if I could buy the best insurance myself. I just don't like betting against myself.
Hm? That's not how insurance works.
You can think of insurance as a small & certain loss to hedge against a large & uncertain loss.
If stuff happens and you do need to cash in on that insurance policy, the payout should be thought of as saving your butt, also known as indemnification.
An airbag in your car is a form of insurance. You spent $X to protect yourself in a collision. The small & certain loss is spending the $X. Say you unexpectedly end up in a crash, but instead of dying, the airbag saves your life. It protected you from a death, the large & uncertain loss.
The idea of that buying an insurance is making a bet against yourself doesn't make sense to me. Insurance is more about making sure you don't lose. It's reducing risk, and a bet feels like taking on risk. The insurance company is the one making the bet, not the policy holder.
Replace the airbags by a long pointy metal spike that goes next to the driver throat.
Would that impact the way you drive? I think you would be super careful. Then, why do you think an airbag will not impact the way you drive? It does - only in the other direction.
We all have unconscious bias. Insurance increase risk. I want to minimize my risk, not my average payout. This requires recognizing my own biases.
If I'm kidnapped and dead, all the money in the world won't bring me back. So I'd rather feel unsafe, as it will discourage me from taking risks. In other words, I will not bet against myself.
I don't like making bet against myself, regardless of the reasons behind. So in general, I only take the minimum insurance legally mandated.
In the OP post, you can see that the existence of an insurance will increase his desire to take the job, and thus the risk of being kidnapped. I wouldn't do that, but I'm just talking about me
[1] https://en.wikipedia.org/wiki/Transportation_safety_in_the_U...
This does not hold if the reductions in fatalities caused by the safety features are larger than the (alleged!) increase in fatalities caused by additional recklessness.
Why do you think this is more than an infinitesimal change?
I see people driving classic cars, which would probably be instantly fatal in a crash just like a motorcycle, and yet they are driving conservatively.
That's why it's usually not legal to take insurance out on things that are not you or that you own or are responsible for. Like me taking life insurance out on you, then convincing you to take up crack or simply killing you. I'm betting you're going to die at some odds, then I'm massively changing the odds in my favour relative to the initial bet. Insurance is just gambling with vast sums. Sometimes it makes sense, sometimes it doesn't.
No, insurance is gambling with small sums from the point of view of people selling it, and it is avoiding gambling with large sums from the point of view of people buying it.
But probabilistically doesn't it make sense to skip insurance altogether?
If insurance manages to turn a profit despite having overhead expenses (salespeople, infrastructure, lawyers, etc) and assuming they don't have a special discount in whatever they're ensuring then there are more people paying without using than there are people who need it.
If I'm an average or above average driver, for example, then it doesn't make sense to have insurance, does it? Wouldn't it make more sense to save the money I'd otherwise be using for insurance and pay myself in case something happens? That way my money would go only towards my problem and not towards worse drivers and insurance company expenses.
Is the product that insurance offer really just peace of mind?
You’re waiting at a red light when a drunk driver smashes into you. Your skills as a driver can’t affect the probability of this. It may not be your fault, but someone needs insurance.
The difference between owning a total of 0 and a total of 10000 USD is way more important than the difference between owning 10000 and 20000 USD.
So assume you have 20000 USD. There's a 10% change that you will lose it all and become homeless. It makes sense for you to pay 2000 USD at the start to get 10000 USD back in case that happens. Because being homeless in 10% of the cases is way worse than having 18000 USD instead of 20000 USD in 90% of the cases.
If they trust you they’ll tell you. If they don’t they won’t. Now you can decide based off of that if you want to pursue employment.
This is the best and easiest way I’ve gotten people to tell me things they weren’t allowed to.
If you don't trust them, and they might hint at having insurance as a carrot to tempt you to sign, this doesn't apply.
However, this is probably down to common sense. If the pay and other benefits are good, and it is common for companies of similar scale in the region to have this cover, then they will have it.
You have to get someone kidnapped. Or do it yourself.
Then see if it gets paid out.
In other words, when push comes to shove, do they pay out? That’s how you are able to find things out that they won’t tell you. See for example Sherlock Holmes yelling fire and Irene Adler revealing where her treasures are.
Just um, pay some people to hide an existing employee for a while, treat them well, in fact provide a budget for them to be in on it and not try to escape, but instead help make everyone believe they were kidnapped against their will. If a person agrees you go with that person.
Then hope no one reads HN religiously at that company.
Of course, this is all theoretical. But - you asked.
I'm sure that in some situations this kind of approach would be up there on the drawing board. Lots of money pitted against unknown trust, or military projects (the super-super expensive kind) immediately come to mind.
But even then, in the theoretical "high risk / untrustworthiness" scenario, surely one payout event wouldn't provide enough confidence to predict similar behavior in the future, and causing multiple events is suspicious enough you wouldn't be able to rule out whether the adversary was paying out each time because they'd caught on.
A proper ZK analog would be the company being prohibited from giving you a signed statement saying they had said coverage, as if you were kidnapped the kidnappers would force you to turn over this signed statement to know you represent a nice payday. So they type out a statement, then sign it with an X in front of you. If the kidnappers see this, they cannot be sure you didn't just type up the statement and sign it with your own X - only you know it was signed by the company.
But back in the physical world your kidnappers will just "prove" the fact to themselves by beating it out of you. Which is why the K&R policy prohibits any sort of telling you, not just written - your knowing is the liability.
Thinking about it, perhaps it's to do with the location a person is in, and the reputation that location may have.
Shipping comes to mind (the "actually being in location XYZ" part of the transportation process), along with the fact that perhaps some at the destination may want to hinder the receipt of whatever's being shipped
I can't come up with much else right now, although I'm very sure there are many other reasons.