by Scott S. Perry, CPA, CISA
Principal, Crypto and Digital Trust Services
Schellman
Back in 2021, members of the Trust Over IP Foundation took on a monumental task. An august set of passionate cyber technologists (including me, who plays at it) set out to create design principles for its innovative Internet architectural model where trust and digital identity can be layered onto online transactions for greater transactional confidence and authenticity.
Within this effort, the group plummeted into a deep dive focusing on what are the key principals driving human trust and the factors in enacting decisions based on trust. I believe this effort was groundbreaking, and I fear this portion of a technical white paper will get lost without the effort to raise the topic to more prominence. In this paper, I hope to summarize and elevate the topic of human trust principles and the factors we humans employ in making decisions based on trust.
From the Oxford dictionary, trust is defined as the “firm belief in the reliability, trust, ability or strength of someone or something”. All of these are human constructs to measure and apply. This makes the concept of trust, with so many variables in play, more of an art rather than science.
The Trust Over IP Design Principles identified the following human trust principles as headings in this essay. The principles create the fabric in which we make decisions to trust something or someone. I’ll explore each one.
Trust is Human
Trust can be achieved with only a few data points or volumes of input. While we can artificially program computers to “trust” using rule sets and decision trees, the full embodiment of trust has too many variables to be programmed holistically. Humans use data, but they also use instincts and emotion to drive their trust decisions, characteristics which are difficult to program. The ingredients of trust are human concepts: belief, experiences, propensity, tolerance, and fear. It is said that human life is a compilation of decisions. Many of these decisions involve trust.
Trust is Relational
In the Oxford definition, trust is the state of reliability, truth, etc. about someone or something. That requires a relationship between the trustor and the object of trust. Those objects are in two broad categories: parties(people) and things. Trust is based on an unlimited number of conditions and experiences, some of which we cannot define verbally or objectively (or sometimes even consciously). Human trust can be vague and subjective, yet it is adaptable enough to consider conditions that are not yet known. It can also change over time—trust in people and things can be built up over multiple interactions and then eroded or destroyed by a single action. But it is all within the trustor over their relationship with the trusted person or object.
Trust is Directional
In the unaccounted number of trust decisions taking place in the world as you read this, each single trust action takes place in one direction. While the earlier principle identified there is a relationship between the trustor and the object of trust. That relationship is always one way, a human trustor applies trust to a party or thing. Trust can be bidirectional, but each trust action is one way and separate and nondependent on each other. Now that we have the two atomic principles for trust, we can build upon these elements using the next principles.
Trust is Contextual
In the world of digital trust, context is king. But what is context? Our friends at Oxford define context as “the circumstances that form the setting for an event, statement or idea and in terms of which it can be fully understood and assessed”. Think of context as its own mini metaverse, with a singular focus on all the factors that contribute to a specific trust decision.
Similar to direction, context may need to be broken down to a point where it cannot be parsed any further. For example, a parent might not trust a teenager to help with all tasks in a household but may trust her to babysit his four year-old. That trust is predicated on the teenager passing an American Red Cross babysitting course and the parent supervising the babysitting for two two-hours sessions without incident. If we change the context to assistance in fixing the family minivan, alternative evidence is needed to trigger the parent to trust the teenager for that context such as experience and a high-school car maintenance class. Therefore, trust is not triggered for all decisions, each context is taken individually.
Trust Has Limits
As we have seen that context may need to be segmented in order to be properly applied, the degree of trust is neither infinite nor needs to be for a trust decision to be enacted. The question is what are the factors required for a person to make a trust decision within a given context? The secret is within traditional risk analysis using the concepts of risk tolerance, confidence intervals and assessed risk determined from factors of likelihood of occurrence and severity of outcomes.
Risk tolerance is defined as the standard level of risk and uncertainty innate to the risk taker based on experience and biological factors. How much of a “risk taker” are you? How did you establish that stance? Was it through previous risky decisions that went right or wrong? Have you always been willing to take risks that others will not? How attuned are you to learn from others’ risky decisions to make your own? All these factors set a personal risk tolerance level that is imprinted within trust decisions we make in our daily lives. That is why, given the same information and experience, two people could make different trust decisions within a given context. The following diagram illustrates this point.
The trust trigger area is a continuum when a given set of experiences, transactions, and other human perceptions combined with a person’s risk tolerance will cause an individual to take a trust action. The amount of information needed is not infinite. As the amount reaches B, we start experiencing “analysis paralysis” where the need to gather more information outweighs the utility of making a trust decision. At the limit, we don’t act. Where do you place yourself in the trust trigger continuum for trust decisions you’ve made?
Confidence level is the surety of making an appropriate trust decision at the time of its trigger. This level considers the likelihood of it being the wrong decision and the totality of that wrong decision’s effect on the context. Typically, higher consequence trust decisions take more confidence and information to trigger a decision. For example, typically we require deep analysis of budget, locations and features to trigger a home purchase; it takes nanoseconds to trigger an action to cross the street.
As we have seen that there are limits to the amount of information we need to trigger a trust decision, there is a limit to the amount of confidence we have in that decision when we make them. No trust decision delivers absolute assurance so what confidence do we need to trigger trust decisions?
In the audit profession, attestation reports cite that reasonable assurance is applied to auditor opinion letters. That level equates to a 95% confidence level for illustrative purposes. The amount of effort in reviewing and analyzing evidence to assert more confidence is not cost-effective. Relying parties have accepted the 5% risk understanding the costs. This applies to individuals making trust decisions. The confidence level in triggering a trust decision considers, risk likelihood/severity, time, availability of evidence and the person’s risk tolerance. This equates to a reasonable level of assurance perceived by the trustor at the time of making that trust decision.
The final attribute of the limits of trust is the time horizon. Each trust decision typically takes place within a planned time horizon and has a (usually unstated) time window when that trust applies. I may be willing to trust my friend John with my car within the next month; that trust would not extend a lifetime.
Trust Can Be Transitive
In our collective society, trust decisions are not solely based on personal experiences. We typically consider the positions of others in which we have developed a trust relationship. Who are these trusted third parties? There are many but in the revolution of social media applied to the global landscape, the term “influencer” has been coined with both positive and negative connotations. Who influences your trust decisions? We may be more inclined to trust the purchase of a skin product because our favorite celebrity endorses it or accept a SOC 2 auditor’s report because Schellman’s name is on the letterhead. We follow clergy’s opinions on a range of faith topics and take our parent’s advice on a place to eat. In these cases, as in mathematics, we are applying our trust decision using the perception of trust we have about a third party’s trust input.
The factors that cause us to rely on third parties are the same principles discussed in this paper. We create our own trust triggers for third parties based on the same concepts of risk likelihood/severity, time, availability of evidence and the person’s risk tolerance. Using transitive trust is likely to be more efficient and can be more effective than without it depending on the reliability of the trust source on the context we are seeking trust. As in all human experiences, some sources are more trustworthy than others.
Tying the Human Trust Principles Together
Next time you need to make a decision that has notable downstream consequences, think of the following:
- What is the context of the trust decision?
- What could go wrong if the wrong decision is made? How likely is that to happen?
- How much information do I need to make the decision? Where can I find that information?
- What timeframe do I need to make that decision?
- How long do I need to trust?
- Are there third parties I can consult to assist in the decision? How can I trust their input?
- How confident do I need to be when I make that trust decision?
- What prior experience can I draw from to assist in that decision?
Humans process trust transactions like a bank account. When we make commitments, then execute them to another’s satisfaction, we are building trust. We do this unsuccessfully, we erode trust. Therefore, to become more trustworthy, we need to be transparent and confident when we make commitments and work diligently to achieve them. The more collective trust there is in society, the more transitive trust is available to consider.
As we propagate trust decisions to our digital life, human trust principles will apply. It is our collective responsibility to understand these principles and build trustworthy applications considering that humans will remain on the forefront of their own decision-making process.