Determinative

Security is never free, but policy determines who pays for it.
Bruce Schneier, "US Bans All Foreign-Made Consumer Routers," Schneier on Security. Thursday, 2 April, 2026

This is one of those statements that takes what would otherwise be a lot of verbiage, and boils it down into something both succinct and informative. The bigger picture, of course, is that Mr. Schneier's statement is true of everything. Safety, health, education, sidewalks, love... all of them can be slotted into that sentence, and it would still be true. One might even update the old canard of "Freedom is never free" with those last seven words to get something more worth talking about.

And "policy" covers a lot of ground. Sure law and regulation, but social norms and unspoken mores also count as policy, even if they are less stable; enforcement can be even more sure.

American society implements policy that does a lot of shifting of who pays for things. Sometimes, out of an apparent concern for the general welfare, but other times out of an apparent desire to hide the ball, and the true costs of things from those who eventually foot the bill. In the end, it's the lack of transparency of the system that causes the problems. Even without an intent to obscure things, the general opacity of the system means that the general public winds up supporting policies for which it will directly shoulder the costs, even when the intent is to have those costs borne elsewhere. And when anger boils over, and there is a hunt for the sources of people's misery, the search tends to focus in the wrong places.

It would be nice to be able to say that keeping Mr. Schneier's words in mind would help with understanding where the buck ultimately stops (or whose pockets it comes from), but the world is never that simple. Still, I'm pleased to have come across so articulate a distillation of the concept; I think that keeping it in my back pocket will help.