# Identify fallacy and opposing argument - Insiders are biggest security threat, therefore insiders can't be trusted

I'm having practical difficulty in getting work done due to the fact that one contractor is constantly arguing against work being done to allow users the access they need to do their jobs efficiently. The argument is a computer security argument that as most security breaches are committed (intentionally or unintentionally) by inside employees, it should be concluded that trust cannot be given to employees. I'm thinking that this is some form of causation fallacy, the facts being that the majority of the breaches being counted could only be caused by employees, so the correlation between breaches and employee responsibility is normal. It shouldn't mean however that employees can't be trusted. Am I completely wrong? or is there a good way to counter such arguments? I'd abstract the argument to 'Most of bad thing is caused by X therefore X is bad' When the truth is that 'Most of bad can only be caused by X'.

Just to get the discussion going, I offer my response. The situation is that you think your contractor commits a fallacy when she asserts, "[Since] most security breaches are committed (intentionally or unintentionally) by inside employees, it should be concluded that trust cannot be given to employees." You offer some reasons. I follow your reasoning to determine what the name of the fallacy might be.

Initially you suggest that the argument commits some causal fallacy. Post Hoc, Ergo Propter Hoc ( After This, Therefore Because of This) is the name for a causal fallacy. The fallacy is committed when a person confuses a sequential relationship (or correlation) for a causal relationship. But I do not see her argument makes any causal claim. So not is Post Hoc, Ergo Propter Hoc.

Your second idea is that security breaches are irrelevant to trustworthiness, as you separate a bad action by a person from the character of the person. In this case, her argument can be viewed as committing Non Sequitur (not follow), which occurs when the conclusion is supported by irrelevant premises. So you can argue that one may not conclude untrustworthiness from security breaches.

My problem with identifying the argument with Non Sequitur, however, is that security breaches do seem to be relevant to trustworthiness. The contractor should have meant trust differently from yours. While you interpret trust as a value-laden concept (good or bad), the contractor should have meant trust with reliability, a value-neutral concept. There is no absurdity in saying that we cannot rely on those who are prone to security breach.

One suggestion is to argue for the fallacy of division.The fallacy of division occurs when one infers mistakenly that since A is a part of B, and since B has the property X, A must have X. For instance, since the roof is the part of house, and since the house is painted white, one mistakenly infers that the roof must be painted white. The common sense however is that when we say white house, we mean only the exterior walls of the house.

Applying the fallacy, you can argue that the contractor is mistaken to think that, since the majority security breaches happen by the employees, it will also happen by your employees. You can rebut that your employees do not share the property (breaching security) since they are qualitatively different (e.g., they met the govt security clearance). But if your employees are representative of the pool of all employees, then the contractor’s claim is not fallacious.

Depending on the situation and interpretation, the contractor’s argument might not be committing a fallacy at all. The disagreements between you and you contract can be just the reflection of two competing goals in doing business: security and efficiency.

• Thank you, I think you may have led me to the correct answer to the question. Not a fallacy of division, but a fallacy of composition. I'll explain. 1. presented and accepted as fact: Most security breaches are ultimately committed by employees. 2. True conclusion is that a percentage of employees can't be trusted - this needs quantification. 3. the false conclusion is that if some employees are untrustworthy then all employees are untrustworthy. How does that sound? Is there a simple counter arguments that lays bare such a false conclusion? – charmer Jun 30 '17 at 11:29
• Good counter. I thought about the composition fallacy, but I thought the conclusion was about your employees. Maybe I did not catch the subtly in your presentation. – Nanhee Byrnes PhD Jun 30 '17 at 13:53
• I think the conclusion was about all (global set) of employees so including all company employees. I did have one other possible fallacy of affirming the consequent. i.e. all A is B. B therefore A. What do you think? – charmer Jun 30 '17 at 14:34