This is a case where the Nuremberg defence is very useful. If you have explicit policies that are consistently followed, you take away most of the social cost and can even make breaking policy the more difficult choice.

The problems occur in dysfunctional organisations where senior management expect to be exempt from their own rules. Expecting the rules to be bent for your own convenience gives your subordinates tacit permission to bend the rules. Someone who has bent the rules for their boss is far more likely to bend the rules for their buddy. If you're asking people to do inconvenient things, you have to lead by example.

Yes, just look at the example provided by OP. He noticed a security flaw and instead of trying to do something about it he and his companions made a game of exploiting this flaw as much as possible. The employees don't want the inconvenience of actual security.

Manipulating social cost is what you do with social engineering.

If the organization has people that actually care about security they would praise them for practicing good security.

> Manipulating social cost is what you do with social engineering.

definitely one of the more significant parts of the social engineering toolkit.

It should be the same as the General who commended a PFC for challenging him and a manger who acts up in this way should be displined.

If I saw that behavior in a manager who was not in my direct reporting chain I would probably let hr know. but having worked mostly govt contract, pharma, and finance I'm used to rfid badges-- not exactly top security tech-- but it, and photos of employees stored in the system, solve the enployee badge issue.

If you can't swipe to get in you sign in. period.

But the security guard is being paid to challenge you, the social cost is off-set by their wages and you'd have to be an ass to take umbrage at a security guard asking for your pass at the entrance to a secure facility.

My pass used to be checked every day for years, in an office of only 1k people, and a line-manager was the only person who could sign you in without it.

"you'd have to be an ass to take umbrage"

Have you seen our president's twitter account? Some bigwigs like to shit on the little people.

Living in a parliamentary democracy and not being an American citizen, “our President” is literally not my president. Are you referring to the American President, Mr. Donald Trump?

HN needs to become i18n compliant.

Someone saying "our" does not imply that you are part of "we." Our president is not your president.

So if I said "we're getting our carpet cleaned tomorrow," you'd demand to know what I was doing in your house?