Slashdot Mirror
Bruce Schneier on Security Tradeoffs
Anonymous Smile writes "Business Week has an interview with Bruce Schneier on his new book 'Beyond Fear.' He talks about the tradeoffs we've made in the name of increased security. (hint: we've done a poor job so far) Bruce furthers his tradition of being accessible by the non-technical crowd."
Q: You have been critical of efforts to better secure the U.S. and the world in the wake of September 11. What do you think are the biggest mistakes we've made in those efforts? A: I think the biggest mistake is that we've made policy decisions while scared. We've passed laws that are expensive, both in terms of money and fundamental liberties, without giving us a corresponding increase in actual security. In other words, we've made bad security tradeoffs.
Hopefully some bright men in the EU parliament will consider the laws passed in the USA before they blindly try to copy them into laws applying in European countries..
Turkeyphant
Security will never be a solved problem, because people are involved. No matter how secure a system is from a technical standpoint, people can ALWAYS circumvent it. It is a mathematical fact. But we can improve immensely, and that is the point of Bruce's book.
Well, how would he know the risk of burglary?
He said:
I guess - putting words in his mouth - he would say his estimate of the burglary risk falls into this innate sense. He has a rough idea how often burglaries occur, he knows how accessible his back door is, and so on. It is in the case of exceptional or unfamiliar risks that people are not able to use their innate sense and are more likely to make or accept very bad decisions.St. Cloud Times 26 June 2002: 5B.
At first blush the new FBI guidelines appear harmless and reasonable. When Attorney General John Ashcroft announced on May 29 that agents would be allowed to surf the internet, use commercial databases, visit any public place, or attend any public event, my reaction was disbelief that previous guidelines prohibited such commonplace activities.
As Ashcroft noted, "even a 12-year old" can surf the web, just as any citizen can frequent public events and public places or employ databases to gather information. The FBI should have the same rights to gather information as everyone else. And the need to gather that information is greater in this time of increased threat. As President Bush indicated, "The FBI needed to change. The organization didn't meet the times."
But the first blush doesn't always coincide with the final conclusion. We might decide that the new guidelines are justified and necessary. Before we do that, however, we should examine the premises that undergird this policy change, and we should consider what the new policies imply with regard to our security and our privacy.
The new guidelines are based on two premises. The first is that we have entered a more dangerous era that justifies new investigative procedures. But have we? The threat of future terrorist attacks on U.S. soil is no greater now than it was before September 11. Perhaps, given increased security and awareness, it is less. So one objection is that neither the domestic nor foreign situations have changed enough to justify revisions in FBI policies.
The second premise is that the same standards of information collection should govern FBI agents and ordinary citizens. But significant differences exist between agents and non-agents, so that when an ordinary citizen surfs the web or attends a political meeting it is a fundamentally different activity than when an FBI agent surfs the web or attends a political meeting. The agent is in position to collect data into a file, to build a case, to set the stage for an arrest, and thus to intimidate. The history of the FBI certainly makes this fear credible.
Still it seems reasonable to allow FBI agents access to means of observation that are available to other residents of the United States. Recent polls indicate that the public is willing to concede more investigative powers to the FBI, so my hunch is that most citizens will accept the two premises I have presented here.
But even if the new guidelines are justifiable, they are still unnecessary, because the FBI may already engage in these activities. The only requirement is that they establish suspicion of criminal activity. The requirement is not stringent. Indeed, the old guidelines allow preliminary inquiries of 90 days during which the FBI can conduct web searches, engage in surveillance, utilize data collection services, and employ other investigative techniques even without indication of criminal activity. The new guidelines allow the FBI to engage in these activities for a year even if the investigation reveals no criminal activity. In sum, the FBI can now use these procedures not simply to investigate suspicions of criminal conduct, but to generate the suspicion in the first place.
So what does this mean? The FBI can document what you say in internet chatrooms or in religious and political meetings. They can ascertain what magazines you subscribe to or what books you buy. They can access your credit profile, your telephone records (made many international calls lately?), and your travel itineraries. And they can do this without any evidence of a crime or a potential crime. None of these changes in domestic policies increases their abilities to monitor international terrorist organizations. The FBI already has wide latitude to conduct foreign investigations without evidence of criminal activity. The new guidelines apply only to domestic surveillance.
MoFscker
Bruce states that the only two measures to do any help is the reinforcement of the cockpit doors and the teaching of passengers to fight back. Citizens of the US for the most part do not want to be bothered with their own security. It is the same with handguns. I own one and believe I have every right to do so. Citezens need to stand up for themselves and be be prepared to defend themselves and those close to them. The government and police cannot be everywhere all the time, not that would be good either. When you are in your home or a plane it will take some time for the protection services to show up. There is a window of 2 minutes to 2 hours where each person may be called upon to defend themselves.
But we're still better off talking and thinking about it, and consciously making those tradeoffs than just sticking our heads in the sand. These domestic security issues are also so fundamentally visible that they _are_ subject to feedback and criticism by the public - unlike obtuse IRS regulations, the absurdity of, for example, flagging every flyer with a one-way ticket for special security treatment, is eminently visible to every frequent business traveler. And thus there are a lot of us to whine, bitch and complain until something gets done about it.
I'm much more worried about the invisible stuff than the visible stuff (like nail clippers being banned from planes). The invisible stuff is the pressure exerted on ISPs, credit card companies, technology organizations, encryption researchers, etc. to "help combat terrorism" by reducing security, or opening and releasing personal information to the government. Because, doncha know, "hackers" are terrorists. What's a hacker? Well, you know, those "cybercriminals". And "identity thieves". And you never know who might be doing those things. And maybe tax evaders are also helping the terrorists - aren't they avoiding funding our fabulous military? And what about drug users - well, clearly, they are supporting terrorists, I mean, we saw the government make those claims in ads on TV.
That "with us or against us" attitude combined with the power of overreaching legislation like the Patriot Act makes me queasy about who or what comes next behind the scenes - the security we don't see at the airport, or in city hall, or on the streets during a festival or parade, and that does give me cause to worry. I don't have a perfect solution, other than that we, the technologically aware and literate, need to push our causes more, be more politically organized, and make sure that some portion of the citizenry is watching what the government is doing, and that we do a better job of getting that word out to the mass media, and to politicians.
Well, I actually find it describes my attitude about things. Yes, I lock my doors and have very tight firewall rules, but this part is important:
"I'd rather accept the slight risk of attack than constantly live in fear."
--Drunk as in Beer
I remember the days when I travelled via plane to Canada and the US, with my swiss army knife in my pocket. Fat chance of that ever happening again, and I can live with that, I suppose. But nail clippers, matches, and lighters? Does any of this strike anyone as paranoid to the point of absurdity?
The ironic thing is that any determined terrorist will find a way to do what they need, without having to resort to any of the banned items. Do you want to threaten someone with a dangerous object? There's many devices other than metal knives that will do the job. Want to set fire to something on a plane? The whole chemical world abounds with ways to ignite things. Want to clip your nails on a plane? Hey, any smart terrorist can find a way to make sure their nails are decently manicured before they hijack the transport they're on.
Let's face it. Security is not provided, in any way, by banning a whole bunch of little items. It is just a panacea for a nervous public, looking for action after some very troubling events. It is there to bolster confidence by providing a false sense of security. Succinctly, it's a PR exercise.
True, but so is the stock market, and the economy as a whole.
As The Onion so scatalogically pseudo-quoted a leading Democratic Presidential candidate:
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
A colleague of mine who works for Kryptonite says in response to every smart ass (who has the great lock breaking solution) is that, with security, money is only buying you "time and noise". In other words, any detirmined thief will get in. The price we pay is to delay him and make it noisy to get in.
I read a lot of criticism about the security measures and laws that were enacted after 9/11 and although I do agree that many of the laws give the government too much power and some are just idiotic, it has not affected my life at all. I still can surf the web, including pr0n, send email, drive to work, buy groceries, ride the subway, go to the US Open...etc. More importantly there has not been another terrorist attack on our soil. Is this the new laws and surveilence working or just chance? I honestly don't know, but I have a feeling the laws we so often rip on are the same ones helping to protect innocent lives right now. Could they be better? Certainly, and I think they will get better.
We rip on the "knee-jerk" reaction, but that is how it works...it is a reflex. If you don't have reflexes, something is wrong. This is the first time something like this happened here, no one knew how to handle it, we are learning.
On the other hand, we need to keep bitching when these laws go too far. This is how people who will chance things get elected. They listen to the people and their gripes and get the votes. In essence we are watching the process that makes the US a great place. The government goes too far, the people speak out, the government backs off. So keep speaking out.
You know, it's interesting to take those comments in a computer-security context. Compromised machines are often used to send spam, conduct DDoS attacks, and otherwise wreak havok on the Internet -- many of them compromised by script kiddies, the "crystal-meth users" of the Internet. It seems odd then that while the average gun owner knows to take at least basic security precautions with his/her weapon, the average computer owner isn't even aware that a broadband internet connection can be used as a weapon.
How can user awareness be raised? Hell if I know. But it needs to be done: right now the Internet is like a row of houses where 90% have a loaded AK-47 lying on the front doorstep.
It gives the burglar a reason to break a window. That's probably not the purpose that was intended. A pretty decent example, really.
They've completely lost sight of the fact that the FBI, CIA, etc. have been well known (internationally as well as locally) for their less-than-ethical ways of doing "business".
You know, the "power corrupts" comment is fairly common, but I think the issue is more complicated. Power certainly does corrupt a lot of people, but I don't think organizations like the FBI or CIA seek legislation like the Patriot Act because they are power hungry. They do it to make their job easier. Youth curfews, for example, are usually supported/sought by local police departments because it is easier for them if they can just tell a group of kids to go home. Some groups of kids will get into trouble if left unsupervised, but catching them in the act is tricky. So rather than try to catch individual acts of vandalism (or whatever), they would prefer to just keep all juveniles off the street.
Now, the argument should be whether we should allow them to make their jobs easier, and you have to address this issue on a case by case basis. I think most people would agree that not allowing weapons on board aircraft is a reasonable measure. However, I think most would agree that overarching legislation like the Patriot Act is certainly not reasonable. Both make the jobs of the enforcing agencies easier. But one is simply a deterrant, and the other allows for circumvention of judicial controls, like due process.
The problem is, a lot of enforcement agencies see due process as a hurdle they have to cross to catch criminals. Criminals can get away because you don't have a search warrant, or you don't have a wiretap warrant, or the evidence isn't sufficient.... In other words, you can't just look at somebody and say "I think he might be up to something" and throw him in jail. I think it is important for law enforcement agencies (and legislators) to realize that due process is important because, yes, people do make mistakes, and suspicious looking activity can be legitimate. So as for my original point, no I don't think this is just about a power struggle.