Bruce Schneier on Security Tradeoffs

Anonymous Smile writes "Business Week has an interview with Bruce Schneier on his new book 'Beyond Fear.' He talks about the tradeoffs we've made in the name of increased security. (hint: we've done a poor job so far) Bruce furthers his tradition of being accessible by the non-technical crowd."

Comments

I like this statement

[MoonFog]

Q: You have been critical of efforts to better secure the U.S. and the world in the wake of September 11. What do you think are the biggest mistakes we've made in those efforts? A: I think the biggest mistake is that we've made policy decisions while scared. We've passed laws that are expensive, both in terms of money and fundamental liberties, without giving us a corresponding increase in actual security. In other words, we've made bad security tradeoffs.

Hopefully some bright men in the EU parliament will consider the laws passed in the USA before they blindly try to copy them into laws applying in European countries..

Radical theory from Bruce Schneier: Power corrupts

[turkeyphant]

Q: There's a dialogue going on right now about the Patriot Act. You have often stated that you think parts of this act are misguided or not terribly effective. Which parts and why?
A: One of the problems with making security tradeoffs is that there are many overlapping security concerns. The Patriot Act has given the government and police unprecedented powers. Many of these powers are Draconian and fly directly in the face of a free society.

Of course, if you assume that the government and the police are 100% benevolent and good, there's no reason not to give them ultimate power. But history shows, in this country and abroad, both that power corrupts and that even an honest organization invariably includes a dishonest few.

I agree with a lot of what he says, but I wish he would actually answer what the questions ask instead of simply stating the obvious...

Re:Sounds interesting

[Fnkmaster]

Like any process administered and regulated by humans, it is flawed, open to manipulation by the many parties with interests at stake, and imperfect in that it will not always catch the bad guys, and sometimes will inconvenience the good guys.

But we're still better off talking and thinking about it, and consciously making those tradeoffs than just sticking our heads in the sand. These domestic security issues are also so fundamentally visible that they _are_ subject to feedback and criticism by the public - unlike obtuse IRS regulations, the absurdity of, for example, flagging every flyer with a one-way ticket for special security treatment, is eminently visible to every frequent business traveler. And thus there are a lot of us to whine, bitch and complain until something gets done about it.

I'm much more worried about the invisible stuff than the visible stuff (like nail clippers being banned from planes). The invisible stuff is the pressure exerted on ISPs, credit card companies, technology organizations, encryption researchers, etc. to "help combat terrorism" by reducing security, or opening and releasing personal information to the government. Because, doncha know, "hackers" are terrorists. What's a hacker? Well, you know, those "cybercriminals". And "identity thieves". And you never know who might be doing those things. And maybe tax evaders are also helping the terrorists - aren't they avoiding funding our fabulous military? And what about drug users - well, clearly, they are supporting terrorists, I mean, we saw the government make those claims in ads on TV.

That "with us or against us" attitude combined with the power of overreaching legislation like the Patriot Act makes me queasy about who or what comes next behind the scenes - the security we don't see at the airport, or in city hall, or on the streets during a festival or parade, and that does give me cause to worry. I don't have a perfect solution, other than that we, the technologically aware and literate, need to push our causes more, be more politically organized, and make sure that some portion of the citizenry is watching what the government is doing, and that we do a better job of getting that word out to the mass media, and to politicians.

Re:Can't help it...

[drunk_as_in_beer]

Well, I actually find it describes my attitude about things. Yes, I lock my doors and have very tight firewall rules, but this part is important:

"I'd rather accept the slight risk of attack than constantly live in fear."

Re:Sounds interesting

[deek]

• Yet I remember reading on Michael Moore's website about how right after 9/11 he noticed that despite the fact that nail clippers weren't allowed on planes, matches and lighters were because the Tobacco industry had complained to the government that not allowing matches doesn't allow their customers to light up once they get off the plane.

I remember the days when I travelled via plane to Canada and the US, with my swiss army knife in my pocket. Fat chance of that ever happening again, and I can live with that, I suppose. But nail clippers, matches, and lighters? Does any of this strike anyone as paranoid to the point of absurdity?

The ironic thing is that any determined terrorist will find a way to do what they need, without having to resort to any of the banned items. Do you want to threaten someone with a dangerous object? There's many devices other than metal knives that will do the job. Want to set fire to something on a plane? The whole chemical world abounds with ways to ignite things. Want to clip your nails on a plane? Hey, any smart terrorist can find a way to make sure their nails are decently manicured before they hijack the transport they're on.

Let's face it. Security is not provided, in any way, by banning a whole bunch of little items. It is just a panacea for a nervous public, looking for action after some very troubling events. It is there to bolster confidence by providing a false sense of security. Succinctly, it's a PR exercise.

Re:after 9/11

[cowbutt]

Surfing pr0n is not a big deal, and neither are any of the other activities you mentioned.

How confident do you feel about visiting all the mosques in your city to speak with lots of muslim people about their faith? (an activity that's harmless, but may cause you to be added to various agencies' watchlist)

How about participating in non-violent activist groups? (anti-war protestors have been placed on a "no fly list")

How about being critical of your government in a highish-profile way?

All sorts of groups are being classed as "potential threats" these days. You'd be surprised at some of them.

Also, many of the post-911 laws have been passed with no sunset clause. Legislation generally requires significant effort to be removed from the books when it is no longer needed. Whilst we have (arguably, relatively) benign governments, people are unconcerned ("their power will only be used for good!"), but if an extremist government came to power, all the legislational infrastructure is there to establish a repressive state in no time at all.

--