Slashdot Mirror
Bruce Schneier on Security Tradeoffs
Anonymous Smile writes "Business Week has an interview with Bruce Schneier on his new book 'Beyond Fear.' He talks about the tradeoffs we've made in the name of increased security. (hint: we've done a poor job so far) Bruce furthers his tradition of being accessible by the non-technical crowd."
Q: You have been critical of efforts to better secure the U.S. and the world in the wake of September 11. What do you think are the biggest mistakes we've made in those efforts? A: I think the biggest mistake is that we've made policy decisions while scared. We've passed laws that are expensive, both in terms of money and fundamental liberties, without giving us a corresponding increase in actual security. In other words, we've made bad security tradeoffs.
Hopefully some bright men in the EU parliament will consider the laws passed in the USA before they blindly try to copy them into laws applying in European countries..
We've all heard the absurd stories like a woman being forced to drink her breastmilk (in bottles) to prove it wasn't some type of explosive or whatever the hell they thought it could have been.
Yet I remember reading on Michael Moore's website about how right after 9/11 he noticed that despite the fact that nail clippers weren't allowed on planes, matches and lighters were because the Tobacco industry had complained to the government that not allowing matches doesn't allow their customers to light up once they get off the plane.
Later they were put back on the list of prohibited items but it's stuff like that which makes the whole security thing seem totally absurd sometimes.
Kick in the Head
- designed the popular Blowfish encryption algorithm
- his Twofish was a finalist for the new Federal Advanced Encryption Standard (AES))
(I heard him talk about a year and a half ago)Where I think the problem in post 911 security is awareness, and this is a people problem. Bruce is right, people that are more aware of their surroundings can easily notice things out of place. Instead what do we get from Wahsington, fear mongering and freedom stifling laws and legislation. The 911 attacks more than likely could not be easily duplicated since (at least in theory) we are aware of how they did it and (hopefully) in a better position to stop it. The bigger question is what are they planning to do in the future? And putting the entire population of the U.S. in under almost continuous surveillance is not the answer. It is not unlike other intelligence efforts, who is going to analyze all of that data? It wasn't all tha tlong ago that the director of the NSA stated his staff couldn't process all of the information they were gathering. Hopefully Bruce's book points out some simple steps that will actually improve security without "breaking the bank", be more effective than most of the current measures, and that some people in Washington actually read it!
It has been a long time since I have ever seen someone who has the ability to comunicate tech ideas to those who are "non-tech." Unlike most security experts Bruce Schneier seems to use the "uncommon" common sense approach. In the interview Bruce states "There's so much stupid security out there -- in airports, in office buildings, in the government. I wanted to give people the ability to see why some things are stupid and -- to the extent possible -- how to fix them. There are many dangers in the world, both real and perceived, and it's my hope that the book gives people a realistic sense of how to deal with risks and threats." If the US would adopt this man's ideas I would not be astounded by how much money the government would save and how much more secure we would all be.
Turkeyphant
Security will never be a solved problem, because people are involved. No matter how secure a system is from a technical standpoint, people can ALWAYS circumvent it. It is a mathematical fact. But we can improve immensely, and that is the point of Bruce's book.
Would somebody google his address and get back to me? I'm in the market for a new television and stereo!
quiquid id est, timeo puellas et oscula dantes.
really, the post 9-11 security craze is nothing more than a jobs program for the security industry. sure, the security here still sucks, it sucked before too. we're a (sometimes and mainly in theory) free society, but mostly an open society. we do make social exclusions, but really, we accept anyone as a neighbor (tho neighbor in another city if we don't like you, thanks, and don't forget to mow the lawn on the way out). we play security like its a game. we dodge our own security just to prove it can be done.
face it, security is an illusion. i'm more likely to die crossing the street (especially in my hood) than from a terrorist attack.
"You never want a serious crisis to go to waste." - Rahm Emanuel
I used to work for a guy who had a saying on this subject: "Locks are to keep your friends out." That is to say, security measures impose barriers to unauthorized access, but these barriers are only so high -- if you have enemies willing to break down your door, locking it will not help you; if you don't, what function does locking serve?
Well, one function of a lock, or a password, is its social effect: it says, loud and clear, "Keep out -- this place is only for those who have the key." Most people want to think of themselves as nice and respectful people. Most people aren't crackers or thieves, and will respect a security measure simply because someone went to the bother of putting it there. Against these people, you set a password on your account simply so they will realize it is not a public resource. You lock your machine room door so they won't wander in randomly in search of a terminal to check their email.
Securing things against concerted attackers is different from securing them from wandering friends. You rarely need to enact security measures that will keep a concerted attacker out forever -- only ones that will keep him out long enough for you to notice his assault and cuff him. Bank safes are rated in minutes: rather than proclaiming a safe "uncrackable", the rating states how long a certain level of attacker will take, to crack the safe. So as long as the bank has their security guard come by more often than that, it doesn't matter that the safe isn't perfectly uncrackable.
Bruce states that the only two measures to do any help is the reinforcement of the cockpit doors and the teaching of passengers to fight back. Citizens of the US for the most part do not want to be bothered with their own security. It is the same with handguns. I own one and believe I have every right to do so. Citezens need to stand up for themselves and be be prepared to defend themselves and those close to them. The government and police cannot be everywhere all the time, not that would be good either. When you are in your home or a plane it will take some time for the protection services to show up. There is a window of 2 minutes to 2 hours where each person may be called upon to defend themselves.
it's truly a matter of providing a deterrent... "target-hardening" as we used to call it in the military. Make a task too difficult, and the perp will move on to easier pickings, it's human nature.
Many home burglaries are done by youths, or people looking for easily-fencable goods (typically to support a drug habit of some kind)... few are done by pros. Some burglars will simply go around a neighborhood, trying doors until they find one that's unlocked. A simple deadbolt would go a long way toward deterring this kind of casual thief.
The professional is a VERY different animal, whether he's a car thief, or a home burglar. The determined car thief will bring along wheel dollies and a panel truck/trailer if he really wants your car... he might even line that trailer with metal screen if he's out to defeat your LoJack transmitter. Bottom line: it's very difficult to guard against a calculating, intelligent, and determined thief.
That said, simple measures will go a long way... to not even take simple measures to secure your home might even open you up to legal liability. If you have a pool, you must provide a secured enclosure or gate, lest a neighborhood kid drown (and you would be sued, likely successfully, for not having taken such a "reasonable" measure). If you own guns, it might be argued that you had the obligation to lock your doors... I certainly wouldn't want to be sued because a gun I owned wound up on the floor of a neighborhood Stop-N-Rob, next to a dead clerk, simply because some crystal-meth user was able to simply wander into my home and steal said gun... I can think of more than a few plaintiffs' attorneys that might argue that angle in a wrongful death suit.
Even if a man chops off your hand with a sword, you still have two nice, sharp bones to stick in his eyes.
Well, I actually find it describes my attitude about things. Yes, I lock my doors and have very tight firewall rules, but this part is important:
"I'd rather accept the slight risk of attack than constantly live in fear."
--Drunk as in Beer
A colleague of mine who works for Kryptonite says in response to every smart ass (who has the great lock breaking solution) is that, with security, money is only buying you "time and noise". In other words, any detirmined thief will get in. The price we pay is to delay him and make it noisy to get in.
a lot of the "security" we've put in place post-911 is truly window-dressing.
I agree with you 100%. This response isn't arguing with your post, but your post did remind me of some thoughts i've had on this matter. The vast majority of the expenditures post 9/11 have been made to make people feel safer, rather then to actually increase their mathematical likelyhood of being safe.
In a sense, though, making sure the passengers feel safe is far more important than actually making them safe. I'm not trying to trivialize airline accidents, but we all know that hopping in a car is far more dangerous than hopping in a jet plane. The FAA doesn't have such strict regulations to bring down the number of crashes every year from 4 to 3. Those kind of numbers don't mean anything to the average person. Humans have a fundamental misunderstanding of the statistics involved, and no one would fly if they perceived the industry to be unsafe. I consider myself a rational person, and I know all the statistics, but I still feel less safe in a plane than I do in a car. No amount of improving the 'actual' security will change that. If you've ever taken a decisions sciences course, you'll know that even the brightest people in the workforce don't make perfectly rational decisions, but rather base them on stupid little things like the order that information is presented in.
What will change everyone's fear of flying is "window dressing," and, yes, I'm willing to pay the 9/11 security tax (or whatever it's called) to fool myself into thinking that there's probably not a terrorist on the plane. The government's role isn't just to operate in a vacuum and take actions that improve safety. The US government also has an obligation to maintain confidence in the airline industry. If having armed guards standing around the airport makes people more likely to fly, then it makes sense to have armed guards, regardless of their statistical effect on safety. And yes, I'm aware that all in all those armed guards are a waste of money. But, you have to make decisions within the constraints of your environment, and I truly believe that no amount of statistical understanding will change the way that the average American or non-American makes the decision to fly or drive.
Spending money to change perceptions is sometimes a rational tradeoff. However, reducing freedoms in order to increase perceptions of safety is simply not a reasonable tradeoff.
How confident do you feel about visiting all the mosques in your city to speak with lots of muslim people about their faith? (an activity that's harmless, but may cause you to be added to various agencies' watchlist)
How about participating in non-violent activist groups? (anti-war protestors have been placed on a "no fly list")
How about being critical of your government in a highish-profile way?
All sorts of groups are being classed as "potential threats" these days. You'd be surprised at some of them.
Also, many of the post-911 laws have been passed with no sunset clause. Legislation generally requires significant effort to be removed from the books when it is no longer needed. Whilst we have (arguably, relatively) benign governments, people are unconcerned ("their power will only be used for good!"), but if an extremist government came to power, all the legislational infrastructure is there to establish a repressive state in no time at all.
--
They've completely lost sight of the fact that the FBI, CIA, etc. have been well known (internationally as well as locally) for their less-than-ethical ways of doing "business".
You know, the "power corrupts" comment is fairly common, but I think the issue is more complicated. Power certainly does corrupt a lot of people, but I don't think organizations like the FBI or CIA seek legislation like the Patriot Act because they are power hungry. They do it to make their job easier. Youth curfews, for example, are usually supported/sought by local police departments because it is easier for them if they can just tell a group of kids to go home. Some groups of kids will get into trouble if left unsupervised, but catching them in the act is tricky. So rather than try to catch individual acts of vandalism (or whatever), they would prefer to just keep all juveniles off the street.
Now, the argument should be whether we should allow them to make their jobs easier, and you have to address this issue on a case by case basis. I think most people would agree that not allowing weapons on board aircraft is a reasonable measure. However, I think most would agree that overarching legislation like the Patriot Act is certainly not reasonable. Both make the jobs of the enforcing agencies easier. But one is simply a deterrant, and the other allows for circumvention of judicial controls, like due process.
The problem is, a lot of enforcement agencies see due process as a hurdle they have to cross to catch criminals. Criminals can get away because you don't have a search warrant, or you don't have a wiretap warrant, or the evidence isn't sufficient.... In other words, you can't just look at somebody and say "I think he might be up to something" and throw him in jail. I think it is important for law enforcement agencies (and legislators) to realize that due process is important because, yes, people do make mistakes, and suspicious looking activity can be legitimate. So as for my original point, no I don't think this is just about a power struggle.