Slashdot Mirror
What Examples of Security Theater Have You Encountered?
swillden writes "Everyone who pays any attention at all to security, both computer security and 'meatspace' security, has heard the phrase Security Theater. For years I've paid close attention to security setups that I come in contact with, and tried to evaluate their real effectiveness vs their theatrical aspects. In the process I've found many examples of pure theater, but even more cases where the security was really a cover for another motive." swillden would like to know what you've encountered along these lines; read on for the rest of his question below.
swillden continues: "Recently, a neighbor uncovered a good example. He and his wife attended a local semi-pro baseball game where security guards were checking all bags for weapons. Since his wife carries a small pistol in her purse, they were concerned that there would be a problem. They decided to try anyway, and see if her concealed weapon permit satisfied the policy. The guard looked at her gun, said nothing and passed them in, then stopped the man behind them because he had beer and snacks in his bag. Park rules prohibit outside food. It's clear what the 'security' check was really about: improving park food vending revenues.
So, what examples of pure security theater have you noticed? Even more interesting, what examples of security-as-excuse have you seen?"
So, what examples of pure security theater have you noticed? Even more interesting, what examples of security-as-excuse have you seen?"
Airports... Need I say more?
No trolling intended, but the war in Iraq now is the biggest piece of security theater on the planet. It does not make the US safer ( indeed it probably does the reverse ) but it does give certain people benefits. Chaney and friends make millions on no-bid contracts, and neocons get to implement policies that in more normal conditions would not be tolerated by the public.
If public CA's are supposed to be trusted authorities of identity on the Internet, why do we have to have "extended validation" of an entity before they get a certificate? If we can't trust the CA to validate entities before issuing certificates in the first place, how can we trust them to issue Extended Validation Certificates in the second?
Oh, I forgot, they are in collusion with Microsoft and other CA's to inflate the cost of digital certificates they already issue.
In 2001 I was living in an apartment complex in a North Dallas suburb. If you got a package that wouldn't fit in those teeny-tiny mailboxes then the mail man would drop off the package at the apartment complex office and you could pick it up in normal office hours.
After September 11th, the apartment management sent out a memo to all residents that because of the heightened state of terrorism awareness the office would no longer allow packages to be held there for the residents.
Of course my first thought was they were just tired of dealing with the packages and saw this as a convenient excuse to stop holding packages for people.
No todo lo que es oro brilla
Every time I'm held up by the "No Fly List" because I have an insanely common name, I feel like a victim of security theater. How many would be terrorists have been caught by the no fly list?
In my opinion almost all forms of random searches are security theater.
People putting loaded handguns in their homes in the case of a wood-be assailant or robber breaking in. This is not only security theater, it increases the risk you are putting yourself and your family in. Not to mention that in most instances of murder the victim knew the assailant. You're more likely to die of suicide than a robber killing you.
I don't know if these are examples where the security theater is a cover for another reason--unlikely. But there's clearly examples where it just makes your life worse more often than better.
My work here is dung.
I cannot verify this story, anyone else?
Back in ArpaNet days, MIT had machines running an OS called ITS. It was a friendly and happy world and there were user accounts but no passwords. But networking means that strangers can connect and so Arpa insisted that passwords be added. So the ITS developers added a password prompt that ignored the password, and this made the Arpa people happy for a while until they figured it out and made them actually check the password.
In a similar vein, Microsoft file server passwords were originally checked only on the client, a fact which went undiscovered until Samba came along.
The article fails to talk about security as a deterrent.
The RFID bracelets on an infant can give comfort to the parents but its more of a deterrent then anything. Sure the hospital can tell the parents that their child is protected. But the hospital is not protecting the child as much as its protecting itself. For example:
A guard that is in the bank is not there to stop a bank from being robbed. He deters people from committing the crime itself. In a robbery situation the guard himself is useless because the individual or individuals robbing a bank would take him out first. But in most bank robberies, the criminals are going to go after a bank without a guard anyway.
A mall guard doesn't stop people from stealing, he creates the presence of being watched, therefor deterring people from stealing.
Same goes with cameras in stores. Most of the time no one is monitoring the cameras and if anything their used to watch employees over customers. But their deterring employees from doing anything unethical or illegal and they deter people from stealing.
In my opinion the idea of security theater and feeling safe is crap. You might as well spend the time and effort to know your safe then make it seem like you feel like your safe.
...but what the hell is up with these users starting their replies with something like: "I'll probably get modded down for trolling, but..." Are you saying you know your answer will not be appreciated, but you're just the kind of crazy, out-there, don't-give-a-damn, cool guy that says it anyway? Just say what you have to say and stand by it. Stop showing off your insecurity, and/or lack of knowledge on the subject.
What's left to say? It's pretty clear that drugs are more dangerous when they're only available in the unregulated black market than in a regulated legal market. Criminalizing the use of drugs only hurts drug users more, yet it's done in the name of safety.
What's worst is that we've been fighting this war for decades, no end is in sight, we've spent more money and lost more freedoms fighting it than we have in Iraq. And still, no one in power has the balls to speak out against this.
We live in a sick, sad world. People who would meet the non-violent act of drug use with the violent acts of arrest and imprisonment are themselves violent criminals. Yet in this society they are deemed good citizens.
Give me Classic Slashdot or give me death!
rj
But if I were making a joke about the "cup holder" that comes out of the "hard drive", then it would be funny.
:-)
And would lose all its funny if someone decided to point out that it's not a "hard drive" but in fact has some other arcane name, which really doesn't matter in the context of the joke.
We created a delete function, and kept getting reports that the customer accidentally deleted records. (And we had no undelete function.) So we added a "Are you sure?" dialog.
The incidents of accidental deletion did not go down.
So we added text "This cannot be undone. Continue?" and still the incidents did not go down (People just randomly click OK.)
Finally we changed it to "Please key in 'irreversible' to continue with the deletion." This solved the problem.
It also helps politicians pander to ignorant members of the right.
"Not an actor, but he plays one on TV."
The consulting algorithm:
1) Find out what they want. (They will ask for bells and whistles and not tell you core process basics.)
2) Figure out what they actually need. (Research their actual process and design improvements.)
3) Try to convince them to want what they actually need and change the spec go with that.
4) After step 3), give them what they now want, whether it's what they need or not. (Provided it's legal and ethical.)
And of course:
5) Profit!
They are the bosses / customers. They decide what to spend money on. You are the hireling. You agree to do what they want in trade for the fee they pay. After step 3) your moral and ethical obligations are discharged - and if your suggestions are good you've proved your worth. If they're smart they go with what you suggested - or know something about their business that you didn't and reject your suggestion on that basis. But if they decide to do something you think is stupid once they've been informed, it's their business, so it's their call.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Security systems that will let you in with nothing more than a fingerprint scan. Gee, what's more difficult: guessing the correct password within 3 attampts, or lifting a fingerprint and making a gelatin mold? (hint: see Mythbusters to see how difficult it isn't to create a gelatin mold)
Of course there are the obvious TSA stories, but I think the more common stuff may actually be worse.
Working as a contractor for a giant Electronics retailer that shall remain nameless, I saw a memo regarding their policy of searching people's bags as they left, and sometimes entered, the stores.
The public reason given for searching those who left the store was, of course, loss of merchandise. The public reason given for searching those entering was safety...
However the REAL reason for both of these, was to (paraphrasing from memory) 'Establish [company name] as the authority figure in the sales transaction and subsequent customer service encounters...'
Yikes! 'We're in charge here, we've got big scary minimum-wage thugs, You'd better Buy as we say!'
Now if that's not 'Security Theatre' at it's worst, I don't know what is....
=R
Why the hell would you have a button that actually says "OK" on it? That's poor design, because you should know that people always click OK. A better design would be to have buttons that say "Delete" and "Cancel", with the Cancel button selected by default. Typing the phrase was a good alternate solution to eventually arrive at, though.
I've read a lot of replies that said that TSA security checks were theatre, and they're right, but nobody has mentioned the requirement to present identification. To me, this is the most glaring bit of airline security theatre, because it has almost no security value at all, but a huge ulterior motive for the airlines.
All computers scattered all over a county are hand configured; there is no DHCP. Reason given: security.
All computers are required to have only Internet Explorer 6. Reason given: security.
All computers have their CD-Rom drive disabled. Reason given: security.
All computers allow USB flash drives. Reason given: security.
If the no-fly list weren't a joke (and sadly, it is) then I would hope that people dressed like pilots get more scrutiny than other people. People dressed in a uniform are often given no scrutiny in places where plainclothes would get questions. If people dressed as pilots can get through security without any fuss, then you can rest assured that someone who wants to do harm will dress as a pilot.
Thank you. There seem to be so many people who have bought the propaganda to the point that they no longer understand what some words mean, or perhaps they never knew so the definitions have been defined by propaganda.
Insurgents rebel against legal authority, they are individuals within a group that rebel against the group. People from one country who attack another are generally invaders, aggressors or terrorists depending on the scale, government involvement and nature of the attacks.
The US has not experienced an insurgency in Iraq. The Iraqi government has, but that government is of dubious standing in Iraq given that it has been installed by an illegal invader. Hypothetically reverse the conflict and ask yourself if someone invaded the US and installed the government they wanted, would you fight against it or simply accept it? If you would answer the former, you could well be labelled a "terrorist insurgent", or "resistance fighter" depending on the political standpoint of the labeler.
Not many monitors or practitioners of international law consider the invasion of Iraq legal, close to zero. There was no UN mandate to support it, there were mandates supporting the use of force but they were irrelevant to the situation at the time. The only people who argue that it was legal are American neo-cons, hardly known for their understanding or respect of international law, their cronies and idiots who buy the propaganda.
Please re-read the dictionary because while the definition of terrorist has changed recently, the definition of insurgent has not yet been corrupted in the good book.
I don't therefore I'm not.
I was flying internationally (Wellington to Sydney) recently. The security guards stopped me after x-raying my bag --- turned out that I had some roll-on deoderant in there that I had forgotten about. Oops.
So I apologise and hand it over. The security officer places the deoderant in a plastic bag, hands it back to me, and sends me on my way.
Clearly the bag was made of some kind of special anti-explosive plastic...
Repton.
They say that only an experienced wizard can do the tengu shuffle.
Doesn't work in Europe. Every thief knows how to drive sticks. Actually, you'd probably be better off with an automatic, everyone will shy away from stealing those. They're expensive, and only rich (and powerful) people spend money on something as frivolous as not having to shift gears.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Europe really is different. Almost everybody drives a manual rather than an automatic. The car hire people tell me the only reason they have automatics is so they can rent out to foreign visitors, British customers will go to a different hire car firm if a manual shift isn't available.
Only two things are infinite, the universe and human stupidity, and I'm not sure about the former. (Einstein)
Yeah, but the US has higher rates of death by people killed by knives than most other countries. We have higher rates of assault (often with cars) than other countries. We are unfortunately, a pretty violent country, with or without guns.
If you look at the situation holistically, it's not clear that guns are a primary cause of the violence. Gun ownership rates are highest in the rural areas, while gun violence rates are highest in the urban areas. This book, has some very interesting, and fairly rigorous statistical analysis.
Many students of the situation note that the gun violence didn't rise in the US, until the war on drugs ramped up. A large amount of gun violence is directly related to drug commerce.
I was taught to respect my elders. The trouble is, it's getting harder and harder to find some.