Schneier on Security

brothke writes "There is a perception in both the private and government sector, that security, both physical and digital, is something you can buy. Witness the mammoth growth of airport security products following 9/11, and the sheer number of vendors at security conferences. With that, government officials and corporate executives often think you can simply buy products and magically get instant security by flipping on the switch. The reality is that security is not something you can buy; it is something you must get." Keep reading for the rest of Ben's review. Schneier on Security author Bruce Schneier pages 336 publisher Wiley rating 10 reviewer Ben Rothke ISBN 978-0470395356 summary The best articles from one of security's best Perhaps no one in the world gets security like author Bruce Schneier does. Schneier is a person who I am proud to have as a colleague [Schneier and I are both employed by the same parent company, but work in different divisions, in different parts of the country]. Schneier on Security is a collection of the best articles that Bruce has written from June 2002 to June 2008, mainly from his Crypto-Gram Newsletter, his blog, and other newspapers and magazine. The book is divided into 12 sections, covering nearly the entire range of security issues from terrorism, aviation, elections, economics, psychology, the business of security and much more.

Two of the terms Schneier uses extensively throughout the book are intelligence and economics. From an intelligence perspective, he feels that Washington has spent far too much on hardware and other trendy security devices that create a sense of security theater. The security theater gives an aura and show of security, but in reality, has little real effect.

The lack of intelligence is most manifest with airports, which are a perfect example of misguided security. Schneier notes that current trends in US airport security requires that people remove their shoes, due to a one-time incident with shoe-based explosive. Such an approach completely misses the point. Also, Schneier notes that the attempt to create a no-fly list, by feeding a limited set of characteristics into a computer, which is somehow expected to divine a person's terrorist leaning, is farcical.

Schneier therefore feels that the only way to effectively uncover terrorist plats is via intelligence and investigations, not via large-scale processing of everyone. Intelligence is an invaluable tool against terrorism, and the beauty of it is that it works regardless of what the terrorists are plotting. The bottom line according to Schneier in the book is that too much of the United State's counterterrorism security spending is not designed to protect us from the terrorists; but instead to protect public officials from criticism when another attack occurs.

Schneier also astutely notes that for the most part, security is not really so much of a technical issue, rather one of economics. A perfect example he gives is that of bulletproof vests. Since they are so effective, why doesn't everyone wear them all of the time? The reason people don't is that they do not think they are worth the cost. It is not worth the money or inconvenience, as the risk of being shot for most people is quite low. As a security consumer, people have made the calculation that not wearing a bulletproof vest is a good security trade-off. Schneier also notes that much of what is being proposed as national security is a bad security trade-off. It is not worth it and as consumers, the public is being ripped off.

Another recurring theme throughout the book is how the Bush administration has little by little eroded the Constitution, all in the name of fighting terrorism. Schneier notes that the brilliant framework the founding fathers created by creating divisions of power (executive, legislative, judicial) with checks and balances violates a basic unwritten rule, that the government should be granted only limited powers, and for limited purposes. Since there is a certainty that government powers will be abused.

Schneier observes that the USA PATRIOT is a perfect example of this abuse. The Constitution was designed and carefully outlines which powers each branch may exercise. While Schneier is best-known as a cryptographer and security expert, Schneier on Security also shows him to be a defender of the Constitution. In a number of essays in the book, he shows how unchecked presidential powers is bad not only for security, but for the preservation of democracy.

In chapter 8, on the topic of the economics of security, Schneier suggests a three-step program for improving computer and network security. He notes that none of them have anything to do with technology; they all have to do with businesses, economics, and people.

In chapter 9, on the psychology of security, Schneier writes that he tells people that if something is in the news, then they do not have to worry about it. He writes that the very definition of news is something that hardly ever happens. It's when something is not in the news, when it is so common that it is no longer news, drunk drivers killing people, domestic violence, deaths from diabetes, etc., that is when you should start worrying. And much of the terrorist threats that the Department of Homeland Security is spending tens of billions of dollars on, are those news threats, such as shoe bombers and liquid explosives that present very little real threat to the people of the US.

A fundamental theme of the book is that security is a trade-off. And far too many people have made the security trade-off without thinking if it is truly worth it. In essay after essay, Schenier challenges those assertions. Since 9/11, much has been given up in the name of terrorism, and that has been personal privacy and security. Schenier asks, has it been worth it?

Schneier on Security is an exceptionally important book that is overflowing with thought-provoking articles. Schneier gets above vague adages such as the war on terror and gets to the heart of the matter. His insight details what the real threats are, and what we should really be worrying about. The irony is that what Washington does is often the exact opposite of what should be done.

Much of the security carried out in the name of 9/11 has proven to be infective in the seven years since the attack. Schneier on Security is a manifesto of what should have been done, and what should be done. The book is eye-opening from the first page to the last. It lets you know that the next time you see grandma asked to take her shoes off by a TSA agent at the airport, why she is simply a bit player in the large security theater. And why spending tens of billions on a charade like that, makes that a tragedy of epic proportions.

Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know.

You can purchase Schneier on Security from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Comments

Afterword

[mcgrew]

Two things:

First, Van Gogh painted Bruce Schneier's portrait over a hundred years ago.

Well ok, that's not Bruce but it sure looks like him, doesn't it? The linked picture is a Van Gogh self-portrait.

Secondly, I want to point to an afterward to Cory Doctorow's Little Brother. Bruce Schneier writes:

It's how security people think. We're constantly looking at security systems and how to get around them; we can't help it.

This kind of thinking is important no matter what side of security you're on. If you've been hired to build a shoplift-proof store, you'd better know how to shoplift. If you're designing a camera system that detects individual gaits, you'd better plan for people putting rocks in their shoes. Because if you don't, you're not going to design anything good.

So when you're wandering through your day, take a moment to look at the security systems around you. Look at the cameras in the stores you shop at. (Do they prevent crime, or just move it next door?) See how a restaurant operates. (If you pay after you eat, why don't more people just leave without paying?) Pay attention at airport security. (How could you get a weapon onto an airplane?) Watch what the teller does at a bank. (Bank security is designed to prevent tellers from stealing just as much as it is to prevent you from stealing.) Stare at an anthill. (Insects are all about security.) Read the Constitution, and notice all the ways it provides people with security against government. Look at traffic lights and door locks and all the security systems on television and in the movies. Figure out how they work, what threats they protect against and what threats they don't, how they fail, and how they can be exploited.

Spend enough time doing this, and you'll find yourself thinking differently about the world. You'll start noticing that many of the security systems out there don't actually do what they claim to, and that much of our national security is a waste of money. You'll understand privacy as essential to security, not in opposition. You'll stop worrying about things other people worry about, and start worrying about things other people don't even think about.

Sometimes you'll notice something about security that no one has ever thought about before. And maybe you'll figure out a new way to break a security system.

That's just a snippet, as the book is one long HTML page do a word search on "Bruce Schneier" to find the afterword.

Re:Afterword

[Creepy Crawler]

And one who breaks security is like the one who alerts the king about wearing no clothes. You WILL get punished. You WILL be dealt with.

I saw this all the time at schools, jobs and like. People dont like smart people. People who intentionally find broken ideas and mechanisms will be dealt with, not glorified and congratulated. Highlighting a security problem means they have to put in the effort to fix what you brought to their attention, or threaten you to STFU.

If you are smart about security, keep your mouth shut. There's not much you can do, except yourself be a target.

Re:Afterword

[Penguinoflight]

I like the idea of security systems working against their intended purpose. It reminds me of a recent incident at the office/retail complex where I work.

There's a fountain in the middle of a round-about, the intended purpose is to entertain visitors to the resturaunts around it. This fountain had multiple signs worded "Smile, you are being recorded"; a somewhat polite reminder to behave so to speak. Of course, there aren't any places to hide cameras in the nearby buildings, and there are no cameras installed. Someone figured this out, and put soap in the fountain. Now there are no friendly warning signs.

It was surely interesting that the poster of these signs wasn't intelligent enough to figure out that the signs would not deter bad behavior, but did understand after the fact.

Re:Afterword

[gnick]

People dont like smart people. People who intentionally find broken ideas and mechanisms will be dealt with, not glorified and congratulated. Highlighting a security problem means they have to put in the effort to fix what you brought to their attention, or threaten you to STFU.

Sometimes, but I don't think that it's about some smart-person-persecution system. The big problem is that, if somebody points out a security hole, it must be fixed. Even if the hole has been noticed before but was ignored because the odds of exploitation are so remote as to negate the sense in repairing it, once it's been reported it must be addressed - The risk of exploitation is now magnified greatly because of the liability lying on whoever ignores the request - Nobody wants to hear "I told you so" after a security incident. So, if the weakness is ludicrously expensive to fix and very minor, you are correct that it will probably annoy whoever you point it out to. It's not that they don't like you because you're smart, it's because they may have to do something silly or possibly face the consequences of exposed inaction.

If you are smart about security, keep your mouth shut. There's not much you can do, except yourself be a target.

That's kind of messed up. Maybe you've worked in some really dysfunctional places, but just throwing in the towel is doing a disservice to everyone involved. Just be sure you do a critical assessment of what you're suggesting before voicing it formally so that you can be sure that you're really improving things instead of making them worse. Otherwise, like Schneier points out, everyone winds up removing their shoes and throwing away their shampoo as a reaction to a couple of very remote threats.

Of course, there are obvious exceptions.

Re:Afterword

[cvd6262]

Amen.

I recently relocated to a rather rural area and I've met a lot of... shall we call them "simple" people. They look like country bumpkins, and many rarely leave the area, but several have surprised me with their insights.

One was an older man who worked construction his whole life. He once flew out to see his son's family in another state. While waiting to board his return flight he was sitting facing the key-pad door that led to the tarmac. He heard one person type "Beep... Beep... Beep... Bip-bip-bip." Then another. He realized that the six-digit code was three different numbers, followed by three identical numbers.

So he watched. After fifteen minutes he got the code. It was something like "264000." He wrote it on his boarding pass. When we handed the pass to the attendant at the gate she asked, "Sir, do you need this number?" He responded, "No, I don't need the code to your locked door over there." And then he boarded the plane.

A few minutes later two airport police officers came on the plane and asked him if he'd mind answering a few questions. He missed his flight (though they took mercy on him and put him on a later flight) while he was read the riot act. At no point did anyone thank him, nor did it seem that they were willing to find fault with their system or people who let out their ubersecret code.

He was wrong for hearing the code. He was wrong for watching the employees type the code.

Re:Afterword

[Creepy Crawler]

That's the thing: all security can be broken. All security has some sort of a hole or another. People do not want to hear about "possible avenues of attack".

Security really comes down to trust: do you trust the person you hired to not sell the company out or do evil to the company?

The problems that beget lower security can be attributed to a cost of business.

Re:Afterword

[JustinOpinion]

Highlighting a security problem means they have to put in the effort to fix what you brought to their attention, or threaten you to STFU.

Only because people have no clue about security.

When most people hear about a security vulnerability, they do indeed think that they have two options:
1. Fix it.
2. Bury all information about it.

The reality is that the third option is the one that is frequently the right one: Acknowledge it and move on. Security vulnerabilities are everywhere. It's better to be aware of them than not. And yes it's a good idea to fix them if doing so is not overly onerous. However it is not always necessary to fix them all.

For instance a store may not put magnetic tags on the chocolate bars they sell. Is the correct solution to tag everything? No, it's probably better to rely on people's (generally) good nature, the vigilance of employees, and then simply accept that a few chocolate bars will get stolen. It is cheaper (and less annoying for customers) to accept the losses. Or a movie theater can be tricked by having people exit with already-used tickets, and bring other friends in using them. Is the correct solution to require that everyone going to the movies show ID every time they enter the theater? No, it's better to simply accept the occasional teenager who "beats the system." Oftentimes the best "security" is just social norms. (Think of how much harm you could do, how much stuff you could steal, on a daily basis if you felt no remorse.)

Many geeks make this mistake, too (possibly because they are used to thinking about computer security, where applying a fix usually makes sense because the coding cost is fairly small compared to the damage that a exploit can cause).

I wish more people understood that security is a tradeoff, so that when someone points out a security hole, the people in charge can be honest and either say "that's not a sufficient concern to warrant fixing" or "that's a good point--we'll fix that now".

Re:Afterword

[burris]

That's kind of messed up. Maybe you've worked in some really dysfunctional places

You mean, there are places in the security business that aren't dysfunctional?

That's why I stopped working in IT security. Employees punished for trying to help, incredible amounts of snake oil, kickbacks for purchasing snake oil, totally clueless people attracted to the "spook" aspect, people and vendors acting "spooky" for no good reason, and did I mention the spook wannabes?

Re:Afterword

[Cowmonaut]

Change has to start somewhere. People being selfish/apathetic like this is part of why things like the USA PATRIOT act get passed.

Mod me +1 Wishful Thinking. I just shudder to think of a world where no one stands up and tries to make their homes better. The sheer amount of will it takes is staggering, but the results are worthwhile.

Re:Afterword

[cdrguru]

A security system in a store that simply moves the thieves next door is accomplishing the objective of the shopkeeper. Absolutely, and at minimal cost. Catching shoplifters is not the objective, it is the prevention of theft.

A basic problem we are now faced with in the US is that 50 years ago societal pressure was enough to ensure that most people obeyed the law, were nice to other people and we generally had a civil society. These pressures are breaking down, in some ways because of unassimilated immigration and changing attitudes. Also because of increased population. So what defined perfectly adequate security in a civil society doesn't work at all today.

Take the example of the restaurant. 50 years ago most people would not conceive of going to a restaurant, eating and not paying. The few that tried it were often stopped by other patrons. Today? Better have something stronger in place. The other patrons aren't going to be any help.

Security where everyone is a potential threat is a completely different game than the way the US has been playing since the 1700s.

Re:Afterword

[nine-times]

And one who breaks security is like the one who alerts the king about wearing no clothes. You WILL get punished. You WILL be dealt with.

Maybe because, in most cases, security is meant to deter the casual threat. You don't need to be some kind of super-spy to break into my apartment, but then the purpose of having a lock on my door isn't to keep super-spies out. Still, I don't particularly want you standing outside my door offering tutorials on how to pick my lock.

Re:Afterword

[Vellmont]

That's the thing: all security can be broken. All security has some sort of a hole or another.

While this is true, you ignore the most important point. All security holes are not created equal. There's some VERY dumb security problems I've come across or heard about over the years that would be VERY easy to exploit. Most (if not all) of them have been fixed. There's others that would be much more difficult to exploit.

You're correct that people don't want to hear about "possible avenues of attack". They want a security guy to do his/her job and say "this problem should be fixed, as it's highly likely to be exploited, and can cause severe damage".

Security really comes down to trust: do you trust the person you hired to not sell the company out or do evil to the company?

All security isn't internal. But on some level, you're right that internally there's a lot riding on the trust relationships. For those cases where there isn't any trust, security is about economics. How hard is it to break the security, how much risk of getting caught is there, and what's the benefit to doing so? You only need to make it not worth it to jump the fence.

Re:Afterword

[cdrguru]

You are thinking it is still 1950. Relying on people's good nature will get you a rude surprise today. It isn't 1950 and Mrs. Cleaver doesn't live up the street. Indeed, most people aren't feeling remorse.

In the town where I live they put up lights along a bicycle path. The path is relatively isolated from other homes so at night there is nobody around. Some people figured this out and removed all of (3 or for miles worth) the electrical wire for the lights. Probably got several hundred dollars for it at the recycling center. The city is going to rewire the lights, giving some other enterprising person another windfall because the lights simply cannot be protected.

As to how much the average person could steal, stores are facing that every day. Your average retailer is looking at 2% to 5% in shrinkage, every day. You wonder why more and more stores are checking people as they leave? It is because it is proven over and over that it is no longer a small minority that steal. It is everybody. Societal norms have completely broken down.

Re:Afterword

[spidr_mnky]

I sympathize with the guy, because he sounds a lot like me, but just to play devil's advocate, here:

Yes, the authorities were being jerks, but that's not really a surprise. He might have anticipated this and either kept the observation to himself, or at least taken a moment to explain that he'd watched it, and wasn't any kind of threat, rather than acting shady.

The gold from Fort Knox probably isn't sitting behind the door to the tarmac. Odds are that the lock is just there to keep people from wandering out there. People have an amazing ability to go places and do things that they really, obviously should not. Most security measures are not taken against geniuses but idiots.

Like I said, my heart goes out to him, because he sounds like a cool guy, but it does sound like he brought trouble on himself, probably just by momentary lack of forethought.

If, on the other hand, someone had left the door open, perhaps they would be more receptive to a quiet mention of that fact. It doesn't make him look mysterious (suspicious), and to acknowledge the pessimistic side, the cost to fix it less than the cost to punish.

Re:Afterword

[DragonWriter]

I saw this all the time at schools, jobs and like. People dont like smart people. People who intentionally find broken ideas and mechanisms will be dealt with, not glorified and congratulated.

This has nothing to do with smart people, it has to do with people who undermine the purpose of the system. In the case of "security" systems, many of them are not intended (from the point of view of at least some of the responsible parties: often there is a conflict) to provide security, they are intended to provide the appearance of security, which means that, contrary to what the "smart" people assume, those "smart" people are not pointing out failures to meet the actual design goal and thereby helping the system work better, they are directly undermining the actual design goal.

If you're really smart, you won't assume that people whose vested interest is in the appearance of security are concerned with the reality of security, or vice versa. And if people are concerned with the latter and you see a problem with the latter, you will make sure that, if you raise it at all, you do it in the context of how it is an inevitable problem with the former because someone hostile will inevitably discover it, and how the best way to fix it is the way that happens to provide actual security.

Its easier to get the response you want by showing people how that advances the intersts that they actually have, rather than the interests you think they should have. (You can work on changing priorities, too, but that's generally a longer term project, and even that can't work unless you are conscious of where people are coming from to start with.)

 

Re:Afterword

[mcgrew]

Well, I was only six 50 years ago, but it did seem that there were fewer thieves. Certainly our governments and industries weren't run by thieves like they are now. But you would have to show some stats to convince me that eat-and-run and shoplifting are more prevalent. I'd say with the advent of security tags on merchandice, all the cameras, there HAS to be a lot less, or today's thieves are smarter than your grandpa's thieves.

I don't think you can blame immigration on it, not in the US at least. We have always been a nation of immigrants.

I know that when I was a teenager, kids were as awful as they are today. And you don't hear about lynchings, or hear the word "nigger", at least not from white people. I'm not sure people are more dishonest than then.

I do know that geezers are a hell of a lot nastier than they were back then. Rich peole are nastier too.

Re:Afterword

[Workaphobia]

As convincing and well-established that argument is in our world, it doesn't extend indefinitely to the real one. When someone doesn't lock their door, you don't reward the guy who sneaks into everyone's house to prove he can. There are some areas where you know that insecurity exists, and rely on individual prosecution or ignorance (security through obscurity) to make the system maintainable. Near-perfect security is difficult and cumbersome, so why invest in it for anything but the most critical systems?

Re:Afterword

[spidr_mnky]

They probably encouraged it. If you're getting away with something, or getting the better of someone, that's tempting. If you're just abusing the helpless, that makes most people feel like a jerk.

Hanging an open padlock on a door is going to attract a few people that would probably otherwise ignore it.

Re:Afterword

[PolygamousRanchKid]

Two things:

First, Van Gogh painted Bruce Schneier's portrait over a hundred years ago.

Funny, I used to watch him on Saturday Night Live back in the 80's: http://en.wikipedia.org/wiki/Dennis_Miller

Well ok, that's not Bruce but it sure looks like him, doesn't it? The linked picture is a Van Gogh self-portrait.

That's because super-secret security experts are masters of disguises. Bruce regularly travels as a comedian as a cover.

And you'll find that all the employees of his company are called "Bruce."

Re:Afterword

[mcgrew]

Wasn't it ELO who sang "Don't bring me down BRUCE"?

Re:Afterword

[riceboy50]

Shouldn't we be trying to restore those values in our free society then, rather than accepting the logical conclusion of that line of reasoning where everyone is subjugated by a police state?

Re:Afterword

[Workaphobia]

That is a perfect example of the exact trade-off security-conscious people must deal with.

Suppose that all people who attempt to break a system were entitled to do so if they come forward with their methods. This would allow anyone to commit any number of attempted felonies so long as they were not successful. My own counterargument would be that the person who would exploit these holes for malicious purposes wouldn't come forward and thus would be unstoppable if we assume that they aren't caught.

Still, by prosecuting or at least harassing even good-intentioned trespassers, it serves the purpose of deterring some cross-section of would-be offenders regardless of their intent.

Re:Afterword

[IsaacD]

i went to work for a credit card processing vendor... shortly into the short, 120-day stay, i discovered serious security flaws, including weak encryption schemes, and even injection vulnerabilities... the software had been written by offshore sources that were either very apathetic or very junior... when i brought this to the attention of my seniors i was just told to keep it quiet... i left VERY quickly after this... this was, i discovered, during the times that they were in talks to be acquired by american express... so, they were acquired and amex inherited a lemon, and the founders of the acquired company made out fat... the last i heard, this company was hemorrhaging clients...

Re:Afterword

[geekmux]

If you are smart about security, keep your mouth shut. There's not much you can do, except yourself be a target.

Obviously, you've never held a Security position where you get paid to NOT STFU.

That being said, this is also one of the main reasons I will NOT take a Security position unless I have the power to say NO in policy and procedure when necessary, and that decision be upheld and supported by the highest positions in the company.

Without TRUE support, you're asking to get hung out to dry, for all the reasons you pointed out.

Re:Afterword

[Anonymous Coward]

because the lights simply cannot be protected.

No; that's bull. It's because nobody can be bothered to protect the lights. You know people come along and steal them. Put police out in hiding and wait and catch them. Yes, it costs more than the cable, but it's an investment. Yes they might get a light sentence this time because they are first time offenders, but next time they won't be. This is the most valuable lesson of New York's zero tolerance campaign. That ignoring small crimes that only affect "little people" like me and you is what causes everything to go wrong.

The shop lifters are the same people every time. You should try two experiments. Firstly; pick a random person for help in a station (really carefully); ask how to do something. Secondly, stand around looking a bit in need of help then when someone offers as the same question. In the first case you will always get good advice. In the second it will depend from place to place, but you will often get bad advice. Most people are fine, but are just to tired to go looking for people to help.

Re:Afterword

[moderatorrater]

No, it's better to simply accept the occasional teenager who "beats the system." Oftentimes the best "security" is just social norms.

I would highlight this with another example. My friends and I would often go to a particular restaurant to eat. This restaurant serves popcorn to eat while waiting for the meal and they have some relatively cheap appetizers. We'd order one small appetizer and fill up on popcorn. To some people, looking from the outside, this would look like "gaming the system", where we take something intended to help paying customers and use it without paying.

However, today, not a month goes by when I don't eat there with at least a group of 6 people, and my wife and I go there all the time. Had a manager or waitress been a hardass and kicked us out, my friends and I certainly wouldn't be eating there on a regular basis today. Sometimes it's better to accept the short term loss if it builds customer loyalty.

Re:Afterword

[Cajun Hell]

He might have .. at least taken a moment to explain that he'd watched it, and wasn't any kind of threat

Good grief. They KNEW he wasn't any kind of threat. What would be the pointing in explaining anything? And why should a person EXPECT to be abused like that, except for having heard anecdotes like this one?

He could have done better, but he didn't do anything wrong -- except that he forgot to hate and distrust The Man.

Suppose some day HE sees something suspicious that he probably ought to report. What is the smartest thing to do? Nothing.

Re:Afterword

[Brad Eleven]

He was wrong for hearing the code. He was wrong for watching the employees type the code.

Surely you mean, "He was wrong in the eyes of the people to whom he reported the problem."

If you want to make a difference, report problems to someone who can make a difference. Someone has responded and referred to "the attendant at the gate" as "the authorities." That's the problem with this anecdote: None of the people involved were authorities. They had privileged access, but no authority to do anything about the exposed keypad. What did he expect, a big thank you and then legwork performed by the gate attendant and the TSA contractors in the vicinity?

I agree that whistleblowers are generally punished rather than respected, because they tend to uncover incompetency and/or malfeasance. That is, they're reporting problems to people who think they'll get in trouble if anyone finds out.

It seems that the man took offense at the fact that he managed to figure out the code to the keypad after only 15 minutes of observation. If he really did say, "No, I don't need the code to you locked door over there," he was inviting trouble, IMHO.

The responsible thing to do would have been to contact the airport's security officer and point out the security hole. I understand that this would take some effort, e.g., finding out who's in charge, how to contact him/her, waiting for him/her to call back, etc.

It's too bad that we can't simply point out errors as we find them, to the nearest and most convenient person. That still doesn't make it sensible to do so and then complain that no one listens. You might as well tell the guy behind the counter at the convenience store that the ATM in the back of the store has a security problem. At best, he'll ignore you--at worst, he'll call the cops because his limited understanding will lead him to believe that you just ripped off the ATM.

Re:Afterword

[Brad Eleven]

You're confusing The Man with The Employees. The Man is far, far away from the keypad. He has hired thousands of people to insulate him from the keypad, in order to make his decisions in isolation.

Just because someone has the root password doesn't mean that they care, or have the authority to fix a security hole.

I say "has the root password" because that's how I think of the people between the front door of the airport and the jetway who can upgrade your ticket if they want to.

Add to that the TSA contractors who have full access to your luggage--and your time, if they choose to detain you.

I'm not saying "Don't raise Hell." I'm saying raise Hell with someone who can--and is likely to--do something about the thing that you think needs fixing. Complaining to someone who is powerless only reminds them that they're powerless--except when it comes to hassling you.

They probably hate the keypad, anyway.

Re:Afterword

[Ken D]

The lock is there because everything outside that door is a security area.
No unauthorized people are allowed accessed to the tarmac.
Out there you have access to the planes, tools, checked baggage, airport vehicles, and fuel (probably including all of gas, diesel, and jet fuel).

Re:Afterword

[quanticle]

The reality is that the third option is the one that is frequently the right one: Acknowledge it and move on.

Unfortunately, in many cases, this isn't an option any more. In the current litigious society, if a security flaw can possibly be exploited, there's no way a company can go on record saying, "Yeah, we know about this vulnerability, but the costs of fixing it outweigh the benefits." If the vulnerability is later found and exploited, that sort of statement will be seen as tantamount to an admission of guilt in the court of public opinion, if not the court of law.

Re:Afterword

[TomRitchford]

Your average retailer is looking at 2% to 5% in shrinkage, every day.

Sorry, that's just not true. Your average retailer looks at less than 2% shrinkage, per year, check the stats.

And overall, most humans are still very moral. There's only a fairly small number of people who have the combination of energy and anti-social nature to do this. This could change - the neo-Cons have tried to make a virtue of psychopathy - but for right now your average guy is, if he's not feeling threatened, pretty decent.

Re:Afterword

[ciderVisor]

That painting looks like Chuck Norris to me.

"Geologists recently discovered that "earthquakes" are nothing more than Bruce Schneier and Chuck Norris communicating via a roundhouse kick-based cryptosystem."

http://geekz.co.uk/schneierfacts/fact/58

Re:Afterword

[Bruce Dawson]

> Sorry, that's just not true. Your average retailer looks at less than 2% shrinkage, per year, check the stats.

You forgot to post a link to some stats. I'll help you out. How about this one:

http://en.wikipedia.org/wiki/Shrinkage_(accounting)

It says that "per day" and "per year" are both incorrect. Shrinkage figures are given as a percentage of sales. That makes sense because giving shrinkage numbers as a percentage of inventory wouldn't be meaningful without understanding how quickly the inventory was turned over, and even then it's not very useful because it doesn't directly indicate the economic cost of the shrinkage.

What the Wikipedia link says is that shrinkage is about 1.7% of retail sales in the US in 2001. Not per year. Not per day. Also not 2% to 5%.

Re:Afterword

[ion.simon.c]

Your average retailer is looking at 2% to 5% in shrinkage, every day. You wonder why more and more stores are checking people as they leave?

BDawson exploded your mishandling of the statistic further downthread, so I'll not bother with that.

His linked Wikipedia article mentions that the majority of theft-related shrinkage is caused by the employees!
What's your answer to that, Mr. Smartypants?

Re:Afterword

[TomRitchford]

Yes, I knew I was comparing apples and oranges, but the point was that the original number was off by well over an order of magnitude if not two. To seriously imagine that 5% of the items disappear from a store, each and every day, is madness.

Re:Afterword

[initialE]

Specifically, they were trying to turn their problem - which was a lack of awareness that they were being observed keying in the number, into his problem, which is being a busybody. One is a disciplinary offense, the other is just bullshit. But if they can make everyone feel that he has done something heinously wrong (and consequently that they have done nothing wrong themselves), they can hide the severity of their own errors in a shroud of fud. Which matters when evaluation time comes around and you're looking forward to that bonus. Nobody cares, you see, that it is instilling into people the apathy that could allow another 9/11 to happen, they're looking at goals closer to home.

Re:Afterword

[ion.simon.c]

How was the olde fart in the GP's post supposed to divine Security's intention?
Moreover, what does Security stand to gain by detaining and berating someone who isn't fooled by their faux security?

Re:Afterword

[Chandon Seldon]

Certainly our governments and industries weren't run by thieves like they are now.

O RLY?

I'm pretty sure the only difference is that 50 years ago they put a bit more effort into appearing respectable (and the lack of social transparency made that easier).

Re:Afterword

[mcrbids]

If you are smart about security, keep your mouth shut. There's not much you can do, except yourself be a target.

No ifs, ands, or buts about it.

Some time ago I found a gapingly large security whole in a major credit card company's online credit card processing system when I was being paid to implement an online shopping cart system. It was a terrible, nasty security hole - bad enough that I could have purchased anything I wanted to at any vendor's website that used this gateway for FREE, without the use of any special "hacking toolz", just a browser and a text editor.

The kind of thing that you see most commonly at the Daily WTF.

So I wrote a detailed email, indicating that I was recommending against this company to my client, along with explicit details, step by step, for how to completely compromise their gateway. I also included specific details for how the security hole could have been completely mitigated. I sent this email to every account that I could find/think of at the company, including abuse@, sales@, customerserver@, postmaster@, webmaster@, etc as well the reps that I'd been working with to that point, cc my client.

My client canceled the account with said company and moved to one with a much more secure API. Having done my duty by protecting my client, I promptly forgot all about the original credit card processing company.

Over a year later, long after I forgot completely about the original credit card company, I got a phone call, from a very agitated-sounding gentleman on the phone. He verified my identity, then asked me questions about the security hole. My only verbal response to him was something like: "Everything I know is in the email I sent to you, the email speaks for itself. A qualified software engineer could read it and should know exactly what to do.". But he wasn't happy with this. He asked me if I'd tried to use the security hole, and I said nothing. He then started this rant, going on and on about how it really wasn't a security hole, and how it's really not a problem. Over and over, he repeated himself.

Finally, he threatened to sue me if I disclosed the security hole to anybody else, and hung up the phone.

The point being? Having been given the problem on a silver platter, with details, implementation details, and a detailed description of how to fix the problem, their "solution" was to yell at and threaten me, the discloser. Never mind the fact that the knowledge needed to compromise their gateway was public information. (their documentation was freely downloadable)

As a professional in either security and/or the digital arts, you frequently find yourself in the unenviable position of seeing the emperor stark naked in front of the crowds. It's not a pleasant experience. Merely helping somebody can be grounds for attack the weak whose fear stems from their misunderstanding - all too often, they confuse the message with the messenger.

Re:Afterword

[jonaskoelker]

Sometimes, but I don't think that it's about some smart-person-persecution system. The big problem is that, if somebody points out a security hole, it must be fixed. Even if the hole has been noticed before but was ignored because the odds of exploitation are so remote as to negate the sense in repairing it, once it's been reported it must be addressed

That depends entirely on whom the security hole has been reported to; if you only report it to a few people, and only to those able to fix it, they might look kindly on it [like when I did that with my university's /etc/passwd]. I think the increased awareness is one of the arguments in the full disclosure versus limited disclosure debate [I won't advocate one position over another in that debate, and you can find all the arguments for both sides on your own time].

Re:Afterword

[jonaskoelker]

Or a movie theater can be tricked by having people exit with already-used tickets, and bring other friends in using them.

Could you elaborate on how that works? I think the movie theaters you talk about don't work like those I think of. Here's my typical use case:

(1) Buy ticket. On the ticket, there's the name of the movie, date and time of when it's shown, and a seat address. There's also a removable part with some of the same information. (2) Go up to man between me and screen; he removes the removable part and lets me pass. (3) watch movie. (4) throw out ticket and leave.

What's your attack on that system? Is your system different? How so?

Some interesting attacks I can cook up: go see the earliest movie. Stay inside the guarded area and watch all other movies shown that day for no additional cost. A reasonably simple fix is to have someone check that the area is all emptied between the movies; a counter-fix is hiding in the toilet. Counter-counter-fixes include giving keys to the toilet to the guards, and posting guards outside each hall instead of one in front of all the halls. A problem with emptying the area is also that the movies aren't shown at overlapping intervals.

The real answer is that this is not really an issue: most people value their time enough that the time spent between movies is not worth it; sure, you can bring a good book, but still... also, viewing movies for one day straight is going to do something funny to your head you may not want, and you may not like all the movies shown that day. The money spent on guards is going to ramp up much faster than the money not earned from cheaters.

Another attack is people fabricating false tickets on their own. The fix is to put a cryptographic signature (or a keyed hash) of the information on the ticket on the stub removed by the guard [in barcode or pixel-matrix form], and give the guard a scanner that verifies the signature. Counter-fixes are harder; you have to steal the private key or tamper with the verification tool. Again, this is probably a non-issue since the time spent on learning how to make counterfeit tickets probably exceeds what most people want.

Although, if the technology is cheap enough, you might do away with the guard if you have a system similar to the subways that lets one person pass through on scanning a valid ticket. This could potentially save money.

Re:Afterword

[MichaelSmith]

The company I work for used to give us two separate security cards. One with the company logo and employee photo etc, the other a blank RFID card to get into the building. Now the cards have been combined into one so that if a card is lost the finder can go directly to our office and walk in.

So I explained the problem to our head of security. he agreed that I was right and that absolutely nothing would be done about it. The new cards are a global policy and 60000 people are using them now and it is too late to change.

Re:Afterword

[Fred_A]

You're confusing The Man with The Employees. The Man is far, far away from the keypad. He has hired thousands of people to insulate him from the keypad, in order to make his decisions in isolation.

The Man is the Sum of the Employees.

Re:Afterword

[Fred_A]

Your average retailer is looking at 2% to 5% in shrinkage, every day.

Certainly not true for average retailers. Bad laundries maybe.

Re:Afterword

[JimFive]

Of course, since everyone just clipped the two old cards on the same lanyard, nothing has really changed with regard to security, and costs went down.

It's a win.
--
JimFive

Re:Afterword

[JimFive]

Could you elaborate on how that works? I think the movie theaters you talk about don't work like those I think of.

The attack goes like this:
You and a friend each buy 1 ticket and pass through the ticket taker (who takes half of each ticket)
You then return through the gate carrying both ticket stubs.
You give one stub to a third friend and you both return through the gate, showing your already torn tickets.

This works because the cinema workers do not prevent you from walking back and forth through the gate with a valid, but used ticket, usually because the concessions or the bathrooms are outside the "secure" area

Clearly, it isn't worth it for most cinemas to control this as long as the incidence is low enough that the lost revenue is less than the cost.

As for someone staying to watch all the movies, you missed the main way that cinemas guard against this. They schedule the movies so that there is a significant wait between the end of a given movie and the start of a different movie, thus giving staff time to notice. They also put the concessions and restrooms outside of the secure area so that you have to show a stub to get back in.
--
JimFive

Re:Afterword

[DragonWriter]

Moreover, what does Security stand to gain by detaining and berating someone who isn't fooled by their faux security?

They stand to gain by, e.g., motivating GPs post, in which he suggests that people who notice this kind of security theater should keep their mouth shut and not reveal it. Developing this kind of attitude, of course, supports the goal of security theater, since it reduces the probability that its shortfalls as actual security will be noted.

Re:Afterword

[Jansingal]

what is elo?

Re:Afterword

[mcgrew]

A 1970s rock/classical band called Electric Light Orchestra.

You got me running going out of my mind
You got me thinking me that I'm wasting my time

Don't bring me down
No, no, no, no, no, ooh ooh
I'll tell you once more before I get off the floor
Don't bring me down

You want to stay out with your fancy friends
I'm telling you it's gotta be the end

Don't bring me down
No, no, no, no, no, ooh ooh
I'll tell you once more before I get off the floor
Don't bring me down

Don't bring me down, Bruce
Don't bring me down, Bruce
Don't bring me down, Bruce
Don't bring me down

What happenned to the girl I used to know
You let your mind out somewhere down the road

Don't bring me down
No, no, no, no, no, ooh ooh
I'll tell you once more before I get off the floor
Don't bring me down

You're always talkin' 'bout your crazy nights
One of these days you're gonna get it right

Don't bring me down
No, no, no, no, no, ooh ooh
I'll tell you once more before I get off the floor
Don't bring me down

Don't bring me down, Bruce
Don't bring me down, Bruce
Don't bring me down, Bruce
Don't bring me down

You're looking good just like a snake in the grass
One of these days you're gonna break your glass

Don't bring me down
No no, no no, no no, no no, no, ooh ooh
I'll tell you once more before I get off the floor
Don't bring me down

You got got me shaking, got me running away
You got me crawling up to you every day

Don't bring me down
No, no, no, no, no, ooh ooh
I'll tell you once more before I get off the floor
Don't bring me down

Down, down, down, down, down
I'll tell you once more before I get off the floor
Don't bring me down
{Thud}

Re:Afterword

[tehcyder]

This restaurant serves popcorn to eat while waiting for the meal and they have some relatively cheap appetizers.

I think calling somewhere that serves popcorn a "restaurant" is stretching the definition a little. But autres pays autres moeurs.

Looks like Kelsey Grammar only with more forehead

[Anonymous Coward]

I didn't think that was possible.

Security can be bought

[davidwr]

The price is usually money, time, emotional energy, study, and perhaps reduced functionality.

Then again, that's probably the point of the book.

Re:Security can be bought

[Znork]

Whether it can be bought or not is perhaps besides the point.

Because it can certainly be sold.

Re:Security can be bought

[_Sprocket_]

Security can be bought

The price is usually money, time, emotional energy, study, and perhaps reduced functionality.

Wait a minute. Emotional energy? Reduced functionality? Sounds like someone's buying themselves a whole lot of insecurity.

Security

[TubeSteak]

"Buying" security is easy, because throwing money at a problem is always the simplest path.

Educating gatekeepers and end-users is vastly harder and much more expensive, because it not only costs money, it costs time..

Re:Security

[FooGoo]

It's called transferring risk. The risk still exists but I pay someone else to mitigate it. There are some risks that a company may not be in a position to address themselves. Either due to conditions in the market place, lack of expertise, or excessive regulatory requirements.

Educating users is probabaly the easiest and cheapest way to reduce risk. It doesn't cost a lot of money or take a lot of time. The problem is most companies just don't do it. You might be looking at a cost of $100 per employee per year and 30 minutes to an hour to take a class.

Most companies mention it during orientation but never provide on-going training or support to their employees when it comes to security issues. In this case the infosec team needs to get out of their cubes and walk around and talk to people to be sure they can advise fellow employees on security risks and get the lowdown on which manager proposed something stupid this week. 90% of the security teams job should be education be it educating developers, system admins, general counsel, marketing, exec admins, or the board of directors.

Re:Security

[fm6]

Educating gatekeepers and end-users is vastly harder and much more expensive, because it not only costs money, it costs time..

Well, time is money, so really it's all about money.

Except it's not. Deploying thousands of security drones and tons of expensive machinery costs a lot more than a few classes. It's not about money. It's about convincing people that you're Doing Something. All that effort against mentally retarded terrorist serves the same purpose as Mayor Quimby's Bear Patrol: it's a conspicuous and easy-to-understand effort that everybody can relate to. Educating airline personnel on good security practices might be more effective, but does little to make people feel safer.

Suppose you could go back in time to 9/12/2001, and persuade SOT Mineta to forget about the security theater and concentrate on the more subtle security enhancements Schneier likes. He would have been fired within days. Everybody would have sneered at the retraining as touchy-feely crap. And frankly, I think most Slashdotters would have joined in.

Re:Security

[Znork]

It's not about money.

Sure it is. For the security salesmen it's about convincing politicians and civil servants that they need to buy expensive security systems. Preferably with lots of blinking lights and even better, As Seen in the Movies, with technology that you can claim is sufficiently 'advanced' to justify the hefty pricetag.

For politicians it's another money/power making issue as they can justify sweeping spending and control with it. They're not overly difficult to talk into buying the pointless junk as it's not their money and they make their other gains by keeping people afraid.

People, to a large extent, don't actually give a crap about 'feeling safe' as far as it relates to abstract dangers like transportation security. Most engage in far riskier activities on an everyday basis; heck, terrorism rates about the same as accidental bathtub drownings as a risk over the last ten years. If it weren't for security salesmen and politicians, people would be a bit scared for a month or two and then get on with their lives. Much like other minor scares that we deal with.

Heck, I'd bet you find more people who've quit traveling due to the painfully retarded security, than you'd find not traveling because they're scared of security threats.

Bruce Almightly

[FooGoo]

I can't wait until this guy starts doing late night infomercials. If there is one thing Bruce its really good at...it's marketing. I remember when he gave me an autographed copy of Secrets and Lies for dropping 20 grand with Counterpane....I will cherish it forever

Re:Bruce Almightly

[Jansingal]

so you are both angry at bruce and jeaolous of his success!

Re:Bruce Almightly

[FooGoo]

Actually, I am not angry. I am happy for him and I think his book Applied Cryptography was excellent and still serves as a great reference text.

What I have a problem with is the security pundits who add no real value to the discussion besides stating the obvious . His success today is more like that of an IT pop star preaching to the choir. Anger and jealousy don't fit into it....I can admire his past achievements and disagree with his current approach at the same time.

Re:Bruce Almightly

[Jansingal]

ok, i see.

but well, his topics are very very current and timely.

name 1 thing he has written that is not.

Re:Bruce Almightly

[bill_mcgonigle]

What I have a problem with is the security pundits who add no real value to the discussion besides stating the obvious . His success today is more like that of an IT pop star preaching to the choir. Anger and jealousy don't fit into it....I can admire his past achievements and disagree with his current approach at the same time.

I think I can shed some light on this. Bruce's job is to convince your boss about the stuff you already know. Your boss will believe Bruce because 1) he's Bruce and 2) he's not you. I don't mean you specifically, but you the underling of an average IT manager. In this case, you are an idiot. In your specific case, your $20K probably fixed your boss (I'm overgeneralizing but this kind of thing happens frequently).

In short, Bruce serves a useful function. And I run all my ssh sessions '-c blowfish'.

Re:Bruce Almightly

[FooGoo]

Unfortunately I can't mod in my own thread but I would give you a +1 Insightful. I hadn't thought of that.

Re:Bruce Almightly

[DerekLyons]

Yup. I've been saying it for years and routinely been modded down for it - Bruce is a columnist and a consultant. He succeeds not by being right, but by being popular or at least generating lots of buzz. This book is just building the brand, repeating and repackaging everything he has said a dozens times before so that they Faithful can shower him with money.
 
The only difference between Bruce and Billy Mays is that Billy is at least honest in what he does.

Re:Bruce Almightly

[mvdwege]

You know, if the point is to raise awareness of security beyond the PGP-using geeks and nerds, what's wrong with being popular?

Your comment has the distinct taste of sour grapes.

Mart

Re:Bruce Almightly

[DerekLyons]

You know, if the point is to raise awareness of security beyond the PGP-using geeks and nerds, what's wrong with being popular?

If that's the point - why is so much of his output over the last few years centered around his political views and so little about computer security? Why so much pandering to the anti-Bush demographic? Why so much, quite frankly, ignorance about security in favor of pithy sound bites?
 
 

Your comment has the distinct taste of sour grapes.

As Inigo says, "I do not think that means what you think it means".

Re:Bruce Almightly

[mvdwege]

I'm very sorry to bust your little reactionary bubble, but the two Bush-Jr. governments have an observable bad track record on matters of security. If pointing that out is repugnant to you, I suggest it is you that has a problem.

And if you're the real Derek Lyons, then yes, complaining about Schneier's popularity does taste of sour grapes. Then again, your work in the SCO affair proved just how smart you are, so I am not surprised you get this wrong as well.

Mart

Re:Bruce Almightly

[Jansingal]

i guess that is why you are asked to speak at so many conferences, write so much, since you know more than he?

seems like so many postings here are from those who are jealous of bruce.

Re:Bruce Almightly

[karlconnors]

As per the other comments, you seemingly envious of his success. There is nothing to indicate that his celebrity status has done anything to impinge on his integrity.

Security Isn't Important

[Anonymous Coward]

I've learned over time working in many companies that security isn't important. What is important is the perception of security to the auditors, the clients, and the management. That's the key.

Re:Security Isn't Important

[TripMaster Monkey]

Sure, that's important....until you actually have a security breach, and all the carefully managed "perceptions" of the auditors, clients, and management come crashing to earth.

Re:Security Isn't Important

[burris]

Maybe in the military or in geek super spook krad fantasy land. In the real world of business there is little to no impact to a business as a whole over any security breaches. The public record is replete with examples of businesses who seriously dropped the security ball but the effect was about as dramatic as a bug getting squished on the corporate windshield. Sure there's some goo to wipe off but the car doesn't slow down.

Microsoft, Netscape, credit card processors, insurance companies, civil administrations, many companies have slacked in their security but the worst that happened was a few negative articles in the press that were soon forgotten.

Find just one company that was shut down or went out of business because of a security breach. You just can't do it. Execs rarely even get fired over this stuff.

That's why businesses continue to have poor security. It's just not worth it. You just have to manage it, like everything else.

Re:Security Isn't Important

[seer]

Credit Card processors? Name one that had a big breech within the last 20 years? They are held to PCI compliance, and Visa makes all the rules.

I bet if there was a breach, it didn't involve any card numbers. (Visa doesn't care about SSN numbers or any other personal info, just card numbers)

Question

[Amazing Quantum Man]

If Chuck Norris tried to break Bruce Schneier's security, what would happen?

Re:Question

[NoNeeeed]

You would reach "beard critical mass", at which point the Large Hadron Collider would turn into a very surprised sperm whale and a bowl of petunias.

Why do you think you never see them together?

Re:Question

[spidr_mnky]

Just like the answer to the riddle about the unstoppable force and the immovable object, they can't exist in the same universe.

Re:Question

[Hotawa Hawk-eye]

Why do you think you never see them together?

Maybe Chuck Norris and Bruce Schneier are one and the same person, and anyone who figures that out gets roundhouse kic$(&$*& NO CARRIER

Re:Question

[Kingrames]

Whoever wins, we lose.

Re:Question

[MK_CSGuy]

It's called 'singularity'

Re:Question

[kat_skan]

I think you'll find that Chuck Norris can exist in any universe he damn well pleases.

Re:Question

[Chandon Seldon]

No, I'm pretty sure that Bruce Schneier isn't a retarded douchebag who endorsed Mike Huckabee.

Re:Question

[MichaelSmith]

Oh no not again!

Re:Question

[corbettw]

Another question: could Bruce Schneier design a system so secure, even he couldn't crack it?

Dealing with symptoms

[Anonymous Coward]

Everything he talks about is just dealing with the symptoms. Terrorism is a symptom of very desperate people who feel that they're being shit on by someone.

I've been thinking about terrorism lately and its causes and its implementers. most terrorism is centered on what's happening in the Middle East. Now before someone accuses me of being anti-Islamic or racist or whatever, hear me out.

Terrorism is the result of very desperate people who have lost all hope and feel powerless. The Middle East and its people have been shit on for a couple of millennia; whether by western powers, other in the Middle East (Persians and Turks), Asians. These are people who have felt shit on by the World and there's nothing they can do about it. The creation of Israel was the straw that broke the camels back - so to speak.

To make a long story short, if we gave autonomy to the Middle east (Oil supplies be damned!), meaning pull out completely. I think terrorism would stop or at the very least, decrease dramatically.

I also disagree with folks who think that if we were to leave the Middle East, others would gain control of the Oil thereby sending us into a depression or putting our military and defense in jeopardy. It won't happen.

Re:Dealing with symptoms

[Calinous]

There is plenty of terrorism (or was lately) in Indonesia, Ireland, and ex-Soviet republics (true, close to the Middle East area) without involvement from the well-known (or less well known) Middle East factions. Also, there was terrorism in the U S of A that did not involved any kind of arabic or Middle East factions.
      Agree with the rest of the post

Re:Dealing with symptoms

[postbigbang]

Sure. That'll help.

I suppose we'll have to forget about the domestic terrorism in OK City. Or the terrorism in the Phillipines. Or Columbia. Or Bolivia, or Argentina, and gosh, the rest of S America. Forget about Africa, too. Maybe the Tamils will surrender peacefully. Maybe the Hindus will stop fighting. Will the IRA cease fire-- really? How about the Basque?

In each case, there's a group that fights the rule of law and with unrestricted, murderous violence.

Your argument is about civility underneath. Without civility, we can't be sure that something will blow up. Letting the Middle East stew behind a wall isn't going to solve anything. For some, the mere fact that you exist as an infidel is all that's rationalized to murder you in cold blood.

Will the insane backlash of western fear make it any easier to travel about freely? You've seen the results.

Otherwise, Rothke is the wrong guy to do this sycophantic, uncritical review of Scheier'w work. To Rothke, Shneier's feces have no scent, whether in fact they do or not.

Re:Dealing with symptoms

[Forbman]

yes, the random terrorism (e.g., Somali pirates that took over that Ukrainian freighter a couple of weeks ago) is that. But the more organized terror groups are after power.

Re:Dealing with symptoms

[Medievalist]

I suppose we'll have to forget about the domestic terrorism in OK City.

but that was Christian terrorism, by a fella that was probably trained in a US Christian terrorist training camp called Elohim City, and therefore DID NOT HAPPEN.

C'mon, get with the program! It's only terrorism if non-christian brownish people do it. Didn't you get the talking points?

Re:Dealing with symptoms

[postbigbang]

As a certain Comedy Central host once said: Taliban is Taliban!

Re:Dealing with symptoms

[anadem]

Your assumption that terrorists are people driven by desperation is an outmoded idea that's leading to non-solutions. Research shows that most terrorists are actually motivated by unmet needs for social contact - they just want to acquire social status.

Re:Dealing with symptoms

[Jansingal]

>>>Terrorism is a symptom of very desperate people who feel that they're being shit on by someone.

which shoes how clueless you are. dumb comment.

Re:Dealing with symptoms

[_Sprocket_]

It's only terrorism if non-christian brownish people do it. Didn't you get the talking points?

I'm kind of curious as to who you think are putting forward these talking points? It can't be Necons who are pretty quick to mention domestic terrorism when convenient.

Re:Dealing with symptoms

[mollymoo]

I've been thinking about terrorism lately and its causes and its implementers. most terrorism is centered on what's happening in the Middle East. Now before someone accuses me of being anti-Islamic or racist or whatever, hear me out.

I don't think you're racist, just not very well informed. If the American press is your source of information that doesn't surprise me. Most terrorism is not centred on the Mid East, it's just that's all the terrorism the USA cares about. The motivations for all the other terrorists around the world are pretty much as you describe though, and the solution (stop fucking with people and they are much less likely to want to kill you) is generally applicable.

Re:Dealing with symptoms

[mollymoo]

What's you explanation then, smartass?

Re:Dealing with symptoms

[_Sprocket_]

Everything he talks about is just dealing with the symptoms. Terrorism is a symptom of very desperate people who feel that they're being shit on by someone.

Terrorism is a tactic. It is the amplification of force effectiveness by achieving psychological effect. It is used by the powerful and the powerless. However, I suspect that you're after the more politically charged use of the word. There are two issues with this.

First, you're assuming that the tactic itself can be stopped by solving a particular set of political issues. That assumes that one issue won't be supplanted by another. And that those in conflict won't study history and seek tactics used by others (with whatever perceived success).

Secondly, you're buying in to the situation as described by a particular political mindset. True - terrorism is an issue. Just like any other threat. But it is not an entity. The "war on terrorism" is as nonsensical as a "war on war."

Terrorism is the result of very desperate people who have lost all hope and feel powerless. The Middle East and its people have been shit on for a couple of millennia; whether by western powers, other in the Middle East (Persians and Turks), Asians. These are people who have felt shit on by the World and there's nothing they can do about it. The creation of Israel was the straw that broke the camels back - so to speak.

Keep in mind that a lot of terrorists are turning out to be rather well educated and otherwise well positioned. They are not the down-trodden masses. But they find it easy to draw from those masses as one would draw from an armory. The trick is methods of motivating desperate people to do desperate things. Sometimes that's trivial. Sometimes it takes a more subtle lever - Isreal and racism makes a very handy lever (which also works when you're drawing from other educated and well-positioned ranks... as is happening today).

To make a long story short, if we gave autonomy to the Middle east (Oil supplies be damned!), meaning pull out completely. I think terrorism would stop or at the very least, decrease dramatically.

Keep in mind that there's already a lot of autonomy in the Middle East; even with a history of US and Soviet meddling in the region. And despite this, conflict has been ongoing for millenia.

It's very likely we'd see a decrease in attacks against US interests - pull troops out of an area and you remove not only convenient targets, but a catalyst for motivation. But the question would then be - for how long?

The US is a world power. The military strength of the US is nothing compared its economic and cultural impact. US interests are global. Those who resent that influence are just as likely to move their targets from military to civilian.

And, in fact, they do so already. It doesn't have to be US citizens or property. Terrorism is conducted by Muslims against Muslims. If any of those targets happen to be allies or otherwise involved in US economic interests, the US remains a target. And that ignores the concept of destroying that hated influence by going directly to the source (not that I'm a big fan of the "fight them there so we don't fight them here" rhetoric... but the World Trade Center was economic as well as symbolic).

I also disagree with folks who think that if we were to leave the Middle East, others would gain control of the Oil thereby sending us into a depression or putting our military and defense in jeopardy. It won't happen.

Iran attacked Kuwaiti oil infrastructure. When Iraq withdrew from Kuwait, it torched oilfields. Iraqi insurgents have repeatedly attacked Iraqi oil infrastructure. Oil is an easy target and likely one of the first casualties in any conflict for power in the region. It's not just about who controls the oil (or at least is the one doing the selling).

Re:Dealing with symptoms

[Cajun Hell]

The Middle East and its people have been shit on for a couple of millennia

Irrelevant, since no middle eastern person happens to be thousands of years old.

All over the world, people spend their whole lives being shit on, and hardly react at all. (e.g. Americans 230 years ago took up arms over trifles that are routinely tolerated today.) The middle easterner has no more (or less, I'll grant you) to be angry about than the average citizen of the world. Everyone is covered in shit.

There's something else going on with the middle east, beyond "merely" being shit on.

Re:Dealing with symptoms

[Attila Dimedici]

I think that your reading of the causes of terrorism are seriously flawed. Your premise is that there are many Muslim terrorists because Muslims have been oppressed both by their fellow Muslims and by others(Europe, U.S., etc)for centuries. If Europe and the U.S. pull out of the Middle East, why do you think this would change, since you admit it was occurring before the Europeans became involved?

Re:Dealing with symptoms

[dragonturtle69]

The AC's post is correct, especially if the locations and race are removed from it. You proved a point that is, and will still be, missed by most; religion gives the extremist belief in life after their death but not cause for giving harm. The happy religious are no more likely to go blowing up stuff than the happy irreligious. They are no different from anyone else with strongly held beliefs of being right or just.

Two quotes from the Wikipedia on McVeigh:

He was picked on by bullies at school,[2] and took refuge in a fantasy world in which he retaliated against them; he would later come to regard the U.S. Government as the ultimate bully.[3]

McVeigh believed the universe was guided by natural law, energized by some universal higher power that showed each person right from wrong if they paid attention to what was going on inside them. He said, "Science is my religion."[14]

So, was it feeling unjustly oppressed that led to the explosion, or the some voice in his head?

Then again, how is terrorism defined in this discussion? The street gangs definitely deal in terror. That is how they control. Maybe there are quite literally a few million terrorists among us, and one just doesn't get the "terrorist" moniker until a triple digit body count.

Re:Dealing with symptoms

[Medievalist]

McVeigh was hobnobbing with violent Christian racists, so I wouldn't put too much credence in that "science is my religion" quote. Those sort of people tend to have pretty weird definitions of "science" (read any racist web page for examples).

But other than that, yeah, several good points you've got there. If you look at peoples' behavior during blackouts and the aftermath of natural disasters, it's pretty hard not to conclude that there are millions of people among us whose sociopathic tendencies are only held in check by their fear of retribution. As soon as police and community restraints are released, a lot of people start acting like murderously insane monkeys.

Re:Dealing with symptoms

[Jansingal]

>>Joe Sixpack has _no clue_ about how American policy in the Middle East is perceived and sara palin has even less of a clue!

Crazy people ARE safe!

[fotakis]

"Since 9/11, much has been given up in the name of terrorism, and that has been personal privacy and security. Schenier asks, has it been worth it? " The United States is slowly resembling one of those padded rooms....

Apply within.

[Ostracus]

"The reality is that security is not something you can buy; it is something you must get.""

WANTED: One security professional who knows what the hell they're doing. Please apply at the door.

Re:10

[Penguinoflight]

If you don't understand that you can post the name of the 3-letter agency while using an anonymous account, you can't be much of a cryptographer.

No bias at all, none what so ever

[Anonymous Coward]

Schneier and I are both employed by the same parent company

[X] Brownnosing in progress

[ ] Fair and balanced book review

I've always wondered how often a single article could contain the words "Bruce Schneier", and you have just met my wildest expectations/p

Bruce Schneier doesn't write books.

[Timosch]

He simply decrypts the truth.

Save 30-70% on used Bruce Schneier books

[misterjava66]

http://www.betterworld.com/list.aspx?SearchTerm=Bruce+Schneier

and save the planet while you save your a**

http://www.betterworld.com/custom.aspx?f=impact :-)

Who cares?

[sjhalasz]

It doesn't do much good to point all this out. Security theater serves the interest of people who make the decisions and real, effective security does not. How do you make decision makers care about effective security? I don't know. Decision makers are almost entirely immune from the consequences of their decisions.

Re:10

[mcgrew]

So you give it a two?

Not just about security - about everything

[bradgoodman]

Everything works like this - not just security.

People responsible for things like airport security are ultimately bureaucrats. They are not experts, nor do they have the time or attention to get down to brass-tacks. The only thing they can do is throw money at the problem.

This how everything works from Airport Security, to product development and Q/A, to passing Financial Bailout legislation.

People who are in-charge of things often are 'executives' - meaning that they oversee a "big picture". These are usually people who are not experts in specific areas.

People who are experts in specific areas will rarley have 'executive' position (I use the work "executive" literally - meaning high-level overseers).

Example: a brilliant scientist spends his entire life solving equations, coming up with theories, designing and building rockets. He/she is revered in his/her work and excels, and is well know. Does this person will ultimately become a "lab fellow", or a "tenured professor", etc. etc. etc, they will not generally become the head of NASA. These are different positions, and different skillets. The "big-picture" guys are always the "political" ones. Mitt Romney would become the head of NASA before a scientist like I mentioned. And it that scientist were offered the position - their heads would be too into mathematical formulas and rocket designs to ever shift gears and worry about budgets and crap.

So the system is set up such that those at the help are the executives, not the experts.

Executives don't know any better than to react - It's only the experts that really think proactively - because that's what they do. Furthermore, executives (like in the TSA) aren't really hired to "make us safe" - they're hired to "make us feel safe".

I've been saying this for 20 years: "If we were serious about airport security, we'd do what they do in Israel". Their security is incredible, and obviously not the work of a pencil-pushing bureaucrat. They're security was obviously devised and executed by people who were heavily, heavily invested in and dedicated to it - on both professional and very personal levels. Israeli security would never take the crap that we do and call "security". 9/11 would never have taken place there for more reasons than I could count.

This is why after after Richard Reed tried to ignite an explosive in his left brown leather loafer, the TSA now mandates that everyone remove their left brown leather loafer for inspection.

If the TSA was serious, they'd make Bruce the head.

Re:Not just about security - about everything

[tjstork]

Example: a brilliant scientist spends his entire life solving equations, coming up with theories, designing and building rockets. He/she is revered in his/her work and excels, and is well know...they will not generally become the head of NASA..

You mean like Dr. Werner Von Braun? He may not have been the head of NASA, but he certainly played a leadership role in the early american space efforts.

Executives don't know any better than to react - It's only the experts that really think proactively - because that's what they do. Furthermore, executives (like in the TSA) aren't really hired to "make us safe"

You can't ever be safe, that's the point. We're in an age where the offensive weapon is so far ahead of defenses that really no physical asset can actually be protected from a determined attacker. The best you can do is maybe guarantee that the attacker is killed and hope that it is a sufficient deterrent, but you aren't going to defend every aircraft, car, bridge, or pipe from every possible threat. You really can't.

To some extent, the illusion of security is all we will ever have until technology of defense catches up - either in better materials for passive defenses, better detection of smuggled weapons, and so forth.

Re:Not just about security - about everything

[mollymoo]

Example: a brilliant scientist spends his entire life solving equations, coming up with theories, designing and building rockets. He/she is revered in his/her work and excels, and is well know. Does this person will ultimately become a "lab fellow", or a "tenured professor", etc. etc. etc, they will not generally become the head of NASA

The current NASA Administrator, Michael D. Griffin, was a working physicist and engineer. He does have an MBA, but he also has six engineering-related degrees. Obviously he has management experience too - you don't get NASA Administrator as your first management job - but the guy has more than enough engineering experience and credentials to know know exactly what his engineers are talking about.

I do take the point about non-technical management, but it's a long way from being a universal truth.

Re:There's only ONE way to get security: JESUS CHR

[mcgrew]

Damn it, who modded me up? Somebody please mod that comment down!

Think like a bad person

[Rastl]

I write code to do stuff. That's generic enough for me to continue.

When I write my code, I sit back and try to think of how people are going to try to get around the restrictions, do things they shouldn't do, etc. In other words, I think like a 'bad guy'.

I can't guess everything but if I can weed out the obvious stuff then I'm well on my way to making things that aren't going to have the security value of tissue paper, I hope.

It's kind of the equivalent of installing the best deadbolt made. On a hollow core door. You have to think it through or your dubious 'security measure' isn't all that secure.

Getting security...

[Chris Burke]

"The reality is that security is not something you can buy; it is something you must get."

*sigh* Fine, make me do things the hard way. Who do I get security from, and how much will they charge me?

What do you mean I don't get it? Is my money not good around here?

Re:Getting security...

[liquiddark]

Don't mind the whooshing sound above your head, sir. Now if you'll step inside my tent, I have some oil from a number of famously secure slithering reptiles.

Re:STFU

[mcgrew]

Is that you, Mr. President? ;)

Amen!

[certain death]

Preach on Brother Bruce!! I don't know how many times I have heard a "C" level person say something like..."So, once we buy XYZ product, we will be secure, Right?" It makes me cringe!!

Re:There's only ONE way to get security: JESUS CHR

[DaveV1.0]

Second the bible doesn't say when life begins.

Actually, the bible lists when life begins, but none are consistent with each other. It lists when blood forms, when the mother first feels movement, and others.

What is not listed in the bible is anything about abortion. The closest thing I have seen listed is a miscarriage caused due to injury to a bystander of two men fighting.

Re:The thesis is a joke...

[tjstork]

There are foreign troops occupying their land.

Oh, you mean in Egypt? Saudi Arabia? Iran? Please, show me the foreign troops in Iran...

It's a b.s. excuse from a b.s. people that can't own up to being stupid. No wonder Obama wants to make nice with all of his buddies... liberals are just like radical islamics - no matter how much money you throw at them, they will be whining about how they are victims... when really, they are just lazy.

Re:There's only ONE way to get security: JESUS CHR

[DaveV1.0]

The athiest couple quickly put on a pair of black robes and hoods. They then exit the house, and run into the street, where a Christian is nailed to a large, wooden X. He is being burned alive. A crowd of athiests stand around him, all wearing black robes and hoods.

RANDOM ATHIEST: Damn you, Christian! We hate you! We claim to be tolerant of all religions. But we really hate your's! That's because we athiests are hypocritical like that! Die, Christian!

Funny, that sounds like Christianity from about 500CE to 1700CE. You remember such things as witch burnings, the inquisition, forced conversions, the crusades, the murders of "heretics", etc.

The fact is that nothing you posted has anything to do with being atheist, but some of it is a very good reflection of how theists have behaved in the past and continue to behave in the present.

Take yourself for an example. I have no doubt you would murder every single person who would not convert to your particular flavor of religion and believe you are justified in doing so because you did it in the name of your god. And, you would expect to go to heaven because you repented after doing so.

ondigo

[ondigo]

"...violates a basic unwritten rule, that the government should be granted only limited powers, and for limited purposes."

Sadly, that's not an unwritten rule. It is, in fact, the 10th amendment. So that just makes it an ignored rule.

Re:The thesis is a joke...

[Jherek Carnelian]

How on earth can the middle east feel powerless when it is sucking a trillion dollars of oil money a year out of the western world?

Because >99% of those trillions go to 1% of the population?

Yeah, safe and un-free!

[k1e0x]

"Much of the security carried out in the name of 9/11 has proven to be infective in the seven years since the attack."

That is right and we can know this for certainty because if we believe Bush and his rhetoric that "Hundreds of terrorist plots have been stopped and the terrorists have been arrested" ..then where are the hundreds of trials? If there are no trials, or these plots are military "detainees" (read: "legally not prisoner"). Then why do we need civilian airport checks if civilians are not being arrested?

This HAS to be security theater, it is the only answer. Giving up your rights will not make you secure.. it will just change the threat from one thing to another. In this case you are simply moving the threat of terrorism to the threat of tyrannical state powers. Both are real. The threat of state power is much greater. You see.. our current government is "attempting" to use these powers for good.. they want to protect us.. but that government will not always be the same.. Some day we may see an administration elected that will use these expanded powers for bad things.. it's only a matter of time.

Not so fast Mr. Funny Guy

[xant]

GP is clearly a troll, but you're wrong about Anonymous. Slashdot logs anonymous posts. If a TLA agency came after them, Mr. AC wouldn't be Anonymous for very long.

Re:Not so fast Mr. Funny Guy

[MichaelSmith]

Three Letter Acronym

Re:Not so fast Mr. Funny Guy

[MikeBabcock]

Any TLA agency worth its salt logged his posting the moment it was submitted and doesn't need Slashdot's logs.

Most Fortune 500's would be in that "monitor everything" list too, and you could always consider running an SSH or other VPN tunnel to your home LAN for your Internet browsing needs like I do when necessary (hotels and other public networks). This assumes you have good physical and logical control of the operations of your computer of course.

Re:Looks like Kelsey Grammar only with more forehe

[Jansingal]

why did you reply to such a dtupid posting. guy is an idouit for such a comment.

Re:The thesis is a joke...

[Anonymous Coward]

Iran? Is that the country that the CIA lead an organized coup which toppled the secular democratically elected government in the 70's?

Security's something one can get bribes for buying

[D4C5CE]

There is a perception in both the private and government sector, that security, both physical and digital, is something you can buy.

More importantly, it is something that can be made expensive and trumpeted by the salesman's three best friends of Fear, Uncertainty and Doubt - leaving ample room to "reward" some of those who get to decide on spending the money of other people who cannot assess the value and actual benefit of their purchases.

Re:The thesis is a joke...

[Stormwatch]

Reminds me of that joke... on a trip to France, a sultan buys some masterpieces from a fine art gallery, then says: "Alright, got the postcards. Time to go buy the souvenirs!"

Ahem...taken from the last Crypto-Gram:

[I)_MaLaClYpSe_(I]

The Seven Habits of Highly Ineffective Terrorists

[...]

Conventional wisdom holds that terrorism is inherently political, and that people become terrorists for political reasons. This is the "strategic" model of terrorism, and it's basically an economic model. It posits that people resort to terrorism when they believe -- rightly or wrongly -- that terrorism is worth it; that is, when they believe the political gains of terrorism minus the political costs are greater than if they engaged in some other, more peaceful form of protest. It's assumed, for example, that people join Hamas to achieve a Palestinian state; that people join the PKK to attain a Kurdish national homeland; and that people join al-Qaida to, among other things, get the United States out of the Persian Gulf.

If you believe this model, the way to fight terrorism is to change that equation, and that's what most experts advocate. Governments tend to minimize the political gains of terrorism through a no-concessions policy; the international community tends to recommend reducing the political grievances of terrorists via appeasement, in hopes of getting them to renounce violence. Both advocate policies to provide effective nonviolent alternatives, like free elections.

Historically, none of these solutions has worked with any regularity. Max Abrahms, a predoctoral fellow at Stanford University's Center for International Security and Cooperation, has studied dozens of terrorist groups from all over the world. He argues that the model is wrong. In a paper published this year in International Security that -- sadly -- doesn't have the title "Seven Habits of Highly Ineffective Terrorists," he discusses, well, seven habits of highly ineffective terrorists. These seven tendencies are seen in terrorist organizations all over the world, and they directly contradict the theory that terrorists are political maximizers:

Terrorists, he writes, (1) attack civilians, a policy that has a lousy track record of convincing those civilians to give the terrorists what they want; (2) treat terrorism as a first resort, not a last resort, failing to embrace nonviolent alternatives like elections; (3) don't compromise with their target country, even when those compromises are in their best interest politically; (4) have protean political platforms, which regularly, and sometimes radically, change; (5) often engage in anonymous attacks, which precludes the target countries making political concessions to them; (6) regularly attack other terrorist groups with the same political platform; and (7) resist disbanding, even when they consistently fail to achieve their political objectives or when their stated political objectives have been achieved.

Abrahms has an alternative model to explain all this: People turn to terrorism for social solidarity. He theorizes that people join terrorist organizations worldwide in order to be part of a community, much like the reason inner-city youths join gangs in the United States.

The evidence supports this. Individual terrorists often have no prior involvement with a group's political agenda, and often join multiple terrorist groups with incompatible platforms. Individuals who join terrorist groups are frequently not oppressed in any way, and often can't describe the political goals of their organizations. People who join terrorist groups most often have friends or relatives who are members of the group, and the great majority of terrorist are socially isolated: unmarried young men or widowed women who weren't working prior to joining. These things are true for members of terrorist groups as diverse as the IRA and al-Qaida.

For example, several of the 9/11 hijackers planned to fight in Chechnya, but they didn't have the right paperwork so they attacked America instead. The mujahedeen had no idea whom they would attack after the Soviets withdrew from Afghanistan, so they sat around until they came up with a new enemy: America. Pakistani terrorists regularly defect to another terro

and the other shoe drops

[khallow]

So this is why Schneier was in the news so much over the last few days. I figured it was the case, but I didn't bother to get it on the record. My take here is that Schneier talks a good game, but he's fond of making blanket statements. For example, the claim that there's no point to quantum encryption even though not everyone is vulnerable to social engineering and not every party can exploit social engineering equally well.

Re:and the other shoe drops

[Jansingal]

the reason he gives short answers to the media is that is all they can handle.

Re:The thesis is a joke...

[mollymoo]

Please, show me the foreign troops in Iran...

None there just now, but what about the US-sponsored and supplied Iraqis a couple of decades ago? There was some direct fighting between US and Iranian forces in that conflict too. Right now, the USA is occupying Iraq to the West and Afghanistan to the East. They also have bases in Saudi Arabia, Turkey and Kyrgyzstan and are propping up the regime in Pakistan. So, Iran is pretty much surrounded by US influence and the US has declared them to be evil and made demands with an implicit threat of force.

If someone fucked with my country that much, I'd be trying to kill the fuckers too.

Re:There's only ONE way to get security: JESUS CHR

[mollymoo]

I've seen this troll before and the only reason I'm responding is to point out that Christians don't troll although some people who pretend to be Christian do.

Oh yes, no true Scot^H^H^H^HChristian would ever do that.

Then what about the Jewish terrorists?

[mangu]

To make a long story short, if we gave autonomy to the Middle east (Oil supplies be damned!), meaning pull out completely. I think terrorism would stop or at the very least, decrease dramatically.

So, abandoning Israel would be a solution, in your point of view? Well, this might come as a surprise to you, but the Jews in Israel had armed groups defending themselves *before* the state of Israel came into existence.

If, in your words, "Terrorism is a symptom of very desperate people who feel that they're being shit on by someone", then if you shit on Israelis they will automatically become terrorists.

A simple look at Google Earth will show the Arab-Israel border by the color of the land, Israel is greener than its Arab neighbors. If I were given the power to decide who should live on that land, I would give it to the people who treat the land better. The Arab Muslims won the biggest lottery on earth, in the form of a few trillion dollars in oil. If they cannot separate the tiniest amount of that enormous wealth to help a few million Palestinians, while Jews around the world have contributed so generously to Israel, let the Israelis have that land, they have earned it.

No, your solution to the terrorist problem is both unjust and ineffective.

Re:The thesis is a joke...

[_Sprocket_]

Fair enough point. But let's keep some perspective.

None there just now, but what about the US-sponsored and supplied Iraqis a couple of decades ago?

Iraq got a lot more support from the French and Soviets during that time period than the US. Iraq was hardly a proxy for US action in the region. Although it was a natural choice to counter expanding Iranian influence. Iran had already set the tone with the US (although the US' involvement in pre-revolutionary Iran was a mistake).

There was some direct fighting between US and Iranian forces in that conflict too.

Certainly - after Iran had attacked US interests in the region. The US counter-attacked. Let's not make it appear that the US was involved in the Iraq-Iran War.

Right now, the USA is occupying Iraq to the West and Afghanistan to the East. They also have bases in Saudi Arabia, Turkey and Kyrgyzstan and are propping up the regime in Pakistan. So, Iran is pretty much surrounded by US influence and the US has declared them to be evil and made demands with an implicit threat of force.

Keep in mind that before the US declared Iran as a member of the "Axis of Evil", Iran declared the US "The Great Satan." There's a lot of finger-pointing going on. And that's lead to a lot of saber rattling. I do, however, agree that this Administration has done more rattling than required.

Why care about terrorists..

[chord.wav]

Why care about terrorists when a company or bank CEO can do much more damage to much more people?
Are those beign blacklisted too? Just because they don't grow a beard doesn't mean they aren't dangerous...

Risk

[starfishsystems]

It's called transferring risk.

Absolutely. And insurance is the classic mechanism for transferring risk. Schneier develops this idea extensively in "Secrets and Lies."

An insurance policy coverts a set of risks into a fixed expense for a period of time. It can do so even when those risks are due to events outside your control. You cite some great examples.

But insurers may charge a higher fee for unmitigated risk, or they may not agree to underwrite the risk at all if mitigations are not performed. For example, here in my apartment building we have to perform annual fire inspections or we don't get to renew our insurance. Schneier predicts that this kind of pressure is what will ultimately create change in the information security space.

So what are those specific mitigations? Well, they are the ones which actually decrease risk. The insurance industry has no interest in security theatre, it wants the real thing, because its profitability is directly linked to getting security right.

In practice, you, as the insured party, will have to demonstrate that you have applied appropriate mitigations. The wrinkle here is that, where effective security is concerned, what is appropriate for you is not necessarily appropriate for someone else. This is what Schneier means about not being able to buy security.

The statement is not such an exercise in hyperbole as you might think. It's very hard to fix bad security if it's part of your core processes. Yes, you can pay for security consulting services, and I think you're absolutely right, those services will rarely be effective without accompanying education. Otherwise, people fall back to their old ways.

But I'd argue that education itself is not enough either. It's equally important, and difficult, to design human and machine processes to be secure by default, and to have well defined roles, effective identity, effective containment, and so on for progressively relaxing that default. To apply the obligatory car analogy, we have to educate people to drive on the righthand side of the road, but we should not also put the ejector seat button next to the stereo. If there is no button, the question of when to push it never comes up.

But organizational processes vary greatly from one organization to the next. Maybe your organization is more analogous to a fighter aircraft than a car. Maybe it needs that ejector seat. You've got to be at least willing make that determination. Get help, but take on that responsibility. That's what Schneier means, I think, by "getting" security.

I agree, the real educational effort should go toward reducing the number of stupid ideas that get proposed in the first place. In other words, it has to be pervasive, and in hierarchical organizations, that means it has to travel from the top down. I predict that will start to happen the instant there's a fiscal impact, for example, higher insurance premiums. But for now, as long as the senior people are not educated about security, there will continue to be a lot of downloading and blaming, and not a lot of effective transformation.

Re:The thesis is a joke...

[grcumb]

Keep in mind that before the US declared Iran as a member of the "Axis of Evil", Iran declared the US "The Great Satan."

Another lovely phrase lost in translation. Ayatollah Khomeini labeled the US the great 'Shaitan', referring to a particular manifestation of the Devil: the Tempter.

Specifically, he meant that US culture was tempting the people of Iran into decadence and materialism. That's evil, to be sure, but not generically Evil.

Iran has been fighting a low-grade dirty war against the US and Israel since the 1980s. They have sponsored many of the most effective guerrila and terrorist organisations in the region and in the world. Their goal is definitely to reduce US influence in the region in order to allow fundamentalist Islamism to spread. In that sense, they are most definitely a threat that, occasionally, requires an armed response.

That said, nobody's interests are served when we speak in broad terms, deliberately mischaracterising the nature and the scope of the threat. It's generic terms like 'Evil' that make it difficult to engage the other levers that the US (and other nations) could usefully bring to bear on Iran to reduce the threat they present.

Diplomacy, economic engagement - both positive and negative - as well as armed deterrence all play a role. But as long as Iran is just plain old Evil, offensive measures are the only ones palatable to otherwise uninformed American voters.

Constitution Inherently, Explicitly Limits G'vment

[Doc Ruby]

Another recurring theme throughout the book is how the Bush administration has little by little eroded the Constitution, all in the name of fighting terrorism. Schneier notes that the brilliant framework the founding fathers created by creating divisions of power (executive, legislative, judicial) with checks and balances violates a basic unwritten rule, that the government should be granted only limited powers, and for limited purposes. Since there is a certainty that government powers will be abused.

The Constitution doesn't violate the basic unwritten rule that the government should be granted only limited powers, and for limited purposes.

The 10th Amendment clearly wrote that "unwritten rule":

The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people.

The rest of the Constitution is perfectly consistent with that written rule, though the 10th Amendment does make it explicit, as seemed prudent to those who wrote and ratified the Bill of Rights so there'd be no doubt that the Constitution protected those rights.

I don't really know what that paragraph I quoted from this review is even supposed to mean. Nor have I read this latest book by Schneier. But I also have read much of Schneier's writings over the past decade plus, including some of his other books (yes, starting with _Applied Cryptography_), and even some direct email correspondence, and I do not believe that Schneier says that the Constitution violates an unwritten rule of limited government. Schneier knows as well as anyone that the Constitution is the exemplar document of inherently limited government, as the Constitution itself says, which is such rock solid conventional wisdom that it's a cliche.

Re:Nonsense

[sarkeizen]

The author has absolutely no data to back up his claims

Not really.

Just a few tidbits from the original paper. The author looked at the data collected by RAND and found out that since 1968 - 64% of Terrorist Acts Worldwide are Anonymous.

There's a lot of stuff about these organizations being politically diffuse. For example Bin Laden's fatwas throughout the 1990's were primarily aimed at Muslims! It was only in 2001 that he talked about the US. The author cites quotes from members of Al-Qaida criticizing their own lack of direction.

The author also cites Abrams study on the success rate of political change. Which is prety bad..of twenty-eight randomly selected cases the success rate was zero.

Other stuff on how terrorism isn't being used as a "last resort" to political ends.

If terrorism is actually about gaining political change then the people involved are doing so in a very inefficient way. Even to the point of giving up gaining most of their own stated political goals.

So you have two choices here: Terrorists are irrational or they are rationally pursuant of a different goal than political change.

The author supplies a goal that better fits the data (the given data anyway) than the idea of "political change"

Re:The thesis is a joke...

[tjstork]

None there just now, but what about the US-sponsored and supplied Iraqis a couple of decades ago?

The operative phrase is... a couple of decades ago. You know, we could go back pretty far and discover that Islam was a simple Saudi religion that forcibly occupied the rest of the middle east.

There was some direct fighting between US and Iranian forces in that conflict too

Yeah, and let's call that for what it was. The Iranians tried to close the gulf to all foreign shipping in an attempt to bully its neighbors into supporting it. The USA sent in the Navy to force the gulf back open and the Iranians tried to fire on it. As a result, the USA sank a bunch of Iranian stuff and then accidentally shot down a civilian airliner which, of all intelligent things, the Iranians flew into a middle of a war zone during the fighting.

Right now, the USA is occupying Iraq to the West and Afghanistan to the East.

Iraq was in a functional state of war against the USA and the USA finished it. Saddam should not have invaded Kuwait in 1991 but he really should not have seized a part of Saudi Arabia in 1991 - once he did that the USA had carte blanche to do what it will with Iraq.

Afghanistan attacked the United States, repeatedly.

They also have bases in Saudi Arabia, Turkey and Kyrgyzstan and are propping up the regime in Pakistan.

There are no US bases in Saudi Arabia.

Turkey is a NATO ally as they have a huge Russia problem and have had one for well, 500 years. Kyrgystan we've bought off fair and square, but alas, they also have a Russia problem.

Pakistan just held elections, and threw Musharraf out, so maybe you should check the news.

If someone fucked with my country that much, I'd be trying to kill the ..... too.

See, there are people, liberals ARE backstabbing the USA on the war and on the economy...and they've been successful enough to create this coup they are headed for in November. It's just like how the socialists caused Germany to lose World War I. When you read stuff like that, its really actually not too paranoid to think that the economic crisis and military shortfalls of the USA were deliberately engineered by the left wing solely to attain power.

Re:The thesis is a joke...

[tjstork]

Another lovely phrase lost in translation. Ayatollah Khomeini labeled the US the great 'Shaitan', referring to a particular manifestation of the Devil: the Tempter.

You know what, that's a bunch of BS. The Iranian leadership isn't stupid and never has been. The fact of the matter is that they throw out incendiary stuff all the time and then blame it on the translation. I would think that after 30 years of this crap they would hire someone who can actually translate. But, its not.

I mean, I think that, Great Satan is pretty much what they meant, burning US flags and all.

What I'm saying is, the moment Iran drops the bomb outside of its soil, kill them all.

Security Breeches Are About Motivation

[dma1965]

Pharmaceutical companies are currently dealing with trying to implement ePedigree, which is supposed to stop the flow of counterfeit drugs (currently about a $35 Billion/year problem).

I have literally had insiders tell me that security is not even on the table in considering what needs to be done to implement ePedigree. They are concentrating on things like cost of RFID tags, speeds of readers, databases, etc.

While these are indeed valid considerations, I have pointed out on numerous occasions that they are dealing with a huge criminal force who have armed themselves with some very good hackers and who can easily afford to pay these same hackers to break the ePedigree systems. I have shown them how easily some of the RFID tags they have chosen can be cloned, and pointed out several weaknesses along the entire chain, and they simply stare at me with blank looks on their faces and tell me that they are sure their IT department will deal with the security issues if any should come up.

The sad reality is that the ePedigree is mandated by the government, and there is no security requirement, so they are simply looking to implement this very costly system at a bare minimum. What they do not know (and perhaps do not care to know) is that the weak security in the implementation will actually create a worse situation than currently exists for these companies, will actually make it EASIER for counterfeiters to get their products into the market, and will create new subversive business models.

Security exploitations are driven by motivation. Some are motivated by curiosity, some by vindictiveness, and others by greed. Greed is perhaps the biggest motivator of all.

Hopefully I will not have to deliver the "I told you so."

Re:There's only ONE way to get security: JESUS CHR

[mcgrew]

A Scotsman is someone who is born or lives in Scotland. If you're a Scotsman, the only way to NOT be a Scotsman is to emmigrate, and even then it can be argued you are still a Scotsman. A TRUE Scotsman. To argue that someone born in Scotland and lives in Scotland is not a "true" Scotsman is a fallacy. It's like some right winger saying "A REAL American would not argue that we should be in Iraq". It is a fllacy.

Being a Christian is a choice, more like being a Democrat. It is not the same.

Re:There's only ONE way to get security: JESUS CHR

[mollymoo]

The point is that you do not get to decide whether someone else is a Christian any more than you get to decide whether they are a Scotsman, they get to decide if they are a Christian. Even imperfect Christians are still Christians, aren't they?

Re:There's only ONE way to get security: JESUS CHR

[mcgrew]

Well that's the thing, Christians ren't perfect, they're saved. But if you see a guy kneeling before a golden calf you can be pretty sure he's not a Christian, no matter what he says.

A lot of people go to church to be seen by others and be percieved as Christains by other people, even though they don't really believe in God.

"You cannot serve both God and mammon" but how many people claim to be Christians while worshiping money? If I see someone deliberately harming another person you're going to have a hard time convincing me he's a Christian.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:The thesis is a joke...

[_Sprocket_]

Another lovely phrase lost in translation. Ayatollah Khomeini labeled the US the great 'Shaitan', referring to a particular manifestation of the Devil: the Tempter.

Specifically, he meant that US culture was tempting the people of Iran into decadence and materialism. That's evil, to be sure, but not generically Evil.

I wouldn't be so quick to down-grade the meaning of the phrase. Your explanation makes it all sound like a mere difference in opinion. The label has a lot more power than that.

We're not just talking about culture. It was definitely a reference to US geopolitical involvement in the region as well. Anyone who disagrees with US policy is quick to label such involvement as meddling.

Although I think you do make a very important point; culture is the subtle issue. US influence goes beyond oil companies and military presence. It is also Baywatch. And in some eyes, that is just as much an affront as anything else that comes out of the United States.

I would also note - Satan is Satan under any other name. The mythology is the same. I don't know enough about Iranian culture to understand any subtle differences in how the mythos impacts the culture. But I would imagine it isn't all that different than how it impacts US culture. Both view the myth as a derogatory figure; one that is, ultimately, evil. I see little difference between the rhetoric of the US and Iran.

Diplomacy, economic engagement - both positive and negative - as well as armed deterrence all play a role. But as long as Iran is just plain old Evil, offensive measures are the only ones palatable to otherwise uninformed American voters.

I find myself both agreeing and disagreeing. And it seems the pivotal reason is the man who delivered the speech. If it had come from a leader that inspired more trust, who didn't portray overly simplistic views, who didn't present an uncomfortable stubborn disregard for fact... I would also find myself generally supporting the concept of an "Axis of Evil." It certainly fits the behavior of those named. But I do agree that it is much too blunt and unwieldy a political weapon to be brandished about by the likes of this Administration.

Re:The thesis is a joke...

[chuck]

If someone fucked with my country that much, I'd be trying to kill the fuckers too.

There are two groups fucking with your country that much. They are Republicans and Democrats. I say you and me let's get started killing the fuckers.

Re:The thesis is a joke...

[mollymoo]

The Republicans and Democrats are fucking with the UK a little bit, but not nearly enough to make me want to kill the fuckers.

Re:The thesis is a joke...

[chuck]

Haha, USA bias FTL. My bad. I'll have to find one of my countrymen to kill the fuckers then.

Re:The thesis is a joke...

[tjstork]

Iran? Is that the country that the CIA lead an organized coup which toppled the secular democratically elected government in the 70's?

No, the CIA did that in the 1950s, you know, half a century ago. So, should we still hate the Germans for World War II? The Iranian coup was only a couple of years after that?

Re:There's only ONE way to get security: JESUS CHR

[DragonWriter]

The point is that you do not get to decide whether someone else is a Christian any more than you get to decide whether they are a Scotsman, they get to decide if they are a Christian.

I would say that's not the point at all. The "no true Scotsman" fallacy isn't really a distinct fallacy, its either a case of circular argument or equivocation. If there is an agreed upon definition of "Scotsman" that applies to the given discussion, its perfectly legitimate to point out that an trait asserted to be associated with at least some Scotsmen is, in fact, inconsistent with that definition and thus, no true Scotsman has that feature.

Where it becomes problematic is:
1) Where no such definition exists, and the proposition being debated is precisely whether or not the trait involved is a trait of at least some "Scotsmen". In this case, its something of a circular argument, but it also can reveal that a fundamental problem in the discussion is the ambiguous definition of terms.
2) Where such a definition does exist (or at least, where a different definition of "Scotsman" is being used in the discussion), but the definition which excludes the trait from any "true Scotsman" is a different definition of Scotsmen. In this case, the fallacy is one of equivocation.

The principle problem that usually arises with "no true Scotsman" style arguments is where the person using them is making an argument that is trivially true for some definition of "Scotsman", but where the real interest in the discussion is in a different definition (or where, simply, the difference in definitions isn't that one is the "more interesting" one for the discussion, but instead just reveals that the participants are talking past each other about two or more completely different things.) It is not that one definition is necessarily objectively correct; there are many different, legitimate definitions of many terms ("Christian", for instance, can usefully defined by self-identification, by adherence to particular belief sets, or by participation in particular groups, and for each of those there are places where those are interesting and useful definitions), the key is that in a discussion, to be productive, people have to be applying the same definitions to the same terms.

Schneier greatly overestimates himself

[crucini]

I have great respect for Schneier as a computer security expert. Applied Cryptography was wonderful. But Schneier errs in thinking that physical security is the same thing as cyber security, and that his computer/crypto expertise somehow extends to the physical world.

A lot of geeks share Schneier's fallacy. And since geeks tend to be a lot smarter than the folks in charge of real-world security, the tendency to false superiority is magnified. But intelligence is not the whole story. There is also experience and instinct.

Some of the key differences:

• In the real world, security through obscurity often works. And is often the only way to achieve a goal.
• In the real world, any security measure which causes an attacker to make an extra move, or expend extra resources, is useful.
• In the real world, there are no perfect barriers; there aren't even any strong barriers. All barriers are just speed bumps.

If Schneier (or any computer geek) were in charge of airport security, I'm pretty sure we would have had another terrorist incident since 9/11.

Re:Schneier greatly overestimates himself

[Jansingal]

do you have anything, any source, whatsoever to back up anything you have written?

Re:Constitution Inherently, Explicitly Limits G'vm

[fritz47]

I think the reviewer accidentally typed in the wrong word. Instead of saying that the balance of powers and checks and balances etc violate the unwritten rule that government power should be limited, he meant to say that these features of the Constitution *validate* the unwritten rule ... (or 'give expression to', or 'implement' or 'serve' - but I try to think of a word looking a bit like 'violate' to figure out how he got to it) The 10th amendment reserves power to the states or the people, but does not necessarily limit government (since the states have governments too!)

Re:Constitution Inherently, Explicitly Limits G'vm

[Doc Ruby]

Perhaps they typed a "braino".

The 10th Amendment does limit government, by referencing the set of powers not assigned to either the United States, or to the several states, which are assigned to the people. There is no other category. It also carves out the niche for states' powers, by establishing the basis for explicit Federal limits to them, but again only as explicit. That brief formulation makes clear that the Federal government's powers, even when powers over the states, exist only where explicit. That is an express basis of inherently limited government. As opposed to inherently unlimited government that would be limited by law, which was the model for governments (eg. unlimited monarchies reined in by laws) previously.

FWIW, the Constitution is scoped to only the Federal government, so its omission of limits on state governments is no indication of any lack of inherent limitation of "government" that might be exercised in a state. Your observation does indeed indicate, though, that states are not necessarily bound to the inherently limited government model. The Constitution does not say that a state cannot have a monarch. However, each state's constitution does mirror the Federal Constitution's formulas, AFAIK. But I suppose that if, say, Texas amended its constitution to produce a hereditary dynasty of "Bushes" who function as divine emperor, we'd have a really big, but legal, problem on our hands.