Friday, January 16, 2009

Security expert Bruce Schneier - "We've forgotten that risk is an inherent part of life."

Hallelujah for common sense.

Bruce Schneier interviewed at Reason Online. In a wise, fair or just world, this guy'd head up the TSA and Homeland Security.

Great interview, more at the link.

Safe, But Also Sorry: Security expert Bruce Schneier talks about privacy and property in the information state - Reason Magazine:
"Reason: You coined the phrase "security theater" and you've been critical of the TSA's choices on priorities and tactics. What has the TSA done wrong that's fixable? What has the TSA done right?

Bruce Schneier
: The TSA focuses too much on specific tactics and targets. This makes sense politically, but is a bad use of security resources. Think about the last eight years. We take away guns and knives, and the terrorists use box cutters. We confiscate box cutters and knitting needles, and they put explosives in their shoes. We screen shoes, and they use liquids. We take away liquids, and they'll do something else. This is a dumb game; the TSA should stop playing. Some screening is necessary to stop the crazy and the stupid, but it's not going to stop a professional terrorist attack. We don't need more and better screening; we need less. On the other hand, I like seeing the direction they're heading in terms of behavioral profiling, though we need to be careful. Done wrong, it's nothing more than stereotyping; but done right, it can be very effective. It needs more focus on people and less on objects. We can't manage to keep weapons out of prisons; we'll never keep them out of airports. Oh, and stop the ID checking—the notion that there is this master list of terrorists that we can check people off against is just plain silly.

If I were in charge of the TSA's budget, I'd give most of it back. Politically, I wouldn't be able to, of course, but it would be the best thing to do. Spending money on airport/airplane security only makes sense if the bad guys target airplanes. In general, money spent defending particular targets or tactics only makes sense if we can guess them correctly. If tactics and targets are scarce, defending against specific ones makes us safer. If tactics and targets are plentiful—as they are—it only forces the bad guys to pick new ones. Spending money on intelligence, investigation, and emergency response is effective regardless of the tactic or the target. Airport security is a last line of defense, and not a very good one at that. We need to remember that at budget time.

...We live in a technological world, and it's common for us to believe that technology can solve our security problems. It solves so many of our other problems, so it's a plausible belief. It's also easier to believe that a shiny new piece of technology—a new ID card, a new airport scanner, a new face-recognition system—can solve our problems than boring old concepts like culture and economics. Admitting that technology isn't the answer is admitting that there isn't an answer that will solve the problem, and many people can't do that yet. We've forgotten that risk is an inherent part of life.

...The security vs. privacy dichotomy is a false one. Only identity-based security is in opposition to privacy, and there are limitations to that approach. I believe that approximately two security improvements since 9/11 have made airplane travel safer: reinforcing the cockpit door, teaching passengers they have to fight back, and—maybe—sky marshals. None of those measures has any impact on privacy. It's things like ID cards, and wholesale eavesdropping on telephone calls and Internet conversations, and large government databases that affect privacy, and their security value is minimal. The real dichotomy is liberty vs. control. There might be less crime in a society with strong government controls and police-state-like surveillance, but I don't think anyone would feel safer in that society.

...I consider myself a realist. Most people who say that are really pessimists, but I'm not. Most people are honest and trustworthy; society would fall apart if that weren't the case. Attacks are rare. Ten times as many people die each year in car crashes than did on 9/11, and the most dangerous part of an airplane journey is still the taxi ride to the airport.

Security is designed to protect us from the dishonest minority. It's important to remember that. I remember being told as a child: "Never talk to strangers." That's actually stupid advice. If a child is lost or scared or alone, the smartest thing he can do is find a kindly looking stranger to talk to. The real advice is: "Don't answer strangers who talk to you first." The difference is important. In the first case, the child selects the stranger—and the odds of him selecting a bad person are pretty negligible. In the second case, the stranger selects the child; that's more dangerous. I don't think that's either optimism to rightly point out that most people are honest, or pessimism to figure out how to best secure ourselves from the dishonest minority; it's analytical realism."

No comments:

Post a Comment