CRYPTO-GRAM
August 15, 2006
by Bruce Schneier
Founder and CTO
Counterpane Internet Security, Inc.
[email protected]
http://www.schneier.com
http://www.counterpane.com
** *** ***** ******* *********** *************
Last Week's Terrorism Arrests
Hours-long waits in the security line. Ridiculous prohibitions on what you can carry on board. Last week's foiling of a major terrorist plot and the subsequent airport security changes graphically illustrates the difference between effective security and security theater.
None of the airplane security measures implemented because of 9/11 -- no-fly lists, secondary screening, prohibitions against pocket knives and corkscrews -- had anything to do with last week's arrests. And they wouldn't have prevented the planned attacks, had the terrorists not been arrested. A national ID card wouldn't have made a difference, either.
Instead, the arrests are a victory for old-fashioned intelligence and investigation. Details are still secret, but police in at least two countries were watching the terrorists for a long time. They followed leads, figured out who was talking to whom, and slowly pieced together both the network and the plot.
The new airplane security measures focus on that plot, because authorities believe they have not captured everyone involved. It's reasonable to assume that a few lone plotters, knowing their compatriots are in jail and fearing their own arrest, would try to finish the job on their own. The authorities are not being public with the details -- much of the "explosive liquid" story doesn't hang together -- but the excessive security measures seem prudent.
But only temporarily. Banning box cutters since 9/11, or taking off our shoes since Richard Reid, has not made us any safer. And a long-term prohibition against liquid carry-on items won't make us safer, either. It's not just that there are ways around the rules, it's that focusing on tactics is a losing proposition.
It's easy to defend against what terrorists planned last time, but it's shortsighted. If we spend billions fielding liquid-analysis machines in airports and the terrorists use solid explosives, we've wasted our money. If they target shopping malls, we've wasted our money. Focusing on tactics simply forces the terrorists to make a minor modification in their plans. There are too many targets -- stadiums, schools, theaters, churches, the long line of densely packed people in front of airport security -- and too many ways to kill people.
Security measures that attempt to guess correctly don't work, because invariably we will guess wrong. It's not security, it's security theater: measures designed to make us feel safer but not actually safer.
Airport security is the last line of defense, and not a very good one at that. Sure, it'll catch the sloppy and the stupid -- and that's a good enough reason not to do away with it entirely -- but it won't catch a well-planned plot. We can't keep weapons out of prisons; we can't possibly keep them off airplanes.
The goal of a terrorist is to cause terror. Last week's arrests demonstrate how real security doesn't focus on possible terrorist tactics, but on the terrorists themselves. It's a victory for intelligence and investigation, and a dramatic demonstration of how investments in these areas pay off.
And what can you do to help? Don't be terrorized. They terrorize more of us if they kill some of us, but the dead are beside the point. If we give in to fear, the terrorists achieve their goal even if they are arrested. If we refuse to be terrorized, then they lose -- even if their attacks succeed.
New airline security rules:
http://www.schneier.com/blog/archives/2006/08/new_airline_sec.html
http://www.educatedguesswork.org/movabletype/archives/2006/08/threat_modellin_1.html or http://tinyurl.com/nxqe4
Getting inside the terrorists' heads (funny cartoon):
http://www.wondermark.com/d/220.html
The DHS declares an entire state of matter a security risk:
http://cosmicvariance.com/2006/08/12/liquid/
And here's a good commentary on being scared:
http://kfmonkey.blogspot.com/2006/08/wait-arent-you-scared.html
A version of this article originally appeared in the Minneapolis Star Tribune:
http://www.startribune.com/562/story/609687.html
August 15, 2006
by Bruce Schneier
Founder and CTO
Counterpane Internet Security, Inc.
[email protected]
http://www.schneier.com
http://www.counterpane.com
** *** ***** ******* *********** *************
Last Week's Terrorism Arrests
Hours-long waits in the security line. Ridiculous prohibitions on what you can carry on board. Last week's foiling of a major terrorist plot and the subsequent airport security changes graphically illustrates the difference between effective security and security theater.
None of the airplane security measures implemented because of 9/11 -- no-fly lists, secondary screening, prohibitions against pocket knives and corkscrews -- had anything to do with last week's arrests. And they wouldn't have prevented the planned attacks, had the terrorists not been arrested. A national ID card wouldn't have made a difference, either.
Instead, the arrests are a victory for old-fashioned intelligence and investigation. Details are still secret, but police in at least two countries were watching the terrorists for a long time. They followed leads, figured out who was talking to whom, and slowly pieced together both the network and the plot.
The new airplane security measures focus on that plot, because authorities believe they have not captured everyone involved. It's reasonable to assume that a few lone plotters, knowing their compatriots are in jail and fearing their own arrest, would try to finish the job on their own. The authorities are not being public with the details -- much of the "explosive liquid" story doesn't hang together -- but the excessive security measures seem prudent.
But only temporarily. Banning box cutters since 9/11, or taking off our shoes since Richard Reid, has not made us any safer. And a long-term prohibition against liquid carry-on items won't make us safer, either. It's not just that there are ways around the rules, it's that focusing on tactics is a losing proposition.
It's easy to defend against what terrorists planned last time, but it's shortsighted. If we spend billions fielding liquid-analysis machines in airports and the terrorists use solid explosives, we've wasted our money. If they target shopping malls, we've wasted our money. Focusing on tactics simply forces the terrorists to make a minor modification in their plans. There are too many targets -- stadiums, schools, theaters, churches, the long line of densely packed people in front of airport security -- and too many ways to kill people.
Security measures that attempt to guess correctly don't work, because invariably we will guess wrong. It's not security, it's security theater: measures designed to make us feel safer but not actually safer.
Airport security is the last line of defense, and not a very good one at that. Sure, it'll catch the sloppy and the stupid -- and that's a good enough reason not to do away with it entirely -- but it won't catch a well-planned plot. We can't keep weapons out of prisons; we can't possibly keep them off airplanes.
The goal of a terrorist is to cause terror. Last week's arrests demonstrate how real security doesn't focus on possible terrorist tactics, but on the terrorists themselves. It's a victory for intelligence and investigation, and a dramatic demonstration of how investments in these areas pay off.
And what can you do to help? Don't be terrorized. They terrorize more of us if they kill some of us, but the dead are beside the point. If we give in to fear, the terrorists achieve their goal even if they are arrested. If we refuse to be terrorized, then they lose -- even if their attacks succeed.
New airline security rules:
http://www.schneier.com/blog/archives/2006/08/new_airline_sec.html
http://www.educatedguesswork.org/movabletype/archives/2006/08/threat_modellin_1.html or http://tinyurl.com/nxqe4
Getting inside the terrorists' heads (funny cartoon):
http://www.wondermark.com/d/220.html
The DHS declares an entire state of matter a security risk:
http://cosmicvariance.com/2006/08/12/liquid/
And here's a good commentary on being scared:
http://kfmonkey.blogspot.com/2006/08/wait-arent-you-scared.html
A version of this article originally appeared in the Minneapolis Star Tribune:
http://www.startribune.com/562/story/609687.html
