Schneier on Security
A blog covering security and security technology.
« Howard Schmidt on Software Vulnerabilities |
| Taser Cam »
November 8, 2005
Richard Clarke Advised New York City Subway Searches
Now this is a surprise. Richard Clarke advised New York City to perform those pointless subway searches:
Mr. Clarke, a former counterterrorism adviser to two presidents, received widespread attention last year for his criticism of President Bush's response to the Sept. 11 attacks, detailed in a searing memoir and in security testimony before the 9/11 Commission.
Unknown to the public, until recently, was Mr. Clarke's role in advising New York City officials in helping to devise the "container inspection program" that the Police Department began in July after two attacks on the transit system in London.
Seems that his goal wasn't to deter terrorism, but simply to move it from the New York City subways to another target; perhaps the Boston subways?
"Obviously you want to catch people with bombs on their back, but there is a value to a program that doesn't stop everyone and isn't compulsory," he said in a deposition.
Mr. Clarke later added, "The goal here is to impart to the terrorists a sense that there is an enhanced security program, to deter them from going into the New York subway and choosing that as a target."
Posted on November 8, 2005 at 12:49 PM
• 27 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Bruce, Are you surprised?
A lot of "anti-terrorism security" seems to have two goals...
1) Make it look like we are doing something so we can get re-elected.
2) Emphasise that we are protecting X heavily so that the terrorists don't attack X. We don't care if they attack Y, but we don't want them to attack X.
If the terrorists attack the Boston subway instead of the New York Subway then New York officials get to say "See, our security program is worthwhile as we were saved because of it." If the terrorists instead attack shopping malls in New York then they will say "Who could have known that they were going to attack Malls, we'll increase security there now. They didn't attack the subway because of our program..." Finally if the terrorists don't attack then they say "See, our program stopped them from attacking our subway which is an important target."
As far as they are concerned it's win-win. Whatever the terrorists do they come out ahead.
Given that the goal is to be seen to be doing something then the program is a success. If the goal was to protect against terrorist attack then perhaps they wouldn't do this... But that is not the goal.
It's win-win for everybody... the terrorists get to do their thing, the government officials get more money and more power, the economy flourishes, everybody is happy!
Errr Bruce, why exactly is it bad to make NY attacks less likely thereby making Boston attacks more likely? Which contributes more to the economy?
As you like saying, it's a trade-off. Not every precautionary measure we take need be a global one.
That the actual measure itself is stupid is another matter entirely...
Unlike Captain Obvious, I am less than thrilled at the logic of "don't beat me up, beat up my neighbor". Especially when it's of the form "I will spend lots of money and inconvenience myself, and then maybe you'll beat up my neighbor instead of me."
But what do I know? I only live in New York, and ride our subways 20 or 30 times as often as I ride the T.
In your second point, you concede that this program will deter terrorists from attacking the NYC subway system.
Then you talk about shifting attacks from the subway to a mall. While an attack would be tragic in either place, an attack in a subway system would be far worse.
1) An explosion in a confined space, especially in a tubular space, can inflict a lot more damage than an equivalent explosive in an open space such as a mall.
2) Any given tube in the NYC subway system sees a lot more people per day than any mall does. The loss of a tube for an extended period has a greater impact on people's day to day lives than the shutting down of a mall.
3) If there is any hint of a problem in a mall, people can shout warnings and run for cover, whereas in a subway there are not so many options.
4) I suspect that psychologically, a subway attack would be a lot more powerful than an attack in a mall. And since this is terrorism, the psychological component is critical and cannot be ignored.
Thus, a program that reduces the likelihood of attack in a subway should be taken seriously. Certainly it has to be viewed in a wider context, but it should not be nonchalantly dismissed.
P.S. Also, in your second point you imply that by choosing to give added protection to X that decision-makers are saying they do not care about Y. Sorry, but that's just silly.
Was Clarke hoping that terrorists would stop humping bombs on their backs and start using, say, FedEx instead? He would call that a successful deterence, would he not?
IMHO, Richard Clarke is the King of FUD. He has been spreading around his "chicken little��? security blather for years. I can't believe he hasn't been ridiculed in public by some real security experts as of yet.
He is a danger in that lots of people in the media seem take him seriously and now so do some big city police departments, (I’m embarrassed that it’s my home town!)
Back in June of 2002 he was quoted as follows:
"...For example, last month, in a speech at George Mason University, Clarke declared that: "Digital Pearl Harbors are happening every day, and are happening to companies all across the country." He then noted that IT security events cost the national economy upwards of $15 billion in 2001...."
Full link to the above article is below:
Ditto what Kevin said. I remember watching him on a PBS program warning about security dangers. My husband and I just couldn't help giggling, it was so overwrought. He warned about all the horrible disasters that could occur to our technological, but with no sense of that anything used by large numbers of people has inherent vulnerability to mischiefmakers. It seemed to be a "better not to have the internet at all, rather than be this vulnerable to cyberattack" sort of thing.
So I take it this means that in the wake of the Madrid train bombings (using briefcase bombs) and the two London bombings (using backpacks) that people involved in making security policy should not have bothered conducting searches on subways of NYC of people carrying containers.
And not because this wouldn't have been effective in terms of interception or deterrence but because -- wait for it -- the US has more than one city.
This of course means that even if you could introduce security measures to achieve a guaranteed level of safety there is no point since somewhere else can always be attacked.
This is of course the same reason nobody patches web servers with known vulnerabilities if they also run other servers. There is no point patching the most likely target if other less likely targets exist.
And should NYC subway have been bombed using the same technique as the two other attacks on rail stations of Iraq coalition members (4 if you count failed/foiled plans), the same people repeatedly using the phrase "profiling" would have seen no failure of security in terms of protecting the NYC subway (which has been hypothetical terrorist target #1 since Tokyo) because apparently "profiling" somehow doesn't include looking for what attacks have been used successfully to date.
I get that right ?
Because it sounds pretty ridiculous.
"Errr Bruce, why exactly is it bad to make NY attacks less likely thereby making Boston attacks more likely?"
Absolutely nothing. That's the point. If you're the government of New York City, it's smart to spend money moving the terrorists to Boston. But if you're the U.S. government, it's a complete waste of money.
Rediculous? Not really. More realistic than anything. Sooner or later, an intelligent person needs to accept that he or she isn't Madame Cleo, can't see the future, and that trying to control what does and doesn't happen on a massive scale is arrogant and aineffective. If the government could stop things from happening by throwing money, surveillance, and legislation at the problem, the USA would be drug-free by now.
Ideally there will be no terrorist attacks. However, as a Bostonian, I would like to say that if terrorists just have to set off a bomb in somebody's subway, could they please do so at 161st Street in New York?
Dick Clarke? Wasn't he the bad guy in Robocop?
By the way, here in the UK today the politicians will be voting on the (insane) idea to lock up 'suspected terrorists' for 90 days without charge. No news on the important bit of who gets to make that decision (judge or politician?), and absolutely no belief from the government that it will make things worse and not better.
Justice has to be *seen to be fair* by all in order to work. I don't think locking up people without charge is *fair*. I also don't think the current circumstances really are 'a unique threat to our way of life' compared to the IRA and other battles in the past.
Fingers crossed that the UK Gov will be defeated on this one.
"4) I suspect that psychologically, a subway attack would be a lot more powerful than an attack in a mall. And since this is terrorism, the psychological component is critical and cannot be ignored."
And exactly for that point, I do not agree with your choice of target.
The goal of a terrorist is not to inflict huge amounts of damage (natural disasters do a far better job), but to frighten people. Here in Holland for example, a subway/tube is almost non-existent, so it is somewhat difficult for appx. 16mln people to picture themselves in a confined space while an explosion goes of. The thoughts run like "Boy, that must be terrible, but we don't have that overhere.". Yet, we (as almost the entire western civilization) go to a supermarket every day to get our food. So if we can scare them in not going there with say four seperate and relative small explosions (nobody has to get killed), that would be quite some blow. Ultimately, we would have to go shopping again (we need food and growing your own takes time (and has a different ring when you are talking about Holland :-)), but we would be afraid. Very afraid. (Spurred by the media trying to milk the most from the situation.)
If somebody gets shot in the head for sitting in a tube carriage, just picture what would happen if you leave your cart unattended for a second, because you forgot to get some potatos...
I completely agree that an attack on a subway should not be neglected, but it is a matter of balancing available resources.
In my opinion, the balance shifts way too much to objects where a recent attack took place, leaving other objects wide open, until that object is attacked.
@ Stephen at November 8, 2005 09:34 PM
"Rediculous? Not really. More realistic than anything. Sooner or later, an intelligent person needs to accept that he or she isn't Madame Cleo, can't see the future, and that trying to control what does and doesn't happen on a massive scale is arrogant and aineffective."
Yeah you cannot see the future... you can however learn from experience.
Is there some idea that the 2nd Madrid bombing was planned to mimic the first attack purely by coincidence ?
That the 2nd London bombing identically matched the first by coincidence ?
That the popularity of IEDs in Iraq and Afghanistan is due to some other reason than the people responsible for this planning and training employ what has worked in the past ?
There are no crystal balls involved with looking at 4 attacks on the mass transit systems of the largest cities of Iraq coalition members.... and then checking bags in the NYC subways.
Seriously at what point would you suggest checking bags as a reasonable measure for US target #1 ?
After 6 bombings ? 12 ? 48 ?
Still the same "madam whoever" scenario after the same thing happens each time... so is there any point at which security theory bends to reality to address the threats which are actually killing hundreds of people ?
Is there any point at which security principles take into account attacker methodology and address those precise threats as a priority ? Because all I see here is people throwing their hands up as though defense is pointless.
Yes in theory if you provide a deterrance against the prime target of an attacker then a secondary target might be attacked.
In reality if you do not protect the primary target then the primary target gets attacked and attackers need nothing more than to imitate what has been done to date.
I don't care how long the whitepaper is that tries to justify that as a logical plan for implementing security you already know it's ridiculous.
I guess that's along the lines of the old proverb: "You don't have to outrun the bear, just the people you're with."
Whether that's very sensible with regard to the society as a whole is another question.
Agreed, it is a waste of money for the US Government to move the terrorists to Boston. It is *much* better to move them to someplace far, far away... for example, France ;-) Or, better yet, to go after them where they live, and deal with them before they get anywhere near us (or the French.) That will take a combination of research and intelligence gathering (a point which I think you make often) and the cojones to do what needs to be done (and, yes, by that I mean "kill them dead".)
Isn't this something your neighbor is doing, too? By putting a sign out in the yard that the place is protected by Whoopti-Do Security, aren't they telling potential home invaders that it might be easier to go somewhere else and leave their place alone?
Of course, it won't stop someone who is determined, who thinks he has some way around their security precautions -- like maybe there's just a sign in the yard and no real wiring inside -- but for the run-of-the-mill burglar, it's easier to slip in through an open garage door of a house that clearly has no protection.
New York City's visible security precautions in the subway system served the same purpose. Of course, it's a hassle for the subway users -- just like keying in your security code every time you enter and leave your home is a hassle -- but that's the price you pay for assuring your own safety.
If the folks in Boston think the New York security efforts might be sending terrorists their direction, they might want to do the same thing -- maybe the bad guys'll go to Chicago instead ...
This isn't new and innovative. We've been doing it on the small scale forever. It doesn't stop terrorism; it just makes it somebody else's problem.
If the "beat my neighbor not me" is to be put to the limit, then the Chicago authorities would benefit from publishing the New York City vulnerabilities. Not just the "we are more vigilant than they are" but "hey, take a look at the Yankee Stadium, how many people packed in a closed space." Now Chicagoans might sleep better knowing that the bad guys will blow up somebody else's kids ... only, do we really want to live in such a society?
If people live in community and cooperate instead of treasoning, maybe it's just because it's more effective to do so. We add a layer of security to the common good by strenghtening our trench, not by pointing the holes in the neighbor's.
1) Political guy (yes, I know he was the 4-star general in charge of NATO troops, but if you think that's not a political job...) discovers he can receive tons of unearned love and respect simply by switching sides during a period of strong political disagreement.
2) Political guy soaks up this love and adulation for a few years. When closely observed, it's easy to note that he's parroting whatever they want him to say... but, you know, love is blind.
3) (there is no ????)
... and then...
5) Political guy reverts to form when (he thinks) nobody's watching.
6) The suckers that bought his act are all kinds of shocked.
7) /me laughs at suckers.
8) /me cries because there's no profit in laughing at suckers.
I think you've got your Clarks confused. Richard Clarke is a security and terrorism expert who worked for George W. Bush and then criticized him. He was accused of "being on the other side" because he also worked for Clinton. You're probably thinking of Wesley Clark, a general who headed NATO under Clinton, retired in 2000, then ran for the Democratic nomination. He was accused of "not being on our side" because he didn't join the Democratic party very long before running.
@Peachpuff & everyone else.
You're right, I was confused. My bad.
You miss the point, my friend. It isn't a case of gesturing toward the neighbors and saying they are vulnerable; go get 'em. It's a matter of advertising your own security measures with the idea that the bad guys will decide you're too difficult and so they will go elsewhere. This is a common practice on the local level.
For example: You lock your car to protect it; if the car thief is in a hurry he passes your car by and looks for one that isn't locked. Even better as far as he is concerned, it's the one left running outside the convenience store while the owner steps inside for a purchase.
Ignoring certain basic steps of security merely opens yourself up for victimization.
Motive to do it, opportunity to do it, the means to do it -- all three factors play in the commission of a crime. Take away any one of them, and the crime doesn't occur. What the folks in NYC were doing was showing terrorists the opportunity had been narrowed, and by checking packs and bags, they also limited the means. The motive may still be there, but the other factors were all but eliminated.
Nothing happened to New York's subways. Did it work? Only the terrorists know for sure.
In the original post, Clarke is quoted as saying, "The goal here is to impart to the terrorists a sense that there is an enhanced security program, to deter them from going into the New York subway and choosing that as a target."
That's the idea. I'm just pointing out that any outrage felt at this statement should be tempered with the realization that you and your neighbors are likely doing the very same thing on a smaller scale -- just not realizing the similarity.
I sincerely doubt Mr. Clarke wanted terrorists to strike Boston or Chicago or anywhere else. The immediate concern, however, was preventing the New York subway system from experiencing the same nightmare as London had gone through a short time earlier. It worked.
> But if you're the U.S. government, it's a complete waste of money.
I would encourage Congress to pass a law requiring that any Federal $'s spent on security measures had to prove a genuine risk reduction rather than a mere risk transferance (to another location or group of people). The vast majority of these idiotic measures simply transfer the risk from the richer segments of society (eg airplane passengers, museum patrons) to the poorer (eg greyhound bus passengers, mall customers).
Attacks on Richard Clarke is led by the Jewish neocons in an effort to hide their role in doctoring Mossad intelligence being fed to the President Bush and the National Security Council.
The war against Iraq is a war to secure Israel's eastern flanks.
I have to write a research paper for school. My professor wants me to research an existing controversy over why NYC in general, and by extension, the NYC subway, is safer today than it was in the past. Can anyone help me identify what exactly the controversy is about and where I might find specific opinions on it, so I can get ideas for my paper? Thanks.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.