Schneier on Security

Roger • February 2, 2006 2:09 AM

@narpo:
“BTW i dont think that it’s a good idea but i’m sure that the most interested people on not loosing planes are… air companyes.”

Unfortunately, it’s not that simple. Airlines recognise that from time to time they will lose a plane, it’s an inevitable fact of life in an imperfect world. Thus rather than “not losing planes”, they must apply some sort of fatal calculus to optimise the losses that will occur. It sounds ghoulish if you’ve never been involved in safety engineering, but really it is the best way to approach the problem.

Thus their objectives in maintaining flight safety are twofold:
a. for a given available safety budget, minimise direct losses from aircraft crashes, including both the loss of the aircraft and compensation to relatives of the victims; and
b. minimise loss of business caused by reduced public confidence.

So far as terrorism is concerned, they quite correctly observe that the rate of loss of aircraft due to deliberate attacks is MUCH lower than the rate of loss due to accidents. Thus, their logic has always been that any money spent on anti-terrorism security is money wasted, that could have been better spent improving general aviation safety. Similarly their approach to public confidence about airline security has always been “security theatre”, i.e. relatively inexpensive [1] measures that don’t really achieve much but look good to the ignorant.

This isn’t a new attitude: I recall airlines violently resisting security measures back in the 80’s, and they still do. (US airlines still haven’t made cockpits inaccessible during flight. The ones that have, surprise surprise, are largely state owned.) Furthermore, except for one tiny little flaw which I privately call “the bean counter fallacy”, their thinking is absolutely correct and perfectly moral: they really will minimise suffering and loss of life by spending as little as possible on real security, and using the money saved for safety programs and fooling the public about anti-terrorism security (because it is, in fact, safer than the alternatives).

But there is the bean counter fallacy. The bean counter fallacy is the error which occurs when we use past statistical data to summarise the risk from an intelligent opponent. It usually goes something like “our total losses from burglaries last year were less than the wages of the night watchman, so it would be more economical to retire him.” It is perfectly valid to use, say, the past incidence of lightning strikes on aircraft to estimate the risk of that happening again in the future (assuming we do not radically change the design of aircraft). However using the past incidence of aircraft hijackings to estimate the future risk of aircraft hijackings is abject nonsense. It is wrong in two important ways:
a) the future risk is likely to change in dramatic ways according to the political climate. (It is also true that the incidence of natural phenomena varies from year to year, but rarely to anything like the degree that human activity does.)
b) more seriously, an intelligent opponent will analyse your strategy and adept his own accordingly. For example, if you retire that night watchman, it is very likely the number of burglaries will soar!

1. Some people argue that the current generation of security theatre in the US is an expensive gravy train, but in fact the total expenditure on it is a microscopic fraction of the annual budgets of airlines. In a previous blog entry on this topic, I calculated that the total is about $1 per passenger per 1000 miles of flying.