Schneier on Security

J Jet • December 29, 2006 5:15 PM

TSA’s, America’s Gestapo. This new governments reason to search Americans under the guise of SECURITY is somewhat false. These people individually make and change their rules almost daily. They demand to know “what are you thinking” and when you answer they call it a disturbance. We all need to read 1984 again. I am not against secure transportation, but for the most part what we have know is eyewash to make the public feel good. If someone wishes to do harm I don’t think they can be stopped.
Just wait until RFID’s get inserted into your drivers license. You will be monitored everywhere you go and computer files will be kept of your movements and there is nothing one can do. As far as ID’s go I have visitors from Europe who get drivers licenses as souvenirs. And I have used my library card for access to airlines (issued by the government with a picture). Now the TSA has secret laws (Documents received under the FOIA) and your Congressperson will refuse to respond to this issue. Note; I have been working with aircraft for over 40 years. Something to think about. Signed, an American

Editorial Stanley Schmidt
Analog September 2005

SOFTENING US UP

The next time you’re waiting in an airport security line, try this thought experiment. Imagine the you of twenty years ago-i.e., around 1985 – being offered a glance through a time machine at the scene in which the present you is now participating. You’re not told what’s going on. You can’t see your own face so you don’t recognize yourself, and you have no reason to react personally to what you see. Nor can you read any signs, badges, insignia, or similar information in the scene. So what do you say when somebody asks you, “What do you see happening here? And where do you think it is?”

I submit that the chances are very good that you’d guess Russia, East Germany, or some other policed state. Consider what you see, without what you now know of its context: a crowded checkpoint with several kinds of scanning machinery, swarming with uniformed men and women scrutinizing every individual in the long line coming through. Each would be passenger is required to show the same identification to several officials, and to relinquish his or her luggage, wallet or purse, coat and shoes. All of these things are x-rayed, and one or more of the uniforms opens and rummages through many of them before returning them to the owner. Some passengers walk through the scanner without tripping an alarm, but many don’t – some of those scanners are very sensitive! – and are called aside for additional indignities ranging from wand scans to patdowns to strip searches. Anyone unlucky enough to have inadvertently packed some horrible weapon like a pair of fingernail scissors is likely to have it confiscated, or perhaps be given the option of returning to the lobby to pack it up and mail it home – and going through the whole process all over again. All of this would have been quite unthinkable for most Americans twenty years ago, even though we had already gone a little bit down this road. Everybody knew this sort of thing went on in “those other countries,” but we all knew it couldn’t here. The suggestion that it could, or might ever need to, would have filled must of us with righteous indignation and revulsion.

Now it seldom does. Quite likely you read my opening paragraphs and thought, “What are you ranting about? All these procedures are necessary now, for security. Get over it!”

And that’s precisely my point: by steps large and small, we have gradually been conditioned to accept as “normal” things that just a few years would have seemed beyond the pale for rational consideration.

And the process is still going on, in ways both official and unofficial.

Okay, maybe at least some of these changes are necessary, at least temporarily. But they represent such radically departures from the principles on which this country was founded that we should be very conscious of what we’re doing when we accept them. We should not let ourselves be softened up so we readily accept large and dangerous changes just because they occur in relatively small stages, or appear to be justified by special circumstances, which in turn also come to be accepted as “normal.” We should, in other words, go into any drastic changes with our eyes wide open and fully aware of what we’re doing.

SOFTENING US UP

In the case of increased government security, we are told that these extreme measures are needed because of the clear and present danger of terrorism. Right after the 9/11/01 attacks on New York and Washington, this sounded all too convincing. In what amounted to a state of national panic, people accepted, even welcomed, these measures – and then others. Extreme airport security? Sure. Indefinite “detention” (a newfangled euphemism for “imprisonment”) of people suspected of maybe being dangerous, with no time limit or requirement for a trial? Why not, if that’s what it takes? Invade another country because it in some vaguely envisioned way eventually be dangerous? You bet. Fingerprint anybody coming into our country? Push for fingerprinting all of our citizens when they apply for a passport? Ban photography around airports or subways, even though such a ban will be impossible to enforce consistently and unlikely to have much effect beyond annoying and entrapping unsuspecting tourists or railroad buffs?

Not all of these things have been fully implemented, but some of them have and the rest are under serious consideration in at least some places. All of them, not many years ago, would have been seen by most Americans as hallmarks of a totalitarian or police state. Yet in that short time we have been conditioned to accept them as normal actions that must be taken, at least “for the duration,” to protect democracy . But we have no indication of what “the duration” is, or how far we can go in this direction without having thrown away the very thing we’re supposed to be protecting. So far we’ve continued to practice and expand them on the basis of official assurances that continuing threats make them necessary – but very few of us have any way of directly confirming that claim. So we have to take officialdom’s word for it – and the more such measures we’ve already accepted, the easier it becomes to get us to accept still more. Far be it from me to suggest that anybody so far has been tempted to exploit that fear and trust to establish and maintain an Orwellian “1984” situation, but we must take very seriously the possibility that somebody could.

My point is merely that no matter how necessary such measures may be now, the willing acceptance of them softens us up – makes us increasingly vulnerable to possible future attempts by someone to take them well beyond the necessary. But government actions are not the only things that can, intentionally or unintentionally, have that effect. There are cultural forces, driven by technological developments, pushing us in the same direction.

Consider, for example, the current popularity of “blogging.” Its closest counterpart until quiet recently was “journaling,” or keeping a diary, which many people regarded as a very private thing – a book in which they could record, primarily for their own use their own use, thoughts and feelings that they might not feel comfortable sharing with many others. Blogging, short for “web logging,” is similar, except that instead of being done in a private book, it’s done on a website where any body at all can read it. Personally, I marvel at the ego of people thinking that strangers would want to read every detail of their personal lives, and even more at the fact that many of them do find plenty of readers. Voyeurism, it seems, is alive and well, and some of the most enthusiastic bloggers go well beyond simply talking about themselves. Some live huge portions of their lives in front of their webcams, letting anyone who cares to watch what most people (so far) would consider their private business.

Some even go beyond conducting their own lives on “candid camera,” and extend coverage to others who are offered no choice. Some bloggers who are also parents are now running blogs that they use for such purposes as looking in on their offspring when they themselves are at work or
SOFTENING US UP

otherwise elsewhere and posting huge galleries of pictures of “cute actions,” logs off diaper changes, etc. All of which is available to anyone who cares to look at or download it. This probably doesn’t bother babies, but babies grow up. How long do parents continue these things, and how does it affect the kids who are subjected to it when they get old enough to be aware of what’s going on? No doubt some of them will be extremely embarrassed, and some of them of those may manage to put a stop to it – thought they still risk humiliation when they somebody calls up an old bath photo or diaper tally in front of a teenage boyfriend or girlfriend.

Or maybe the practice will affect them quite differently. Maybe kids brought up this way will be so used to continuous surveillance that they won’t even realize there’s an alternative and won’t make much distinction between Mom and Dad doing it and Big Brother doing it. Particularly when their growing environment also includes many other variations on the theme. There’s already a considerable business in other paraphernalia for parents to spy on kids, from software to record everything they do on a computer for later parental scrutiny, to gadgets constantly monitoring their whereabouts by means GPS readings transmitted by their cell phones or the cars they drive. At least one company specializes in “nannycams.” cameras that can be hidden in teddy bears or the like to let absent parents spy on babysitters and their charges; a recent newspaper article was devoted to the ethical question of whether parents using such devices should tell the nannies they were doing so.

Nannycams lead us to the increasing prevalence of various forms of work place spying on adults, including the use of various forms of cameras and eaves – dropping on telephone and e-mail conversations. Nobody says “eavesdropping, ” of course; the politically correct euphemism is “monitoring,” and so many noble-sounding excuses have been mane for it that even some of the employees are beginning to believe them and accept such practices as a normal part of the working world. That too, has the effect of softening us up, making us more receptive to continuous intrusive supervision. If some such steps become widely accepted, then it’s easy to accept others that go a little further. If that happens often enough, we can easily arrive at a situation very much like that in 1984, even if nobody set out with the conscious desire to create such a state.

And if adults can be made susceptible by small steps, beginning from a state of high resistance at a fairly advanced age, just imagine how much more susceptible they would be if they had been subjected to even closer and more continuous surveillance from such an early age that they’re conditioned from the start to regard it as “normal.” That, it seems to me, is happening to large numbers of children right now. And I suspect it’s likely to become even more prevalent as the electronic exhibitionists who like parading their own lives and those of their children before the world exert social pressures on those who don’t.

In Orwell’s vision of 1984, we are led to believe, the nightmare world of Big Brother was created by deliberate intent and maintained by consciously designed social machinery. The real danger we now face may be much more insidious: a similar world that arises not by malicious design, but simply by “growing” in a series of small steps, each of which seems too innocuous, and perhaps even to reasonable, to protest.

Needle With a Nametag
By Stanley Schmit,
Analog October, 2006

Anyone who has used English for more than a few years has surely encountered the phrase “like a needle in a haystack.” It refers, of course, to the difficulty of finding a specific small object in the midst of large numbers of very similar objects. For a literal needle (whether a pine needle or a sewing needle) in a literal haystack, the difficulty is obvious: Finding it will involve a large amount of tedious manual picking through lots of stuff that looks alike. Even if it’s right in front of you, you may not notice it because it doesn’t stand out from its surroundings.

Wouldn’t it be nice, when confronted with such a task, to have a magic wand that you could simply wave at the haystack, in response to which an embedded needle would call out. “Here I am!”? While we’re dreaming, why not fix it so that if there are multiple needles in the haystack, each and every one of them will not only tell you where it is, but which one it is and what its characteristics are?

Well for better and/or for worse, we now have something that acts very much like that – not necessarily for literal needles and haystacks, but for a great many similar situations. It’s called a radio-frequency ID tag, or “RFID” for short, and its original purpose was quite practical and innocuous: to make store checkouts and inventory control easier and more accurate. Inconspicuously attached to a piece of merchandise – umbrella, a bunch of broccoli, or a boot for example – it stores information such as the items exact identity and its current price. And it can spit that information out instantly in response to a “ping” (an omni directional coded microwave pulse), for processing by a computer associated with the reader (or scanner) that provides the ping.

Unlike the laser barcode readers we’ve all gotten used to (though our grandparents could hardily have imagined them), RFID ‘s don’t depend on a clerk’s holding the barcode for each item, one at a time, directly in a narrow sensing beam. Since the microwaves with which they communicate are omni directional, pass easily through many kinds of matter, and have considerable rang, a single “ping” directed at a full shopping cart can elicit self- identification from every item in the cart. That’s enough to let the checkout computer generate a complete itemized bill. If the customer has one of those “Loyalty cards” increasingly used by stores in lieu of coupons, the RFID scanner can read that and automatically figure in several discounts offered to users of those cards – and compare this week’s purchases to previous ones to print out along with the receipt, customized special offers likely to entice that customer back into that same store next time.

Sounds like a win – win situation for everybody, right? The merchant gets a fast accurate checkout, with very few if any bookkeeping errors, and needs fewer clerks to process a given number of customers. The customer gets through the line faster, is unlikely to be overcharged, and gets several chances to save money.

And it doesn’t stop there. While the merchant has an RFID scanner identifying each item sold to calculate the bill, it might as well feed that information to another program that deducts the item from inventory and keeps track of how many are left. By doing that for every item in the store, it can monitor the entire inventory on a continuous basis and let the storekeeper know whenever something needs to be needs to be reordered. It can keep track of what sells how well therefore how much of each thing to should be ordered. It can keep track of what individuals customers buy a lot of, and therefore which personalized special offers are likely to be effective in bringing them back – without one person having to ask another prying question about such things.

What “extras” does the customer get? Well, not much in the store – but things begin to get clear – cut and utopian – sounding after the merchandise leaves the store. RFIDs are typically built right into the wares – sewn into clothing labels, for instance – so that customers are likely to be unaware of their presence, and unable to easily remove them even if they know they’re there. So they remain, and can still be read by any scanner they pass. That opens up all kinds of possibilities. A great deal of a person’s history can be traced, if only in terms of where he or she was at a particular times, by stored records of the presence of objects in their possession – not only at the moment of purchase, but at any time thereafter. Your credit cards and subway pass, the wallet in which you carry them, your underwear, a book you bought, the E-Z Pass and tires on your car – all can serve as tattletales, giving anyone with the inclination and know how to seek them out a wealth of data points to map much of your life and draw conclusions about it. Most of that information will never be accessed or used; there’s just too much of it and most of it is of little interest to anyone. But the fact that it can be accessed is and used should give us pause, because some of its uses can ruin lives for no good reason.

Mary Rosenblum gave a disturbing taste of the possibilities in her story “Search Engine,” which appeared here in September 2005. Edward M. Lerner, another writer well known to Analog readers, chillingly suggests some others in his story ” The Day of the RFIDSs'” which you didn’t read here, but would do well to seek out anyway. It appears in his collection Creative Destruction, published Wildside Press in 2006. Many of the stories in the book did appear first in Analog, but a couple are new and eminently worth reading. “The Day of the RFIDs,” in particular, points out some o the possible ramifications of this modern convenience that everybody needs to think about before embracing it unmitigated enthusiasm.

There are those, for example, who will complain that what I have said so far dwelled too much on the possible negative uses of RFIDs while neglecting their power to help prevent terrorism. Some will say that the more information we have that can be used in tracking potential terrorists, both for prevention and for establishing guilt after the fact, the better off we all are. The innocent, these people will say, have nothing to fear.

How charmingly naive.

If you are one of those who can comfortable believe that, please read Lerner’s story, which among other things includes and all to plausible scenario for the diligent pursuit of terrorists leading instead to the deaths of numerous innocent people, massive destruction of property, and the placing of a man who never hurt anyone or anything on a “most wanted” list. It can happen that way, and if we are going to use the things that make it possible, we need to figure out safeguards to make sure it doesn’t.

If you are not one who can be so trusting, but think instead that you can protect yourself by such means as avoiding the use of E-Zpass, credit cards and loyalty cards, and paying for everything with cash, think again. Some countries have already begun incorporating capital RFIDs into their currency, so that even “unmarked” bills leave plenty of tracts and can no longer be considered anonymous. Some countries have begun incorporating them into their passports, and others (including this one) have definite plans to do so. Many urban transit systems now require that fares be paid with scan able cards, and some toll road systems are moving in that direction.

All of these things have been created and adapted with good intentions, and all of them can do good and worthwhile things for us. But any tool can also be used as a weapon, and the more powerful it is in one kind of application, the more powerful it can be in the other, too. We as a people have to decide which of these aspects matters more to us, and how we can get as many as possible of the benefits of a particular technology while protecting ourselves from as many as possible of the dangers. These new information technologies are very powerful indeed, and we dare not assume that those who control them have only our best interest at heart or that the guiltless have nothing to worry about. Information gathered in these ways can make shopping easier and help thwart genuine malevolent terrorists. It can also be used to persecute almost anybody for almost any reason, such as a personal grudge, a political or business rivalry, or just a malicious prank. Or to establish a kind of government quite alien to the kind we have long taken care to maintain: The equipment and methods now available to would-be “Big Brothers” far exceed anything in George Orwell’s writings. We can and should use these new tools just as we use fire and electricity – but we can and must use them with no less respect and care.

A few years ago I myself wrote a novel (Argonaut, Tor Brooks, 2002), which, at the first glance and even in my own original thinking, seems to have little to do with these matters. Certainly the direct inspiration for it, at least at the conscious level, was quite different. After reading one too many manuscripts in which explorers got to ea new planet and in a few days learned more about it than all our scientists have learned about earth in all of human history, I found myself thinking, “Could they really do that?” and then, “Well, maybe….”. I thought of a way they might, in the not too distant future, using a combination of then-nascent technologies to carry out unprecedentedly widespread surveillance, data collection, and analysis. And I realized that the ability to do that would be addictively exhilarating if you were the one using it, and thoroughly terrifying if you were the one (s) being studied by entities you had no reason to trust. The result was what Michael Flynn called “the oddest alien Invasion yet.”

I wrote it simply because I thought it could be an enjoyable, thought-provoking story. But I know suspect that part of the reason I was drawn to the idea was its parallels to the dilemmas beginning even then to begin apparent in our own burgeoning abilities to gather and use information. Large-scale, intimate spying is no less a problem whether it’s done by “them” from Out There, or by some of us right here. The result, and the danger, is the same either way.