Schneier on Security

Anonymously Posted From Mars • May 8, 2012 9:46 PM

In the months and years following 911, I would occasionally hear on the cable news channels things like: “The NYC police department is responding to a suspicious package outside of an office building — the streets and nearby buildings have been evacuated. We will bring you more when we get it.”

Of course a few minutes later, after the bomb squad had been deployed, we would hear “False alarm, it was a backpack full of clothes.” And the story would die. I remember hearing this type of thing live several times and I don’t even watch cable news that often. I am sure this type of thing still happens a lot in other cities (NYC just got all the attention). The story Bruce mentioned here is but one more example.

It got me to thinking that due to the hysteria 911 brought, that a terrorist group could use this to its advantage. They could go around and plant suspicious suitcases conspicuously around large buildings and in other important locations. This would really cost the city or jurisdiction a lot of time and money. It would essentially be a DDOS attack at the physical “real world” level. And the great thing from the terrorist’s perspective? It takes very little resources to pull off and one would have very little risk of ever being caught. In fact, I am not even sure much could be done to them even if they were caught. I am not a lawyer, but afaik it is not a crime to drop a backpack on the ground (though a conspiracy to do so for malicious intent could probably be prosecuted).

My point is, all of this hysteria and increased police action can have, shall we say, unintended consequences. In a sense, by introducing all this extra security, they have opened up new security holes that are even more easily exploitable than the things they are protecting against. What if during one of these false alarms people are crushed and killed by the stampeding crowd? Even though there was no bomb, the mere fear of a bomb caused deaths.

Taking this into account, it is not really a stretch to say that the terrorists have already won. Emmanuel Goldstein didn’t have to bomb anyone — his mere (perceived) existence allowed him to exert his psychological influence. Bin Laden was compared directly to Goldstein (correctly I think). Any time we have a “name” attached to a threat, we grossly exaggerate that threat.

We now have the DHS telling us to “speak up” if we see some guy paying for his coffee in cash (no I am not kidding, DHS has said paying in cash should be reported, especially if the person looks nervous or has burns on his fingers — whatever that means). Also, if you buy fertilizer, watch out. This is supposed to be reported to DHS as well, especially if cash is paid for it. (Yes, I know about nitrate fertilizer bombs a la Tim McVeigh).

We have turned into a country of paranoid snitches. People snitch on “suspicious” activity that is probably in 99.99% of cases completely innocent. And the more snitching people do, the more the “cry wolf” phenomenon comes into play. Eventually people will get sick and tired of evacuating their office buildings due to all of the backpacks left on street corners and they will simply begin to ignore it. Then one day one of the real threats falls through the cracks and an attack will be successfully executed. After that, the cycle starts all over again: people once again become paranoid snitches. It reminds me in some ways of that Twilight Zone episode “The Monsters are Due On Maple Street.” It’s a classic episode that illustrates beautifully how fearful people are more of a threat to their neighbors than some existential scary threat can ever be (in this case it was an alien invasion).

David Brooks gave an interesting talk about this phenomenon at RSA. He presented studies by both economists and psychologists that suggests that the less trusting people are of their neighbors, the less successful the population is economically. He gave Italy as one such example. In Italy, people are very distrusting of people not blood related to them, so even though their business may have lots of room for growth, they never hire “outside the family” which results in unnecessary stagnation of the business. He also mentioned Soviet Russia as another example: in Russia people were terrified that their neighbors might be KGB agents which was bad for business. I highly recommend you watch his talk on YouTube.

What’s the solution? Stop being paranoid and stop living your life in fear. Your chances of being killed by a terrorist are next to nil. Even if DHS and TSA were both eliminated today, your chances of being killed by a terrorist are less than being struck by lightning. That’s not to say if you see a man walking around outside an airport with a bomb strapped to his chest that you shouldn’t report it, but some of this stuff DHS is suggesting is just ridiculous and does much more harm than good.

Of course, it’s true that just because you’re paranoid doesn’t mean they’re not after you. But, in reality, they probably aren’t.