Schneier on Security

Clive Robinson • December 1, 2004 6:03 AM

Security like may other things is a process subject to the “laws of human nature”,

1, It continously evolves.
2, It has non linier but oscilitory behaviour.
3, It’s subject to market forces.
4, It’s subject to prejudice.
5, It’s subject to resource limitations.
6, It’s a three state game (win,draw,lose)

and several others.

The Comunist block colapsed for many reasons however one of the prominent ones was it could not afford it’s security (market forces).

East Germany did not see it’s downfall and 9/11 happend, not because the information was not there but there where insuficient analysts (resources) and they where looking in the wrong areas (prejudice).

When a security event (9/11) happens in an open society there is a knee jerk action, security quickly ramps up as long as there are the resources and the people it is applied against accept it, which for a time they do. In an open society the limitations start to apply and security ebbs slowly away, untill such time as another security event happens. This gives one type of oscillitory behaviour.

In a closed society security builds up slowly as the resources are found for it, it continues to increas beyond the point where it is sustainable leaving the society week and inflexible. At some point an event happens such that causes the resources to be diverted away from security (crop failer, epedemic, earthquake etc). As the event is dealt with the resources return to security, unless the event was sufficient to cause an attempt at a change in governance. Unfortunatly this is often expensive in infrestructure and manpower (Civil War) often the change results not in an open society but another closed society and this is the second type of oscilitory behaviour.

In both cases there is a time lag involved, time to election in an open society, time for overt oposition to gain imputus in a closed society.

All societies are placed somewhere between the extreams of open and closed. Thise means that their resultant pattern is a combination of both major types of oscillitory behaviour and appears chaotic when a scociety is away from the extreams (I wish you luck on trying to model it ;).

As Bruce points out in his artical there are two main types of security in an democratic society Governmental (mainly open) and Corparate (mainly closed), in normal times they are usually in conflict, however they play for marginal wins or draws, based on the accumulation of assets or resources (money). This causes minor oscilitory behaviour.

In a closed society there are again two types of security Governmental (mainly closed) and Organisational (usually closed) again they are usually in conflict. The organisations are either part of the current covernance or in opostion to it. If an organisation is part of the Government it tends to play for minor wins and settle for draws, based on the accumulation of influance and control (power). If not part of the government they are usually signed up to what is a mutual destruction pact where there is no draw only total win and total lose.

Where ever there is conflict you get an advancment of tactics and behaviour (evolution) usually the predomenent entity (Governement) has the advantage in this due to superior but limited resources.

However in a closed society a non governmental organisation has the advantage of playing against a resource rich but limited oponent, that has many unrelated organisational oponents (both real and imaginary). If the organisation does not become subject to scrutiny (prejudice) from the government then their activities can progrees without hinderence. This gives them a significant advantage when it comes to single/first strike events (Fall of East Germany etc).

Real terorists / freedom fighters are usually the product of closed societies, imaginary ones are usually the products of open societies (Reds under the bed etc). They are by nature closed organisations that might at a later stage if they replace the government become mainly open (ie democratic). Often they pretend at being open (Faux Democratic) but remain closed (Dictatorships).

Up to half way through the last century the scope of any coperation or organisation was limited by communications (both physical and informational) this tended to limit their sphers of influence (horizons) they had. Likewise governemnts where also limited by communications but less so, however they had the advantage of playing as organisations in a (non) society that had no governance.

The problems of Univerasl Survailance did not arise prior to that time as there was effectivly little freedom except for governments.

In the 1960’s the “Golden Age” of freedom started when the cost of mobility droped to the point where it was available to all (in the Western World). This gave rise to the possibility that ordinary people could move away from their “home vilage” and start a new life, coincidentaly leaving any mistakes behind them. This “Golden age” started comming to the end when the cost of processing information dropped down to a point where all information could be held “on-line” and arbitary rules could be tested against large databases of information (profiling or targeting). The first loss of freedom that came about for the avarage person was credit, oganisations either traded credit histories amongst “peers” or setup rules based on statistical norms (credit profiling). It became possible for provably credit worth people to be refused credit, however very non creditworthy people quickly found out how to make themselves lappear very creditworthy and got credit.

The same sillyness has moved on to counter terorisum, however somebody did not learn the lesons from credit profiling. As counter terorisum is about life and liberty not money it is a whole lot more serious for anybody it effects (whic is all of us).

The big problem is that norms are based on past data and simplistic models, security is evolutionary and chaotic. Also no entity is omnipitant in outlook or has even close to the resources to be so. Terorists have very bad “credit” in counter terrorisum but know how to look “creditworthy”. Worse they try to remain invisable until their First/Single Strike so effectivly have no “credit history”, and offten no intention of living long enough to creat one.

Ultimatly the solution to terorisum is not security that is by definitian “reactive”, it is always destined to fail. But proactive policies that do not allow situations to occur where terorisum can be born of hate and envy and grow sufficiently to turn on you. The solutions are also not military in nature as warfare always has civilian casualities and they in turn have relatives who will hate you.