Schneier on Security
A blog covering security and security technology.
« ChoicePoint Says "Please Regulate Me" |
| More Hash Function Attacks »
March 10, 2005
Security Risks of Dungeons and Dragons
The Israeli Army gives a lower security clearance to people who have played D&D.
Posted on March 10, 2005 at 8:16 AM
• 22 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
It's not clear whether the IDF is simply prejudiced against D&D. I'm waiting to see if they did some studies to come to their strange conclusion. There ARE all sorts of non-intuitive profiling studies around. In the 1950's, someone in England found a statistically signifigant tendecy to psychosis in army British officers who wore mustaches.
The other obvious question - if playing D&D makes a poor officer, what many similar hobbies should also be a disqualification? Why not blackball any teenager who writes fiction...
- The Precision Blogger
Since when does the IDF take psychological advice from Jack Chick?
And why did my 8th level cleric not entitle me to the mystic secrets of the universe? Oh yeah, because he was slain by an elf. D'oh!
Slashdot covered this as well, in usual slashdot fashion: http://slashdot.org/article.pl?sid=05/03/09/...
A number of people pointed out that the photos in the article depict SCA activities, not D&D. Unless they take their D&D a LOT more seriously in Israel.
Oh, man. Why don't they focus on the real issue - finding the people they can trust and thos they can't.
1990 a guy from German military intelligence was talking to me, because a friend of mine had to get his security clearence. I told him, that my friend is playing roleplaying games, what they are and such.
The only question this guy had, was: Can he be blackmailed with this?
I answered: No.
That's it. My friend got a high security clearence and did his job.
PS: The whole platoon were playing roleplaying games an their free time.
Basically, this is just the same as the various airline passenger screening programs: you find something that may be suspicious (even if it's based on prejudice) and then you do more thorough testing.
But here the similarity ends: it is easy to prove that you don't have weapons and bombs with you.
Psychology on the other hand is a tricky business. Here the "truth" is not so easy to find and the psycholgist may be prejudiced to see the "truth" he is expected to see.
But unless we know more about the initial screening parameters and "suspicious facts" that may lead to more thorough evaluation in the IDF, I would more likely consider this as another media hype, highlighting just one fact of the whole story.
There may be many more criteria like these and if these have been observed in the past in combination with security problems, they can easily and rightfully be implemented in a pre-screening process.
In the end, there's maybe just one thing about D&D as a security problem for the army: gamers tend to think more independly and ask more questions (at least according to a study I once read)
I like these two statements in the article:
1) "We have discovered that some of them are simply detached from reality," a security source told Ynet.
2) Many of them are from the former Soviet Union, where the game is very popular.
If I did not know the title of the article, I would probably just read these statements to mean some of the many people from the former Soviet Union are detached from reality.
Given the altered "reality" these 18-yr olds have experienced (toddlers during the collapse of the Soviet Union and migration to Israel), I hardly think D&D is at the root of the problem.
As Chris points out D&D tends to expose children to thinking processes that are creative, individualistic and inventive. These traits tend to be seen as a threat to institutional thinking, which surely includes the military and religion. And again, those who survived the collapse of the Soviet Union probably think more independently and challenge authority more than their peers.
As an aside, I have known many soldiers who spend their idle time playing hobbies and games (especially submariners who seem to be slightly bored by being locked in a metal tube for months at a time). While I agree with the principle that people with passtimes are susceptible to influence, the simple reality is that D&D is just one of thousands passtimes and certainly is not the worst. Quite the contrary, it is far easier to social engineer and infiltrate those who participate in physical and militant passtimes. And anyone who performs pen-tests knows the social weaknesses of smokers...has the Israeli Army banned smokers yet?
Maybe that is the real message here. When people have already developed a critical-thinking, analytic, approach to problems, the military will have a harder time trying to convince them of a very specific definition (policy) of right/wrong.
People who play D&D are normally of at least average intelligence or they wouldn't be drawn to it. I can see how the army would deem this as a 'personality weakness'.
In the words of bill hicks "Anyone dumb enough to want to join the army...should be allowed"
Perhaps it could be seen as a vice on dice. Instead of planning accordingly one may be influenced to take unnecessary risk.
Sigh. I think everyone will agree that this is a bit stupid. I'm sure my statistics professors could drum a statistically significant correlation between stupidity and D&D in a few seconds.
There are two big issues here:
1. The number of reasons that this is wrong is as long as my arm, but anyone with half a brain could come up with counter arguments too.
2. Maybe the Israelis are actually really smart.Although there may be no direct correlation between these two things, maybe it's as good a measure as they need because of some bizarre indirect correlation that's not understood but is good enough and seems to work. And that's a little scary.
3. Worst case D&D players actually make great soldiers and this policy will wreck their armed forces in 10 years. Then again, maybe not.
Thanks for the slashdot reference, it was far more insightful than the article itself. The comments of those with actual combat and IDF experience reveal far more understanding than those who equate military suitability with dullness.
You may want to fault the IDF for flagging LARPers for further testing but saying that the IDF considers it undesirable for elite combat soldiers to have an "already developed a critical-thinking, analytic, approach to problems" is simply ignorant and untrue. Being 'easily impressionable', sociopathic or even religous lowers ones military profile and makes one unsuitable for certain elite service. It may not be fair or perfect but it has worked well enough.
"saying that the IDF considers it undesirable for elite combat soldiers to have an 'already developed a critical-thinking, analytic, approach to problems' is simply ignorant and untrue."
Very eloquently stated. However the article is actually about determining security clearance for mandatory service (e.g. the susceptibility of new recruits) not whether elite combat soldiers need to be intelligent.
Nonetheless, thank you for illustrating the sad and common mistake of equating general military service requirements, including security clearance, with "elite combat soldiers". Something tells me that if we follow your red-herring and talk about how smart you have to be to become an awe-inspiring super-soldier of death, then we are no longer discussing the corellation between idle passtimes and security clearances.
Bottom line is that military "service" means a way of life and thinking that ensures somewhat predictible reactions to almost unpredictable situations. The best example of this is the process of "boot camp", which breaks everyone down to a common baseline and then builds a very different vision of the world than your average civilian.
Rhys made an excellent point that the correlaton is what we need to focus on. That is why we can so easily disagree with "actual combat" (real or imaginary) veterans on slashdot. As I've said before, just because self-proclaimed crime "experts" (or IDF veterans) tell you that burglaries go up whenever people eat more cold desserts does not mean you should agree with them to ban ice cream in your neighborhood. Independant analysis should lead you to discover that burglaries and ice cream are both symptoms of fair weather...
The more I read about this article the more I wonder if the story is real at all or a silly hoax.
Perhaps it is just me, but all the D&D players are identified by name (Matan, 22, and Igor, a 21-year-old) whereas the IDF is quoted completely anonymously:
"the army says"
"A security official tells Ynet"
"a military official says"
And who/what is the mysterious "David" that appears at the end of the article without prior mention?
Had I read more carefully the first time I might have noticed this sentence: "the army is...trying to locate soldiers who in their free time dress up as witches and play in forests".
And that alone should be enough to blow off the whole story as some kind of nonsense. Maybe we'll find out that this all started with the ultra-religious fanatics again trying to dissuade kids from playing D&D..."children you'd better not play D&D or you will never be elite and have access to classified information".
Baloney. In as much as any government policy needs a cover story, it's fine.
But really what's going on here is the type of people who play D&D aren't good for entry or mid-level military positions.
They tend to be good and understanding rules frameworks (good for military), clever (not useful for low-end military) and good at finding ways to exploit the rules frameworks for their benefit (bad for military).
Personally, I played D&D for a year or so. It was fun. Then I figured out a way to use a pair of characters and some low-cost magic to create a basically undefeatable character and the game lost its appeal. It was all within the rules but really contrary to the spirit of the game. I'd 'hacked' D&D, if you will.
So you definitely don't want this kind of person as a grunt in the Military. From this perspective, this policy makes sense and is a good move.
Now, as far as computer security and covert intelligence, that's another story.
"But really what's going on here is the type of people who play D&D aren't good for entry or mid-level military positions."
Perhaps, but the issue supposedly raised by the IDF is whether people who play D&D are fit to work with classified information.
I think everyone is reading more into this. In the article it states that if someone plays D&D they are referred to a psychologist to see them. It doesn't say that for sure they get a low clearance it just implies that they get more scrutiny. It makes sense that if they see a trait that they believe could be a risk factor that they might explore it further. Making a direct connection between playing D&D and getting a low clearance is not warrented here.
Well, that would have been a much more sensible conclusion for an article. But unfortunately the published article clearly states "Ynet has learned that 18-year-olds who tell recruiters they play the popular fantasy game are automatically given low security clearance."
Pretty strong stuff considering the unnamed "offical" quoted by the reporter only seems to say "More than half of the soldiers sent for evaluation receive low security clearances, thus preventing them from serving in sensitive IDF positions".
As I said earlier, and as I read in the Ynet comments, this article must be some kind of wild hoax, religious propaganda, or editorial mix-up. It has obviously driven up the popularity of their site. Maybe it's just a new marketing strategy. Heck, if it works in American news...
Analyzing the IDF based on the YNET article would be akin to analyzing T-Mobile's system security based on a Newsweek article. Both may be reputable publications but that doesn't mean they have their facts straight. Some of the slashdotter's were able to get a more accurate interpretation, such as reading the original Hebrew to reveal that 'D&D' was a poor translation of what should have been 'Live-action Role Playing' ( http://slashdot.org/comments.pl?... ) when referring to one of the triggers for additional testing. No doubt there are rumors within the populace that any D&D affiliation affects your score.
One of the primary reasons inductees care about their score is that it affects their ability to serve in elite units as well as their security clearance. A lower score or security clearance does not prevent someone from being a 'grunt' unless they have significant factors in the IDF's view. Even the poor quality YNET article first claims "Ynet has learned that 18-year-olds who tell recruiters they play the popular fantasy game are automatically given low security clearance." but then the sources in the article don't claim that if you play D&D you won't get a low security clearance.
Now to the beef I have with statements made here unrelated to the 'facts' of the article:
"...expose children to thinking processes that are creative, individualistic and inventive. These traits tend to be seen as a threat to institutional thinking, which surely includes the military and religion..."
Surely you don't have a clue. The military (US and IDF) highly values these dismissed traits. This attitude is far more reflective of Hollywood than reality.
"...it is far easier to social engineer and infiltrate those who participate in physical ... passtimes..."
What??? Am I the only person who sees this as ridiculous? Why don't you just lump in women and minorities to complete the notion?
"...at least average intelligence... I can see how the army would deem this as a 'personality weakness'..."
More of the same thinking.
"Bottom line is that military service ... than your average civilian"
Back to the topic - in Israel almost every adult male (that is the average civilian) has served and this is part of the cultural fabric. The assertion that such people will have predictable responses, a common perspective or some other strongly manipulated mind set by the military is giving the military far more credit than they possibly deserve.
But as Davi points out we are avoiding the point of "...corellation between idle passtimes and security clearances...".
Do role playing games affect the ability of someone to be considered trustworthy? (The IDF doesn't say so - but they seem to be saying that LARPers are required to get further psychological testing.) I don't see evidence that such people are any less trustworthy.
How about the other statement? Are people who are 'easily impressionable' more likely to be a security risk? I can see the concern. I imagine that someone who hasn't reached their positions based upon critical thinking skills is more likely to misplace their trust and be swayed by emotional reactions.
Unlike some - I don't find credible evidence that the IDF really considers D&D players to be 'easily impressionable'.
I also do not find credible evidence that creative or imaginative people are 'easily impressionable'. The leap is just too great for me to make.
Meanwhile, the US Marines use images of knights slaying dragons in recruitment videos, while the US military will only let gays serve if they lie about their orientation. Well and Donald Rumsfeld still has his job. To expect any sense out of all this is rather a stretch.
I'm an IDF officer. If you want to challange that, fine, because I won't show you my credentials, so either take it in good faith or don't.
The process of security clearence is not as simplistic as it's made to be. Like anywhere else, people are questined, their relatives, acquaintences, elementary school teachers, the works. Not unlike the Us clearence process, probably like any other.
The process is not followed through on every soldier enlisted in the IDF. Not even for every officer. Only those who need access to classified information. It may be done at the time of enlistment, and it may be deferred to a later date, depending on the soldier's placement in the system.
Most of the soldiers may tell about their D&D habits and serve - if they like - more than the compulsory 3 years, because their clearence level doesn't need to be high. In fact, most of the jobs in the IDF do not require a high clearence.
For the few jobs that do need high clearence, the process does involve psychologists and other means I will refrain from mentioning. If you do mention you are into role-playing, it may influence the psychologist when reviewing your material, but it's hardly a single factor. If you enjoy D&D and are otherwise mentally healthy, there's no reason why you can't have a high clearence.
If you come to your interview and say that you really enjoy the friendship of Gnor, the 7th level Ork you had lunch yesterday with, it might present you in an unfavorable light. Unfortunately, some people ARE prone to say that, and it seems very natural to them.
Needless to say, the newspaper has exaggerated. It's not like people are standing in line and asked in turn if they do D&D, and if they answer with the affirmative they are sent to room 101. There is a one-on-one interview, it's part of the process. It's not black and white.
Oh, and the pictures the newspaper used are there not because they are any indication of what people play. Most people in Israel, like anywhere else, stay in the realm of dice and scoresheets.
Well I may agree that FRP addicts may be independent individuals (contrary to the military order) But they also have an unlimited creativity, which is invaluable for Infosec profession... (and special forces in military)
I think we are all missing the real point of this article. D&D is mostly popular in Russia. Probably heavy vodka drinking and accordion parties are also viewed with suspicion. Israeli is not a real nation. It is a country founded relatively recently that is desperately trying to build a new Jewish national identity, with much debate. Members of the Israeli army or Israeli society in general who display or cling to old national identities will all be suspicious or challenged. If the army let all the â€œfreshï¿½ï¿½? nationals cling to their old languages and habits they may feel a threat.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.