Schneier on Security

Davi Ottenheimer • April 22, 2005 1:49 PM

Hear hear! Excellent read.

Just a couple exceptions to jump out at me:

1) CSOs are not usually trained for preventative measures in the workplace. They talk a good game (because it’s part of the job) but awareness and education are typically given far far less emphasis than the detective measures such as incident response teams, forensics, and such.

This parallels a shift that is sorely needed; a move away from the style and training of a more traditional (military/peace officer) security expert who thinks that the more attacks they stop the more successful they are. Instead of this “stop, who goes there” syle of leadership, we need more “how may I help you build trust” leadership.

2) The top “killers” listed are mainly health issues. With regard to my first point, we should think carefully about more preventative measures to reduce death as well as detective and corrective measures. I believe the cures are most often based on a simple change in habit or lifestyle, or perhaps even better testing and regulation of toxicity. We would be wise to stop thinking that everything is solved with a magic pill (pharmaceutical) or expensive and technologically savvy last-minute procedure (emergency response).

3) I know I sound like a broken record, but CSOs can actually be in an awkward position that prevents them from effectively guiding policy. Influence, yes; guiding, only with extreme caution. Take for example the top-ranking military experts (Graves, Powell, etc.) who warned not to create a market vacuum in post-war Iraq due to the risk of instability. They were not only pushed aside, but completely removed from their post by the US Administriation that instead sought zealous believers in their fanatical greed-doctrine — Bush sought rich entrepreneurs who thought a vacuum was exactly the type of risk that would make THEM most successful, and therefore somehow benefit US security. Of course it has been a dismal failure, but the important point is that the security experts lost their position and any chance of effecting direct pressure on the leadership. In other words, urging caution and trying to explain and show another side to the “truth” (that the numbers related to safety and security do not add up) can actually just get you fired and replaced by a parrot. And that’s probably why the article is written by Anonymous.

http://www.harpers.org/BaghdadYearZero.html

But I still think it’s a great piece that makes for excellent reading. Thanks for posting, Bruce.

Davi Ottenheimer • April 22, 2005 6:27 PM

@mark
Yes, you’re right. The author of the article focuses on the budget issue and seems to suggest an approach that is commonly found in Quality Assurance (QA) models. It starts with the notion that in order to get the biggest bang for the buck, you need to rate and then prioritze where resources are best applied.

The problem with this approach is that it depends on people having a similar or at least compatible set of values. For example, in order to agree on the top ten risks, we need to have a common understanding on the value of assets, the number of vulnerabilities, and the level of threat.

In other words, when the author says “assume, first of all, that the ultimate goal of security is to prevent the loss of lives”, he simply writes himself out of the picture of current events (and out of the Bush Administration). Clearly the War on Terror is not about saving lives; the Bush Administration is banking that by expending lives, and killing thousands, they can expand corporate influence over the public sector and prevent market regulation. They then hope that this will improve the quality of life by breeding rapid entrepreneurial growth, eventually making it possible for some to have a very high standard of living…ala Milton Friedman economics. I know it sounds harsh, but the people who look at the facts (including this article) all seem to arrive at the same place — the Bush Administration does the opposite of what appears to be good for America.

Fundamentally, therefore, when the author states “We have expertise in knowing where the government should be putting its poker chips” s/he is actually saying “we respectfully disagree with the core values expressed by this government”. That kind of difference of opinion makes it difficult, if not impossible, to suggest a minor change in priorities.

Davi Ottenheimer • April 25, 2005 10:34 AM

@Stuart
My point exactly, many CSOs would love to be more proactive, but the fact is the budget and culture of the companies they work for rarely allow it.

I mean, just imagine people without a clue about security in senior executive positions wandering around saying “that is simply lame”. Some might say it is not even worth responding to such nonsense, but alas, security is about doing the right thing. And sometimes you must press ahead with a different path when you run into a non-intelligent response that reveals a faith-based blinkered grasp on reality.

Also, you perhaps will be happy to note, if you actually read the news, that it is not my analysis of US policy.

Davi Ottenheimer • April 25, 2005 7:40 PM

@Stuart
A better retort, to be certain, but you still miss the mark. I’ll take back my position (that the Bush Administration clearly defines “safety” and “security” in terms of economic gain and opportunity for their backers, not in terms of saving lives), but only because I am probably giving too much credit. They have cleared out the bank but not actually saved lives, so perhaps they are simply unfit to rule.

Don’t get me wrong. I am not against humanitarian intervention or pre-emptive strikes when warranted. For example, it seems to me that Israel’s bombing of the Osirak nuclear facility in Iraq in 1981 has been widely regarded as a wise pre-emptive strike for a country that wanted to ensure its safety.

So although you are correct that the Bush Administration sent in Bremer to “render terrorism useless”, his policies actually did exactly the opposite by completely destabilizing and destroying the existing infrastructure and creating a complete vaccuum with little or no opportunities for stability — a situation where violence clearly trumps entrepreneurship and professionalism. Experts warned against this.

Which might actually bring us full circle on this topic. CSOs should be enabled to perform risk analysis such that they can help their employer/owner (e.g. shareholders) avoid predictable disasters. Their warnings should be respected and documented.

What do I mean in terms of Iraq? Consider that Bush said he’d run the country as a CEO would. Well, it turns out that he’s the type of CEO that would never allow a CSO to function properly:

(from the neoconservative Bush-backer Robert Kagan)
http://www.washingtonpost.com/wp-dyn/articles/A59795-2004May1.html

“Bush himself is the great mystery in this mounting debacle. His commitment to stay the course in Iraq seems utterly genuine. Yet he continues to tolerate policymakers, military advisers and a dysfunctional policymaking apparatus that are making the achievement of his goals less and less likely. He does not seem to demand better answers, or any answers, from those who serve him. It’s not even clear that he understands how bad the situation in Iraq is or how close he is to losing public support for the war, a support that once lost may be impossible to regain.”

I submit that no CSO worth his/her salt could survive under that leadership, let alone try to argue risk or present the facts related to the safety and sanctity of human life.

http://www.washingtonmonthly.com/archives/individual/2004_05/003829.php

“George Bush is genuinely committed to winning in Iraq. He just doesn’t know how to do it and doesn’t have the skills, experience, or personality to look beyond his own instincts in order to figure it out. America is about to pay a heavy price for that.”

Davi Ottenheimer • April 26, 2005 12:41 AM

And here’s some more reading on why it is verboten to dissent with the Bush Administration:
http://www.time.com/time/magazine/article/0,9171,1053595,00.html

White House spokesman Trent Duffy explained on Sunday that telecommunications experts who were found to support Kerry in 2004 were removed from the Inter-American Telecommunication Commission. He said “wanted people who would represent the Administration positively” rather than people who were experts in their field. “Only after the start of Bush’s second term did a political litmus test emerge, industry sources say.”

Again, it appears that if you want to participate in politics yet hold a position counter to the Bush Administration you should also expect to be dumped like yesterday’s lettuce. So unless the CSOs in question were generous donors to the Bush campaign, or they are experts in disguise, they have little or no chance of positively influencing this Administration through traditional methods.