Schneier on Security
A blog covering security and security technology.
« Deep Throat Tradecraft |
| Attack on the Bluetooth Pairing Process »
June 3, 2005
Billions Wasted on Anti-Terrorism Security
Recently there have been a bunch of news articles about how lousy counterterrorism security is in the United States, how billions of dollars have been wasted on security since 9/11, and how much of what was purchased doesn't work as advertised.
The first is from the May 8 New York Times (available at the website for pay, but there are copies here and here):
After spending more than $4.5 billion on screening devices to monitor the nation's ports, borders, airports, mail and air, the federal government is moving to replace or alter much of the antiterrorism equipment, concluding that it is ineffective, unreliable or too expensive to operate.
Many of the monitoring tools -- intended to detect guns, explosives, and nuclear and biological weapons -- were bought during the blitz in security spending after the attacks of Sept. 11, 2001.
In its effort to create a virtual shield around America, the Department of Homeland Security now plans to spend billions of dollars more. Although some changes are being made because of technology that has emerged in the last couple of years, many of them are planned because devices currently in use have done little to improve the nation's security, according to a review of agency documents and interviews with federal officials and outside experts.
From another part of the article:
Among the problems:
- Radiation monitors at ports and borders that cannot differentiate between radiation emitted by a nuclear bomb and naturally occurring radiation from everyday material like cat litter or ceramic tile.
- Air-monitoring equipment in major cities that is only marginally effective because not enough detectors were deployed and were sometimes not properly calibrated or installed. They also do not produce results for up to 36 hours -- long after a biological attack would potentially infect thousands of people.
- Passenger-screening equipment at airports that auditors have found is no more likely than before federal screeners took over to detect whether someone is trying to carry a weapon or a bomb aboard a plane.
- Postal Service machines that test only a small percentage of mail and look for anthrax but no other biological agents.
The Washington Post had a series of articles. The first lists some more problems:
- The contract to hire airport passenger screeners grew to $741 million from $104 million in less than a year. The screeners are failing to detect weapons at roughly the same rate as shortly after the attacks.
- The contract for airport bomb-detection machines ballooned to at least $1.2 billion from $508 million over 18 months. The machines have been hampered by high false-alarm rates.
- A contract for a computer network called US-VISIT to screen foreign visitors could cost taxpayers $10 billion. It relies on outdated technology that puts the project at risk.
- Radiation-detection machines worth a total of a half-billion dollars deployed to screen trucks and cargo containers at ports and borders have trouble distinguishing between highly enriched uranium and common household products. The problem has prompted costly plans to replace the machines.
The second is about border security.
And more recently, a New York Times article on how lousy port security is.
There are a lot of morals here: the problems of believing companies that have something to sell you, the difficulty of making technological security solutions work, the problems with making major security changes quickly, the mismanagement that comes from any large bureaucracy like the DHS, and the wastefulness of defending potential terrorist targets instead of broadly trying to deal with terrorism.
Posted on June 3, 2005 at 8:17 AM
• 29 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
"...what was purchased doesn't work as advertised."
"After spending more than $4.5 billion on screening devices... ...concluding that it is ineffective, unreliable or too expensive to operate."
Under "normal" circumstances, wouldn't this be considered "war profiteering"? Why are we not holding Senate hearings to investigate these companies that sold the US Government such bogus equipment?
Hopefully, we can at least get some satisfaction that the US Government pumped $Billions into the US economy as a result of all this spending.
Before anyone starts the rant, remember the constitution states that congress decides what gets spent where. Its the presidents job to spend the money but only as congress dictates.
That means that *both* parties are at fault since there is review of contracts and such (remember how congress stopped the S&W backdoor contract clinton did? They really do have the power to review and stop contracts. Further at that time it was not a republican majority so it really is very fair to say its *both* parties).
"There are a lot of morals here"
I wouldn't say they were morals but they certainly are dilemmas. There is no winning "solution" that will make things better, only "solutions" that will try and make things _not_ worse.
Nothing is more grotesque than seeing CEOs eyes light up when talking about the marketing opportunities in anti-terrorism in hopes of peddling more FUD and draining the economy dry.
1) According to these articles, security is no better than before 9/11/01.
2) We haven't had any airline incidents, and shopping centers haven't been blown up in the last four years. Just lots of false alarms.
Therefore, why isn't someone asking the obvious: whether police-state mechanisms like US-VISIT are necessary at all? What has happened in the last four years that these programs are supposed to prevent?
The U.S. is a big country. To try to secure it takes a lot of money.
There are 5,000 airports, 350 Ports, 100 (legal) border crossings, and 38,000 post offices. To spend $4.5 Billion, each location is getting an average of about $100,000.
If you think this is a lot, you'd be amazed at how much money the Department of Energy spends on pest control each year.
Its not wise to spend all the money in one place.. A better approach would be to find the biggest target and spend just enough to protect it to be equal to the #2 risk. Then spend just enough on those two to make it equal to #3. Continue with this until the top 50 or 100 most vulnerable targets are equal.
That would reduce some of the police state issues, as well as save dollars. But everyone wants their local politician to say 'we got XXX dollars and are going to make you 100% safe' which is an impossibility, and if they harden a target too much terrorists (domestic or foreign) will go to a softer target. So it just wastes money to make this uber hard targets unless you can make *everything* uberhard, which they cant without spending many many trillions of dollars.
This wasteful spending is just one of the many many reasons that is forcing me to escape America to somewhere else. The system is too broken and I feel will take at least 20 years to get fixed.
I don't know the situation will improve anywhere else. Few politicians look for the best solution, settling for that which brings them the most support (e.g. the most money into their districts in the shortest time). Generally leads to half-baked solutions.
Bunch of crap. I'm sure that they buy a "security" machine for $50,000, and some government scumbag who I'd like to murder shoves $10,000 of that in his pocket.
This is the America that people seem to want.
I just bought three airline tickets. I noticed a $10 "9/11 Security Fee" on each. How lovely.
This approach by our government is security "for the sake of doing something". The traveling public would likely abandon airtravel if it *appeared* that nothing was being done. So you have some of these measures. And they get more intrusive as the profit motive increases.
"The traveling public would likely abandon airtravel if it *appeared* that nothing was being done."
I doubt that. On the other hand, I know people who are abandoning air travel precisely because of what the TSA is doing for appearance' sake.
It's called shock & awe isn't it? Shock that we spent all that money for doodads that don't work, and awe that we manage to keep doing it. But Hey! It's only "government" money right? (LOL!)
Smaller countries tend to have the government and people closer together. Further each vote counts a whole lot more becuase there are so few votes. I am planning on going to a developed country with a population of 4 million or less (yes one exists, even has dsl, cable modems, wifi all over, and one of the fastest source forge mirrors to the US I have found). The political situation there seems much better.
But you can pick your own http://www.votewithyourfeet.org/ :)
And all the while they are bleeding basic scientific research funding dry.
Air travel is a private enterprise, one in which large corporations are even trying to reneg on their pension promises (hey, isn't that breach of contract to many thousands of employees?).
We should stop pretending that one form of transportation needs so much governmental help. If the airlines cannot secure their services, people will not buy, and they will go bankrupt. That's the free market.
Sure, police should investigate any crimes against these companies, but taking over their security and forcing taxes on to pay for them isn't the solution.
After all, if the airlines simply kept the cockpits secure, the 9/11 type attacks could not take place, nor could hijackings. Sure, they could kill people on board, but then it's not a whole lot different than them killing everyone on a bus, train, in a building set on fire, driving a car bomb into a crowded theater, etc.
Besides, I'm sure the airlines would be happy to put in security measures that protected their industry at the level that made sense. Too much security will drive away customers. Too little will make customers afraid. But with government interference, we just lose billions of tax dollars, enriching already rich folks with the promises of security (left unfulfilled) and there's little recourse because government programs have lives of their own.
It's too bad that security theater has to win out. Nobody wants to address terrorism head on for fear of "negotiating with terrorists." Well, secrecy will keep terrorism alive and strong, with things like torture, invasions of countries unrelated to terror in the U.S., etc. Perhaps we need more public dicussions and more open and honest dialog.
If the terrorists really are crazy (and most are in my opinion), then we should talk to them in public so everyone can see their views and then support will drop off. As long as we bomb them, they'll have reasons to continue to bomb us.
The Christian tradition suggests that peace can be found through love, not war. The democratic ideal suggests that peace can be found through open dialog, educated people, and power to the people instead of big governments. Capitalist ideals suggest that peace can be found through economic prosperity, not through destruction and taking money from all people and redistributing to the already wealthy.
" if the airlines simply kept the cockpits secure, the 9/11 type attacks could not take place"
If the terrorists knew the cockpits would be fortified another target would have been chosen.
Terrorists (namely the ones deemed responsible for 9/11) plan way ahead of what the general population may be able to undertsand.
There is no simple answer on corrective countermeasures that will satisfy and securify all. It is a roll of the dice every day. Everyone seems to have forgotten this saying: "Sometimes you get the bear and sometimes the bear gets you."
> the wastefulness of defending
> potential terrorist targets instead of
> broadly trying to deal with terrorism.
Don't we need to do both?
"This is the America that people seem to want."
Do people want it, or do lowlife government bureaucrats want it? I'm convinced it's the second, since they have a very good reason to support this kind of world whereas nobody else does. Since they already have too much power and nobody seems to care enough to take it away from them, their influence will inevitably continue to grow until people get mad.
This is why I'm getting fed up with the two-party system. A new party can grow to plurality status in under 10 years (i.e. the abolitionist beginnings of the Republican party), why can't one start 9 years ago?
"... instead of broadly trying to deal with terrorism."
cough, cough, iraq war, cough, cough
changing the political calculus of the middle east is definitely "broad."
"Therefore, why isn't someone asking the obvious: whether police-state mechanisms like US-VISIT are necessary at all? What has happened in the last four years that these programs are supposed to prevent? "
A guy is walking down the street, dragging a 10' length of chain behind him.
A cop asks him what he is doing, and he replies "Keeping away all the elephants". The cop says "I don't see any elephants here".
"See what a great job I'm doing?"
Is the money wasted, really? If the purpose is to reward campaign contributors, then this spending is successful, highly successful.
"Hopefully, we can at least get some satisfaction that the US Government pumped $Billions into the US economy as a result of all this spending."
Nope. Government spending contributes nothing to the economy. It only misdirects resources that would much better have been left in the pockets of taxpayers.
The politicians' response to any "problem" is to throw gobs of money at it and proudly and loudly claim they dealt with it. The fact that most of the expenditures are sheer waste doesn't interfere with getting re-elected.
"Government spending contributes nothing to the economy."
What complete nonsense. Governments are not somehow magically different from for-profit corporations, or not-for-profit corporations, or individual businesses.
Different forms of spending contributes varying degrees to the economy. The economic benefits of a bridge between two communities are the same regardless of whether a goverment or a corporation builds it (for example).
"Governments are not somehow magically different from for-profit corporations, or not-for-profit corporations, or individual businesses."
There is an absolutely fundamental difference. A business cannot use coercion to make you pay for goods and services of no value to you. The government does that routinely.
Further....Obviously not all government expenditures are waste. But those that are simply taking money out of your pocket or mine to give to someone else cannot be justified as creating any net good for the overall economy.
The last and shabbiest defense of a wasteful program is the claim that it "creates jobs." What the public doesn't see, of course, are the jobs that would have been created or saved if the government had left the money in private hands.
My first thought when seeing those billion dollar type numbers was "Gosh, what appalling waste"--just like most other respondents. But then, when you stop and think about it, this really isn't very much money.
Well, okay, it's an enormous amount of money for *ME*, but for a nation of 300 million persons, it's peanuts . $4.5 billion for capital expenditures over 4.5 years is something like $3.30 per person per annum. Or in more meaningful terms, about 1 tenth of a cent per passenger mile; call it about a dollar per passenger for a one thousand mile flight.
Similarly, $741 million to provide airport passenger screening would be absorbed by salaries alone, if they had just 7 minimum wage staff per airport. That's TOTAL staff, not post-9/11 increment. When you consider the hundreds required at places like LAX and La Guardia, it's evident the only way it could be kept so low is by grossly understaffing smaller airports--and even then there wouldn't be much of a budget for equipment or training.
So whether or not any particular part of the expenditure was done prudentially, the overall scale seems to me to be a token gesture. It sure as hell isn't the massive pork-barrel some are making it out to be.
Note 1: Actually, the US annual peanut crop is worth more than that.
"The economic benefits of a bridge between two communities are the same regardless of whether a goverment or a corporation builds it (for example)."
Not quite. If a private enterprise builds a bridge, it will be because the costs are borne by those who benefit from it (e.g., through tolls). When the government builds a bridge, it is under no constraint to expect the benefits will match the cost. Again, it sells because the benefit is local and visible, while the exorbitant cost is invisibly spread among all us taxpayers.
Well, once you get your product certified for "homeland defense" then it becomes pretty much immune to lawsuits. Liability and fitness-for-use become irrelevant.
TSA are a bunch of baboons. I was traveling from St Louis airport with my 1 year old daughter who likes to hold a simple hand towel. The morons forced the towel out of her hand so it can be security checked in the great big machines. My daughter even after few months gets freightens when see sees the security line. TSA along with homeland security are unnecessary and waste of taxpayer money. I hope the ticket taxes don’t get raised again to hire more of these monkeys.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.