Schneier on Security
A blog covering security and security technology.
« Secure Flight News |
| Fingerprint-Lock Failure in a Prison »
September 26, 2005
Man Arrested for Being A Computer Nerd
In this disturbing story, a man is arrested in the London subways as a terrorist because, well because he was acting like a computer nerd.
At least the police didn't shoot to kill.
EDITED TO ADD: This picture was supposedly taken in the London Tube a few weeks after the first set of bombings.
EDITED TO ADD: Snopes says that the picture is a fake.
Posted on September 26, 2005 at 12:12 PM
• 51 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
This is ridiculous; profiled because he was playing with his phone and other geek hardware.
To my mind, this is the weird part of this story:
"The officer explains what made them change their mind and arrest me.
Some staff had also been seen photographing tube stations with a camera phone."
How did they know this?
The only plausible explanations I can come up with involve a large amount of barely-targeted population surveillance and data retention, on the basis of not very much at all.
If they were doing this, I wonder what other activities are considered suspicious enough to trigger further targeted surveillance, and subsequently to mark people out as suspicious, and retain that information?
The UK of 2005 is looking an awful lot like the USSR of 1975. And the US is in competition.
And because he was "carrying a bulky rucksack, and kept [it with him] at all times".
So a loudspeaker repeatedly bleets "Keep your bags with you at all times" and then you are told it is suspicious to keep a bag with you at all times.
This is like the worst kind of security imaginable. Lacking any reliable profile or signature of an attack, the authorities will weaken their credibility by continuously creating confusion and making illogical mistakes. In a corporate setting this kind of security would be bounced out on the street in no time. The next step in the wrong direction will be if they say that resistance to their lack of logic means that they will have to further curtail public freedoms to win support.
As the old saying goes, when all you have to work with is a hammer then everything starts to look like a nail...
One wonders if the true terrorist organizations out there aren't looking at the U.S. and U.K. and saying amongst themselves, "How kind of their governments to do our work for us."
I'm far more worried about being unjustly detained or shot in the head by an paranoid police officer having a bad day than I am about being killed by some stereotypical AK47-toting, suicide-bombing, towel-headed jihadi.
On flights, I'm far more inconvenienced by the TSA than by the IRA. I think I'm going to start avoiding most of the trouble by getting transparent suitcases and flying naked. I won't have my privacy, but at least I'll still have my dignity. Sort of.
With governments like these, who needs terrorists?
I guess as a Brazilian and a nerd, i should stay the heck away from London, especially the subway! :-)
Great, I live in a police state.
It's enough to make me to the US :-)
Are we terror-ized yet? I would speculate that no more attacks need to take place, the terrorists have completed Phase 1 of the mission. Sadly, Phase 2 is to simply sit back and watch us do ourselves in.
And now we're slipping dangerously close to martial law after disasters.
I'm constantly reminded of the old wive's tale about the frog in the pan of water. The heat is coming up and no one seems to notice the bubbles.
"One wonders if the true terrorist organizations out there aren't looking at the U.S. and U.K. and saying amongst themselves, "How kind of their governments to do our work for us." "
Exactly. I'm sad and frightened that terrorists actually succeeded in making us terrified with our armed forces and vice versa. The thought of dying due to police mistake is more unacceptable, more horrifying to me than dying from a terrorist attack.
I laugh at the Americans for chosing Bush as President.
I also laugh at the English, is this security?
This is what happens when people are afraid of being blown up, coupled with a sincere belief that the authorities are not going to do anything to them that will have lasting negative repercussions. It goes on all over the place, and happens over and over. While it sucked to be Mr. Mery at the time, his fellow Britons (like most Americans, I suspect) feel that him getting the treatment was a small price to pay for them avoiding a fiery death in the Tube. Of course, when it's THEM who get the treatment, the system is broken, it's an outrage, et cetera, et cetera. But until then - they listen to their fears - and fear makes people willing to sell out their neighbors, and look the other way.
But there should be a tolerance for false positives, along with enough transparency so that people can judge how effective the police are being, and know what trade-offs they're making.
David Mery: "I went into the station without looking at the police officers at the entrance or by the gates."
My personal policy whenever I see a cop is to stare at him, as I've got good odds he's up to no good. Wild as they can get, cops still need to fear witnesses for their own prosecution.
Lyger - False positives are sure to occur, so every system that is known to create them must have a way to delete them, so that innocent people are not further harmed.
It is one thing to bring someone who is deemed to be behaving suspiciously in for questioning and search their flat, but another to leave them with a permanent arrest record. Are they to be forever unemployable because of a police error?
@ Lyger & Mary R
I think that you've missed the point. The objective of this sort of arrest is precisely to show "the police are doing everything they can". They get called out by the Guardian, they ultimately admit it's a false positive, and they are pleased with the net publicity. The police do not benefit if false positives are eliminated, because it's indistinguishable from "doing nothing" over the short term. Their agenda is to get good publicity, say once a week. If a week goes by and there don't happen to be any real terrorists to arrest, perhaps the terrorists are watching too much cricket, then they need to arrest someone like Mr. Mery. The US aviation security force even admits to "randomly" searching people, so that the other people in line see someone being searched. It didn't seem random to me, it seemed like they did it when nobody matching their profile had come by in the last 20 folks. The queue isn't long enough for you to see someone searched if they let more than that many people go by without searching someone.
I'm surprised nobody commented on the most improbable aspect of that article: the nerd has a girlfriend! Obviously a fabrication... oh, i see, the guy also wrote the story. :-)
My God, the Patriot Act madness is reaching Europe... :-(
He's a French nerd. That may explain the girlfriend. :^)
Truly amazing. Of course, here in the land of the free a bill wasn't a bill just introduced to permit the taking of DNA samples from all arrestees?
Wait... I was under the impression that the terrorists weren't supposed to change the way we live. Yet we pass laws that undermine our civil liberties and curtail freedom, all in the name of the illusion of security. Did I miss something?
"One wonders if the true terrorist organizations out there aren't looking at the U.S. and U.K. and saying amongst themselves, 'How kind of their governments to do our work for us.'"
I disagree. In my opinion the ultimate goal of these terrorists that you speak of is not to cause a change in the way the U.S. and U.K. deal with their own citizens, but to change the U.S. and U.K. policy toward the countries/areas that the terrorist reside in; in other words to get out of those countries and stop meddling around in their business. These extreme/fundamentalist Islamic terrorist groups outside of the U.S. and U.K. do not care what happens to the citizens of those two countries--unless they are muslims that subscribe to the same interpretation of the koran as they do of course.
"Wait... I was under the impression that the terrorists weren't supposed to change the way we live. Yet we pass laws that undermine our civil liberties and curtail freedom, all in the name of the illusion of security. Did I miss something?"
Blame that on the people that are supposedly elected to serve their constituents and the people that continue to vote them into office. Obviously there are many in power that are taking advantage of the current climate in the world to further their own agenda.
I think you have it right. This apparent idiocy is not incompetence at all. It is the authorities showcasing their 'proactiveness', being very heavy-handed not only to impress the newsies, but also to scare the public.
How else would this from Scotland be explained?
"Of course, here in the land of the free a bill wasn't a bill just introduced to permit the taking of DNA samples from all arrestees?"
In California, such a proposal is already law (Proposition 69, passed last November 62%-38%). It's coming into effect in stages, but has already been challenged.
Basically, DNA is now collected from all adults and juveniles convicted of any felony offense; all adults and juveniles charged with sexual or arson offenses (or attempts thereof) of any degree; and all adults arrested for murder or voluntary manslaughter. Beginning in 2009, any adult arrested for any felony offense must submit to DNA collection.
My understanding is that this has already led to a number of open cases being solved. Whether this is going too far, I've not thought much about.
Here in the good ol land of the OZ, we are today in the process of debating the same draconian laws that have led to the above story.
Our honorable PM Mr Howard is going to "convince" all the state chief ministers how these laws are going to help us ensure our "freedom".
I think i might trade in my rucksack for a briefcase or something:)
Thanks for the details on the CA DNA thing. The link I tried to find before and which prompted my remark is this:
According to the article, anyone "detained or arrested" by Federal officials could be forced to provide a DNA sample.
Where is the corporate rucksack/backpack lobby when you need them?
Someone from JanSport, Karrimor, NorthFace, LL Bean, etc. should be on a plane to London right now...
I remember a spate of tech articles awhile back suggesting ways to discreetly disguise your laptop bag as a rucksack, or to fit out your rucksack for a laptop, due to the problem of being robbed while carrying a laptop bag.
Good thing I never paid any attention to them.
I'm begging for death. Being the bohemian nerd that I am, I made my laptop bag out of duct tape and put my tools in an ammo case. Thank god there isn't good public transportation in the USSA for me to take. Here we go again. The problem isn't finding terrorists, but the system failing in a horrible way. For some odd reason he got tagged by the police. Even after finding out he had no bomb stuff on him, just ordinary personal items, the cops /still/ felt it necessary to keep his stuff and search his house and process him like a criminal caught in the act. There was no reason to escalate the incident past the train station because nothing was found. Very poor use of resources. It's like when my customers keep replacing fuses even after the equipment keeps immediately blowing them.
Ah, the "too warm for the season" line; that was used on me in Vegas as a reason to search me, though thankfully no detention or such. They claimed that my jacket was unseasonal and thus was suspicious, which was funny for two reasons:
1) They searched my bag (containing, surprisingly, a laptop and camera) but never bothered to actually search my jacket.
2) My "jacket" was a type of shirt being worn by soldiers stationed in the mideast, so it's not exactly inappropriate for the heat. I was going to mention that, but I was a little concerned about saying the word "mideast" to these folks.
I always figured that between the US and Britan, the US would be scarier to be stopped. I guess they're so paranoid of "letting one go" they'd rather make absolutely sure even in the absence of any evidence on the spot. Hurrah for freedom.
Too late... They just agreed to pass the bill. Damn. There goes my 7 year old backpack :(
Well, if you rely on human profiling (as advocated by Mr. Schneier), aren't you going to get false positives some times? What is the solution, apart from "better profiling skills"?
My thoughts exactly viking.
The account given states that he was approached because his collective behaviour and appearance made him suspicious. What the officers cited seemed quite reasonable to me. Seemed like good profiling not bad.
Terrorist have won the peace. I guess that you can choose to leave the bag at home, not wear a coat, don't use the cell phone is a public place or avoid public transport, working from home must be an attractive options for Brits these days. For a more attractive one, you can always emigrate to New Zealand, we don't (yet) get any of that bullshit here.
You can't eliminate false positives, but you can minimise their impact.
Having an arrest record is a Bad Thing!
Having your fingerprints and DNA on databases all over the world flagged as "was arrested for suspicious behaviour under the terrorism laws" it potentially even worse.
Stopping and searching this guy was a little weird, but not completely out of line. But once they discovered that he was not, in fact, carrying explosives or in fact doing anything criminal, they should have sent him on his way. If this story had ended with the search being over and the police departing, it would not be getting much attention. Instead, this person had his apartment searched, a mark on his permanent record, and appears to have permanently lost many personal belongings, despite the fact that the initial search found nothing wrong.
"Some staff had also been seen photographing tube stations with a camera phone."
How did they know this?"
They police have a colators file for every person who has been stopped for whatever reason, your details are entered and stay there (possibly for ever). There is a recorded case of a local councilor being refused a seat on the local "Police Commity" as the police objected. After investigation it was found that his car registration had been recorded in a "Known red light" district, and the info had ended up in his colators file. It turns out that infact he was visiting his sister for dinner once a week and her address was in the middle of the red light district.
It is also known that the police stop people for the flimsiest reasons, simply to make sure that they have a sufficiently filled out note book to avoide problems from above.
My guess when the staff where doing their "treasure hunt" one or to of them where stopped and questioned. The information ended up in their individual files and was cross reffrenced against their employer. If you read the story he was going to be released untill he mentioned his employer.
The most frightening aspect of the story as far as I am concerned was the falsification of statments they tried to make him sign.
It is fairly clear from what he said that the corrections he was making, where to inacuracies that the police had "deliberatly" made to cover their own backs (ie about having wires hanging out, playing with electronics).
The moral is if you get pulled read the statment line by line and check it thoroughly and not be preasured into signing it. And if you find errors, don't tell the police simply write across the page "This is a falsification of the facts" or some such. I suspect that the police officers will quickly get fed up of having to re-write it each and very time.
"I am asked for her phone number. I don't know it - it is stored in my phone - so I explain it is with the officer at the desk."
He didn't even know his girlfriend's phone number because he relied on always having access to some unreliable, removable gadget. What a dork.
his employer dispatched him and his co-workers to go out around london and have their photographs taken with police officers as a what, a team-building exercise???
the concept of teams has been way overdone in the modern corporate milieu. one tough, smart ronin can wipe out your whole team.
"I disagree. In my opinion the ultimate goal of these terrorists that you speak of is not to cause a change in the way the U.S. and U.K. deal with their own citizens, but to change the U.S. and U.K. policy toward the countries/areas that the terrorist reside in"
True enough, that is the ultimate goal. One good way to acheive that in a democracy is to terrorize the populace until they elect an administration which promises to give the terrorists what they want. If that is, indeed, their strategy, then Eric's post is right on. Many people in the US and the UK are standing in line to give them what they want, and our governments are doing whatever they can to put more of us in that line.
It's been said that if you do the big stuff, don't do the small stuff ... that is, it's not the trunk full of C4 that will get you caught, it'll be driving too slow or too fast.
Is it even reasonable to suspect that a terrorist bomber is going to have his eyes down and scrupulously avoid eye contact with the police? Surely, there has to be more to heightened awareness and profiling than this?
Perhaps the photos of the London transit bombers doing their 'recon' would prove the lie to the rationale offered David. Do we see the suspects staring at the floor, avoiding cameras by hiding behind crowds, etc.?
No. They did it right out in the open, and NO ONE thought anything was out of place.
The 'profile' that hit David right between the eyes seems to be based on behaviors of other types of criminals - like shoplifters or petty thieves. It failed because it's applied in the wrong place. Perhaps what they need to be looking for is someone who is behaving more like a pickpocket.
And the whole 'unseasonable jacket' is STILL a poor indicator, especially now that we're headed into the Fall/Winter season. We have to be smarter/more adaptable than this, or the terrorists will score again while we're busy looking at the wrong thing.
We're looking for someone who won't stay on vacation during natural disasters, Use circumstances to spend U.S. lives and billions conducting wars against family mistakes and family business allies' enemies, while feeding juicy no-bid contracts to still other old business partners and former employers and associates - at the expense of the real goal of protecting this nation and of finding real justice for the '01 attacks (6 foot+ Arab male towing a dialysis machine though the mountains of Afghanistan... Anyone? Anyone? ...).
We're looking for someone who won't seek to turn the country into a police state that serves the <1% ("ownership society" means "the bank shareholders own you through your home, your auto, and your credit cards").
We're looking for leadership who doesn't think first of putting the military in place of an effective civil response management (federal and regional) - apparently that "less government" mantra really should end with ", and dang’it more military", who won't through civil liberties and the Bill of Rights out into the trashcan, because "They hate us for our Freedom"...
It's possible to have a natural disaster (a major fire, tornado, or earthquake) that we wouldn't have advance warning for ... which is why our shoddy performance with Hurricane Katrina is even more disturbing.
And it's a joke when the Vacationer-in-Chief tries to position himself as Crisis Manager-in-Chief as Hurricane Rita comes whipping in from the Gulf. Nobody's buying it, Mr. Bush. Nobody's forgotten that you were on vacation, and your appointed 'experts' couldn't pick up a phone and authorize a response. They had to write memos and hold meetings and (allegedly) figure out who was going to break the bad news to you.
As bad a story that this is I think people are being a bit reactionary. This guy was just unlucky, maybe he should have thought about what he was wearing and doing before he went out? He shouldn't have to at all, but ultimately he has no control over this, so maybe should have thought ahead a bit.
At the end of the day this is just one person and potentially a few more that are unlucky enough to have their time wasted because of what a few disaffected Islamic extremists decided to do a few weeks before.
Now I sound a bit like a right-winger there, but because of the hopelessness of trying to stop a suicide bomber and the police having to show that they are doing something it's not exactly shocking that something like this has happened.
Those in charge of security see this as a war and it's not as though the enemy in this case wear a specific uniform and fly a flag so you know who to shoot at. I believe they just can't take the risks when the lines are so blurred.
Governments can do many, many right things and be picked up on one wrong thing. Terrorists can do many things wrong but only have to achieve one of their aims to get their message across.
Even if the stories of people like this being stopped by such loose profiling exists surely if anyone was thinking of bombing again they might either be caught or abandon because of increased chance of being caught before hand.
The title was a bit sensationalists I think “ Man arrested for being a nerd��?. There must be many thousands of nerds who use the underground in London, just not many nerds that wear coats in summer dressed in dark clothes carrying large rucksacks acting perhaps a little out of character with links to a slightly suspect goings-on previously in the company he works for.
It just goes to show that spin is in the press.
It has nothing to do with the spin.
It has everything to do with the fact that the profile being used to identify suspects doesn't work.
Let's credit the terrorists with some intelligence. In order to pass muster on visual appraisals, you need to look like everyone else. Therefore, the profile that says terrorists will:
- Not look up. (Go watch a teenager walk some time. Heads down, shoulders slumped, feet shuffling.)
- Not look at police. (And yet, if I were to study the police, I'd probably get pegged, too.)
- Wear heavy jackets during the summer. (This thing has more legs than a centipede. It's a stupid concept - it only works during hot weather, and not even that, depending on fashion and region. Kids out here wear bulky 'starter jackets' all the time!)
- Have wires hanging off their person.
- Have coworkers who were observed photographing tube stations in recent weeks. (Frankly, if I require reconaissance photos, I'm not going to ask a non-involved person to do it, as they will likely get arty on me and give me closeups of underground signs, rather than the cameras and angles I need to see; if I do it in person, I'm going to be there with friends or a significant other, position myself, and ask a tourist to snap the photo for me. This happens all the time and we don't think twice about it.)
... is garbage. Garbage in, garbage out.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.