Schneier on Security

Roger • May 17, 2006 4:04 AM

Could I please request that if you want to submit more ideas, please do it at the thread for that purpose, here:
http://www.schneier.com/blog/archives/2006/04/announcing_movi.html
If people keep submitting more ideas to this thread, it will soon become impossible to read the votes.

Also, if you do want to submit more ideas, please read the submission rules! There are some 830 submissions already, but by my reading only ~8 % actually qualify according to Bruce’s criteria.

I downloaded the page and popped it in a text editor so I could sort through them one by one, and so far I am up to #390. So far, there are only 32 that I haven’t dismissed out of hand. Common reasons are:
* Many are just jokes, involve nonexistent alien super-technology or a “deus ex machina”. While some are hilarious (I particularly like jepler’s scenario #3 about terrorist spam!), this isn’t what we’re after.
* Many involve people speculating about engineering fields with which they are not familiar, and are in fact physically impossible. Conversely there are quite a lot where the risk is already known to engineers and already adequately safeguarded.
* Some scenarios — in fact most of the more serious ones — present a plausible scenario but don’t explain how they could “Inflict lasting damage on the U.S. economy. Change the political landscape, or the culture.” They just present a novel method for murdering people, for which the response would likely be a few days of heightened anxiety and a modification of SWAT tactics.
* A lot of scenarios go way, way over budget. You are supposed to have no more than 30 unskilled terrorists and a budget of $500,000. (You can buy specialist skills for your terrorists but Bruce explicitly said it must come out of your $500,000. Figure ~$150,000 for a science or engineering Ph.D., depending on school.) In fact a lot of posters just seem to have no idea what you can get for $500,000. People, you cannot buy Diebold or even a trucking company for $500,000. Think something more like a small general store/gas station — and even then only outside city limits.

Unfortunately, ~70% of the remaining plausible, on-budget scenarios centre around specific risks that some security expert has already tried to raise an alarm over. For example, there are a couple of good scenarios about attacking critical points of the electrical grid, oil pumping stations, or bulk fuel tankers, or hijacking trucks transporting dangerous goods. But those are all vulnerabilities which various security experts have already raised! Bruce’s point is to show that the possibilities are endless, so it is no use to focus on risks that have already been published. If you just repeat someone else’s scenario, you reinforce it instead of exposing its excessive specificity.

Roger • May 24, 2006 4:44 AM

@Davi:
Well, I’m flattered. I guess!

Man, if only we had a secure voting system to select a winner. 😛

8^). Well, I have waded through the list, and oddly enough, my vote is about voting systems.

My vote for the winner is for Lizardo’s plot, which he called “Election Day”, and is linked from my name below (warning: big page!) This plot is well within budget (probably <$3000, and half a dozen people), requires no unusual skills and very little preparation, is quite likely to cause political changes (perhaps even alter the US Constitution), and TTBMK has never been proposed before.

Actually it is alarming enough that I feel quite uneasy talking about it, but, well, it has already been published…

Basically, in midterm elections a handful of gunmen or snipers shoot voters at random polling stations on the East Coast and early bird voters or election workers in the Midwest, so by the time the West Coast votes, attendance is way down. The election is called off, or invalidated.

Suggested minor variation: instead of random polling places, the terrorists murder only members a particular minority, so it is harder to avoid invalidating the results.