Schneier on Security
A blog covering security and security technology.
« Printer Security |
| Malware Distribution Project »
August 7, 2006
CATO on the Risks of Terrorism
Terrorists can be defeated simply by not becomming terrorized -- that is, anything that enhances fear effectively gives in to them.
EDITED TO ADD (8/7): Commentary from BoingBoing.
Posted on August 7, 2006 at 12:27 PM
• 41 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Interesting paper, but I suppose it depends on which continent you live on to how you interpret it.
One man's terrorist is another man's freedom-fighter.
While I agree with 99% of what Mueller says, there is a counter-example to his assertion of the ineffectiveness of chemical weapons: the 1984 accident at the Union Carbide plant in Bhopal, India, killed 20,000 people, and estimates of others maimed are in the 120,000 range.
It is true that the area was much more densely inhabited than a typical chemical plant neighborhood in the West. But it is also true that Bhopal was an accident. A carefully-selected plant, carefully attacked, could produce a toxic release orders of magnitude more deadly than what is possible with a few canisters of sarin. Securing chemical plants is not a response to a movie-plot threat.
That said, it would still probably be less risky to work at home downwind from Union Carbide than to commute 15 miles to work every day in a terrorist-target-free itinerary.
The Bhopal disaster, like Chernobyl, Katrina, the Boxing Day Tsunami, and other disasters, were not terrorist acts, and are exactly the kind of events that an excessive focus on terrorism makes us LESS prepared for.
A natural or industrial disaster has a much greater potential for destruction than a terrorist act, and because of that difference in scale, requires a higher level of preparedness and a greater response. The more people that understand this, the better off we all will be.
I was not trying to conflate disasters and attacks. I was making the more limited point that Mueller's thesis on chemical agents -- that they historically have killed "almost nobody" -- is not a guide to what could conceivably be accomplished with an attack on a chemical plant.
The main point of the article -- the importance of sane, quantitative risk assessment -- is not altered in any way by this minor nit-picking.
A natural or industrial disaster has a much greater potential for destruction than a terrorist act, and because of that difference in scale, requires a higher level of preparedness and a greater response. The more people that understand this, the better off we all will be.
Especially because proper preparedness for natual and industrial disasters leads to preparedness for acts of terrorism, at least as far as emergency response is concerned.
Being prepared for an accident in a factory (or fuel storage, etc.) makes you also prepared for a terrorist attack on the facility...
Wouldn't it be good when the US takes a critical look at its power grid, reducing the regular failures and improving production?
It's depressing to think of the electoral chances of U.S. candidates who'd argue, "Because death by terrorism is so unlikely, we should direct that money to education, health care, and infrastructure."
The research paper quotes John McCain as making that argument a few years ago, somewhat, but it's certainly not a main plank of his or any Congressperson's platforms now.
"Especially because proper preparedness for natual and industrial disasters leads to preparedness for acts of terrorism, at least as far as emergency response is concerned."
I totally agree. It is preparedness that is key. The vector of an emergency or disaster (Flood, hurricane, terrorist attack, industrial accident) isn't nearly as important as the response. What is important is whether or not a community, state, or nation is prepared to deal with the consequence of the disaster (or attack). Is there a plan? Has it been practiced? Can it be put into place smoothly? Will all responders be able to communicate on the same radio frequency? How will the community response meld with County, State, and Federal support?
Disasters happen, like it or not.
@Tom Grant e.a.
I completely agree.
Unfortunately the lobby of the military-industrial
complex is larger and better funded than the one, if there even is one,
of the medical and disaster recovery profession's.
And a budget which allocates such a huge portion
of funds to 'defense' doesn't exactly help either.
Your point could be better described in terms of large-scale terrorism events which have actually occurred. Not to wave the 9/11 flag, but I believe that it was the most (directly) economically-damaging event in the history of terrorism. That said, the cost of our reaction to it was even greater, which speaks to a critical bullet point that comes up in the first page of the report: "The costs of terrorism are often the result of hasty, ill-considered, and overwrought reactions."
When you consider the cost of the reactions on the stock market (did all of those companies REALLY become less successful because the twin towers fell?), the numerous programs spawned within government (TSA contracts in particular have apparently been prone to fraud), and so on...what cost more, the attack or our response? And while some of the things that were done (bulletproof doors on planes) did indeed help to make a repeat attack much harder, I doubt very much that most of the money spent did much at all.
Bhopal is not a counter example. At Bhopal you had the release of 40 tonnes of methyl isocyanate into a densly populated area. This proves that having a huge amount of hazardous material near a city is a bad idea, and you are correct in saying that these types of facilities are a risk. But that is not the same thing as a chemical weapon. If terrorists blow up a damn and flood a town, is that an example of a hydroweapon, and mean that we should ban water? Clearly not. Bhopal was not a chemical weapon, you can't carry around 40 tonnes of anything very easily.
The point is that chemical weapons are no more deadly than any other type of military weapon. If you could get 40 tonnes of high explsives into downtown New Your City, the results would be just as deadly as 40 tonnes of chemical weapons.
I would go further than that. Our national hysterical over-reaction to 9/11 has engendered both economic costs and costs to political liberty. Mueller's analysis points out that those economic costs are much greater than the costs of past or conjectured terrorist attacks. But the liberty cost dwarfs both.
In the space of a few short years, the U.S. has gone from principled leadership in International Human and Civil Rights to being an enthusiastic torture state and operator of International kidnapping rings, the creator of a new Gulag Archipelago, a domestic civil rights and due-process abuser capable of arresting its own citizens and holding them without charges for years, and a high-surveillance society in which all communications activities of citizens are monitored for suspicious activity. It's as if the Soviet Union had actually won the Cold War by losing it.
We appear determined to defend our nation by undermining the very political principles that make it worth defending in the first place. If that isn't a terrorist victory, then I don't know what one looks like.
As they say about mutual funds:
"Past results are not predictive of future results."
These types of analyses provide a misleading and false sense of security. They fail to acknowledge that changes in the global operational, technological and/or ideological environment might make certain types of devastating attacks (nuke, bio) easier or more probable in the future.
And this analysis fails to account for the fact that many attacks have been prevented or deterred because of governmental (or private) action, in its cost/benefit assessment.
And by the way, Bruce, this is an old report, from late 2004!
"In the space of a few short years, the U.S. has gone from principled leadership in International Human and Civil Rights to being an enthusiastic torture state and operator of International kidnapping rings, the creator of a new Gulag Archipelago, a domestic civil rights and due-process abuser capable of arresting its own citizens and holding them without charges for years, and a high-surveillance society in which all communications activities of citizens are monitored for suspicious activity. It's as if the Soviet Union had actually won the Cold War by losing it."
This is not something new, nor a feat accomplished only within a few years. If you look closely at US history, you will see this happening all the time:
Civil War, Spanish-American War, WWI, WWII, Korea, Vietnam, Desert Storm.
One should read about Hiroshima & Nagasaki to recall that Japan was willing to surrender 3 months before the drop. They were willing to surrender conditionally: keeping the emperor on his thrown. The US bombed them, and the emperor got to stay anyway. What was the purpose? Muscle-flexing?
One should read about the court case of 'US vs Spirit of '76 (1776)' of 1918 (WWI). The Spirit was just a documentary film!
One should read about all the telegraph & telephone nationalizations.
This is not at all different that now.
In any case the evidence of 'Soviet Victory' (in summary: socialism) or 'Terrorist Victory' (remember the goal of terrorism is to effect gov policy: done & done) has been filling pages of books for decades.
Suffice it to say that it took less anywhere between 100 & 150 years of the US republic to undo it's founding principles. Most people would be shocked to learn this sad fact, but the constitution is and has been a dead letter for a long time!
There is some debate as to the critical turning points, but the crucial dates that keep reappearing is 1860s,1890s,1913,1933,1945.
200x will someday be pointed to as another critical turning point.
The CATO paper is nice and all, but suffers from one singular, yet all-encompassing, flaw. It assumes society will be rational and logical about the perceived risk of terrorism, or that political leadership can make society become so rational and logical.
"changes in the global operational, technological and/or ideological environment might make certain types of devastating attacks (nuke, bio) easier or more probable in the future."
Part of the point is that although the above is easy to say and easy to believe, it is not actually true. Or at least, it's not true to the point of invalidating the considerable body of security competence we could and should gain by studying the past. We've always had to deal with human nature, which is the basis for all the threats we currently face. Human nature has not changed recently. Technology hasn't actually changed all that much recently either, and the most important real threats are not new high-tech threats. Security isn't a new problem and there's no basis for claiming that it suddenly requires new solutions.
@ Captain Ned
It is a mistake to abandon rational thought simply because people are not always rational. Thoughtful analysis is a useful tool; without which, it is so much more difficult to make good decisions. I would suspect your own thoughts on the problems have a strong elements of rationality about them.
If I the money I would put this on bill boards everywhere :
"End Terrorism NOW. Dont be afraid."
The irrationality of 'the war on terrorism' is rediculous. So many people die each year from smoking, drinking or eating fatty food. MILLIONS. no one seems to blink - it is just accepted.
I believe a country which considers pocket knives and nail clippers weapons of terror (as the TSA did) is doomed. You can't be strong if you have to run around hiding everything that is the least bit scary. And in this world if you aren't strong you are toast, and not in a good way.
Well your elections are slowing looming so you are likely to see a big emotional wind up appealing to the fear and intolerance that is in all of us.
The USA has many large economic and social problems at the moment. Seeing what issues the election is fought on will say a lot about the 'State of the Nations Fear'.
You know, somewhere in all this is a study of the constraints a fearful climate creates for security and risk management - and the negative impact on measurable performance.
Thank you Bruce for the pointer to the very interesting article. While the discussion above is also interesting, I think much of it misses the main point of the article, namely: that the media and politicians reactions caused the public fear -- not the act itself. The constant repetition of false and exaggerated claims by the media and politicians is a major reason that the public now irrationally fears terrorist acts.
Consider that a recent poll shows 50% of the US public still think Sadam had WMD. They came to believe this because politicians and the media drumbeat it, not through rational analysis. (Poll published yesterday 8/6, example article at http://www.suntimes.com/output/terror/...
I submit that the main point of the Cato paper was that if the media/politicians did not mislead the populace, the populace would not be misinfomed. The call to action is to actively participate in the political process. Voting is not active. Your vote is cancelled out by the unthinking couch potato who still believes in WMD. If you can comment on this blog, then you can write your Congressperson. Have you? The couch potato hasn't.
@Lets keep things in perspective....
"So many people die each year from smoking, drinking or eating fatty food. MILLIONS. no one seems to blink - it is just accepted."
The difference in this case is that those millions of people CHOOSE their actions and in the 'war on terror' very few people CHOOSE their actions and have the rest of the populace here and abroad pay for it via the fiat dollar & future taxation.
"You know, somewhere in all this is a study of the constraints a fearful climate creates for security and risk management - and the negative impact on measurable performance."
Predictive risk-management via the market is capable alone of producing the correct climate of fear:
"The call to action is to actively participate in the political process."
The political process is what gets us into these messes...you can only forestall, it will be repeated ad infinitum.
"Voting is not active. Your vote is cancelled out by the unthinking couch potato who still believes in WMD. If you can comment on this blog, then you can write your Congressperson. Have you? The couch potato hasn't."
One wonders why one still believes in voting...
as if this complaint is something new, and there is no better alternative.
An interesting paper.
I was thinking at a more practical level rather than a futures market. Your expression "correct climate of fear" is Oscar Wilde-ish (aka. ".. that statistics have laid down for our guidance.").
>as if this complaint is something new, and there is no better alternative.
And what, pray tell, is your better alternative?
Being that I am a bit of a math geek and conceptual fan of Asimov's Psychohistory, a curious notion wanders through my mind. The article portrays the 9/11 attack as an "abberation". I believe there is a better word choice that might lead to a sounder policy analysis: the event was an OUTLIER.
The notion in my mind: what manner of statistical model best describes the emissions probability and intensity of terrorist events?
If you can get a good fit, then it becomes far easier to get hard numbers as to the cost-benefit analysis of steps taken to prevent novel forms of terror. Of course, since this idea implies that any measure currently being implemented may either be completely appropriate OR complete idiocy (or anything between), anyone advancing it has a good chance of irritating those on both traditional left AND right with an axiomatic position on the matter.
This interesting paper is written in the context of western reactions to terrorism. Here in the 'east' (I live in Egypt) we have been affected similarly. Our governments pump their budgets into arms, round up suspected 'terrorists', routinely torture innocents and jump heartily on the terrorism bandwagon. Dissent is now terrorism. Opposition is now terrorism. Our liberties, few that they were, have been eroded since the US shifted its focus from human rights to hunting terrorists. We suffer from another kind of fear too, that is, when a terrorist act is perpetrated, we get collectively punished/misunderstood by the world and downgraded (as Arabs, Moslems) into perpetrators and supporters of terrorism, whether we support or oppose actions or the ideologies which support them, and at the same time our governments use this as an excuse to get further funding for their illegal arrests and punitive measures on those least able to defend themselves.
Though many excellent remarks are made here, three things to add:
This was a very refreshing read, though a bit old, at least a view from the other more silen(t)ced side.
As always with statistics, they can be used in many ways. For instance, it isn't hard to show that flying is more dangerous than driving, if you measure it by the number of times you do it. However, perhaps it would be good if all media that publish about societal risks have to publish a weekly graph showing the death rates for various hazards, e.g. old age, smoking, being overweight, driving, drinking, asbestos, flying, and also terrorism. This would bring things into perspective and perhaps encourage people to take more rational decisions.
Lastly, terrorism comes in episodes that each have a different nature which makes predictions about the future hard. The current one could prove to be very deadly if nothing is done about it. Indeed some commercial bulk chemicals have the capacity to become potent weapons, though they have never been used as such by terrorists. That is something to be worried about.
> The point is that chemical weapons are no more deadly than any other type of military weapon. If you could get 40 tonnes of high explsives into downtown New Your City, the results would be just as deadly as 40 tonnes of chemical weapons.
Sorry Steve, this is not remotely true. Weight for weight, military grade chemical weapons are dramatically more lethal to UNPROTECTED persons than are explosives. Note the estimate from this report that a single tonne of sarin under ideal weather conditions could "only" kill 3,000 to 8,000 people (Only!!!). In comparison, the Oklahoma City bomb contained about 2.3 tonnes of high explosives, and killed 168 persons, or 73 per tonne . That makes the sarin about 40 to 110 times more lethal per unit weight. 
This report's discussion on the effectiveness of chemical weapons is severely distorted:
* by looking at WWI figures, the author ignores the fact that he is comparing trained, masked troops (in an era when no percutaneous agents were lethal) to unprotected civilians. This is the most serious error; chemical weapons are extremely effective against unprotected personnel, but relatively easy to protect against.
* by considering only deaths, he ignores the fact that the most militarily effective WWI chemical weapon was usually not lethal. (It does, however, create agonising burns, severe lung injuries which can impair respiration for the rest of ones life, a greatly increased lifelong risk of cancer, and temporary blindness which can easily become permanent if not treated very thoroughly).
Like the previous essay on this that we discussed, the author is not analysing chemical terorism with an open mind to make an honest appraisal of the risks; he is rather looking for any data that will bolster his thesis that the risks of terrorism are largely exaggerated and largely psychological. (A thesis I might readily agree with other than on this point.) For example, he notes that in the OTA assessment, the death toll would be only a tenth as great if there were a moderate wind  or the sun is out. That seems to be a valid point if you are looking for excuses, but if you were a terrorist looking for a plan, at least two countermeasures are readily apparent (and one of them is probably what you were going to do anyway).
1. In the lethal calculus of air warfare against cities in WW2, this is a fairly typical figure for an unprepared target. For prepared targets--i.e. everyone waiting out the raid in slit trenches or raid shelters--the rate could drop as low as 3 per ton.
2. Note that this does not translate directly to any randomly selected material. For example, Al Qaeda has expressed an interest in using hydrogen cyanide for chemical terrorism. The LCt50 of hydrogen cyanide is about 25 ~ 50 times higher than sarin, so as a first order approximation one might guess that it would only be about 1 to 4 times the effectiveness per unit weight as explosives -- plus it costs about three times as much per ton as Nitropril.
3. A lot of errors in thinking about chemical terrorism seem to derive from military chemical warfare doctrine, which in my opinion has more differences than similarities. This might be another one. Standard military tables do show such dramatic reductions from wind, but they are designed for estimating effects on a dispersed military unit in a wilderness area. It is far from clear that the same would be the case in a city where the populated area is much larger than the gas cloud. Possibly OTA made the necessary corrections, but one wonders....
I agree with you that chemical weapons are dangerous and that, for safety reasons, bulk amounts of many chemicals should be kept out of urban areas. So far there have been more innocent bystanders wounded and killed by accidents in chemical plants than by terrorist attacks.
It isn't trivial for a terrorist group to obtain a chemical weapon. Making it yourself holds significant risks of accidental poisoning (and how do you verify quality of the product.) Stealing a weapon from an army depot isn't a guaranteed success. Add to that the risk that the weapon is found during transport or pre-deployment at the target site.
Should we do more than standard security to counter the effects of a possible chemical terrorist attack? Not until they start doing sufficient damage to warrant the investment in additional security. (Spending 25 billion per year on DHS to protect against on average 250 million/year damage from terrorist attacks is not cost-effective.)
The basic problem comes from the general public. It is proven that we have a tendency to overestimate small dramatic publicized risk (like terrorists attacks) and underestimate big sizeable risks (like lightning or car accidents) which are underreported.
The media only exagerate this tendency by focusing on dramatic rather than everyday risks.
This is a dangerous cocktail as it gives room for bad policies from the government.
Let's focus on emergency preparedness with natural disaster in mind. Then, *if* terrorism strikes again, we'll be prepared.
Oh, and stop with the "OMG!! The Terror Threat Level is ORANGE!!11~1" - not once has that stupiud scale affected my daily life. Said another way: ignore the damn things and /choose/ to stop living in fear.
"I was thinking at a more practical level rather than a futures market. Your expression "correct climate of fear" is Oscar Wilde-ish (aka. ".. that statistics have laid down for our guidance.")."
Pray tell why the market gauged by freely acting individuals with their own particular knowledge and expertise is not the right way to gauge the proper climate of fear?
Are you to tell me that only the omniscient politicians are wise enough to tell us what it is?
And even if they are so wise (and not the actual guilty parties of creating terrorism in the first place, which in reality they are), why can't they be bent to be more honest if they can make a decent fortune playing in this market themselves?
By 'correct' climate of fear I simply mean as in the proper market price, the supply-meets-demand clearing level.
Just like there is a proper level of insurance in medicine, auto, airline, contract-enforcement, private security, life, mutualism (credit unions), etc...
The 'correct' or 'fair' price of any commodity is the result of market forces - and the same holds true for the service of security provision.
There is no statistics - but actions of individuals, which may be based on statistics, anecdotal evidence, economic determinism, internal knowledge, or any other criteria that can help you judge. Some of these individuals may even be within a terrorist cell themselves.
If you think there is statistics involved, perhaps you should read the article carefully again.
"And what, pray tell, is your better alternative?"
Market anarchy - where every vote is based on your prior actions in satisfying others.
And no, it's not impossible to achieve any more than the transition from feudalism.
I am not afraid of terrorists so much as I am mad at them. This Cato report is suggesting that Americans are walking around afraid of their own shadows which is ridiculous. We are however very angry and desire and end to the Islamo-fascist thuggery that has caused decades of war and attacks right here on our soil.
A moderate amount of fear is good for anyone. It protects us from acting stupidly, causes us to think about ramifications before we speak or act. The fact that you liberals are "afraid of being afraid" says something bout you. It says that you wish to forget that 9/11 and all the other attacks ever took place. You want the world to be like it appeared to be on September 10th. But we were no safer then. We were just unaware of how dangerous terrorism had become.
We may not have been safer on September 10th, but we certainly had more rights.
Calm down there - the Oscar Wilde reference was a compliment.
However, I still question the practical use of a futures market for fear, other than to make money, which is not a good enough reason by itself (for me).
Market anarchy is an oxomoron. A market (as I understand and use the word) cannot exist in a state of anarchy. I have also become cynical of the benefits of this system of trade that is described as 'free trade/market', a large part of the reason in seeing that it is not in fact 'free'.
Yes, politicians are dishonest; but that is the system we created so I'm not having a go at them. Any solutions I have for self righteous greed or bitter envy start at home.
>Market anarchy - where every vote is based on your prior actions in satisfying others.
>And no, it's not impossible to achieve any more than the transition from feudalism.
That process took centuries, incurring numerous bloody repressions and revolutions along the way. If that's your best plan, I recommend a small-scale pilot run first, such as a MMORPG virtual world. That way you can try it with real people taking real actions, but without really harming anyone except game characters. It should be easy to create such a world, because nothing will be forbidden by arbitrary game rules. Emergent order will prevail. "Do what thou wilt shall be the whole of the law."
Well. I think the author enjoys to sit behind his laptop, possibly in some luxurious apartment while he more calmly and intelligently ponders the fate of modern society than the majority of the unenlightened populace. Inwardly he gives himself a conceited, self-decieved pat on the back for producing such logical, intelligent conclusions on terrorism in the word today and it's effects.
I love to hate those proud individuals who have got staggering solutions to some of societies problems.
There are lots of problems in the world today that cause hysteria and fear in the lives of individuals around the world. However, if you think, in any way, that you are going to be able to help those who have been the victims of terrorism by speaking words of 'reform' & "I'll tell you what the problem is..", you have absolutely no idea of what it means to be a human being.
Funny thing is, Michael Moore said this exact same thing before the last Presidential election and was pilloried for it. Now the CATO institute says it and its gold.
Nice to see Mike was right all along.
No fear, no terror. Don't let the Republicans make you afraid so they can take your rights.
Sometimes the libertarians are right...
"Market anarchy is an oxomoron. A market (as I understand and use the word) cannot exist in a state of anarchy."
If you define the word anarchy to mean 'chaos' then I could see how you would come to that conclusion. However, I would go by the classic definition: no-rule (oligarchy-rule by many, monarchy-rule by one, anarchy- rule by no one). This way no assumption is made.
The market historically ALWAYS arises before a government in every civilization. The government is parasitic, and so some production must already be taking place in order for it to be redirected for political/social ends.
The government does never protects private property rights because it violates them immediately to 'enforce' them via taxation.
There is no difference between a government and a mafia engaged in a protection racket.
The good thing about mafias is that they prey upon their victims sporadically (not systematically), and only exist to the extent that government policy makes them profitable.
"I have also become cynical of the benefits of this system of trade that is described as 'free trade/market', a large part of the reason in seeing that it is not in fact 'free'."
I agree. The reason is that what is packaged as 'free trade' is nothing more than mercantilism.
Real Free trade occurs between freely acting individuals and groups of individuals, not nation-states with tarrifs, taxes, quotas, restrictions, subsidies, etc...
"Yes, politicians are dishonest; but that is the system we created so I'm not having a go at them."
"That process took centuries, incurring numerous bloody repressions and revolutions along the way."
Right, because everyone wanted to be the government! And their conflicting ideologies fought for a single seat at the top.
It only took that long if you count Europe as a single whole, as opposed to focusing on specific areas, such as: Switzerland, Ireland, Northen Italy, Iceland, United Netherlands, Andalusia various Celtic areas, and the scattered German free cities.
"If that's your best plan, I recommend a small-scale pilot run first, such as a MMORPG virtual world. That way you can try it with real people taking real actions, but without really harming anyone except game characters."
There is no scarcity, there is no real economics (prices, inventions, stock markets, futures market), there is no consequences, there is no action in the real physical world, there is no uncertainty (the designers would know it all).
" It should be easy to create such a world, because nothing will be forbidden by arbitrary game rules."
I'm sorry to tell you, but a game would not work because it would have arbitrary rules!
It would be arbitrary directly to the extent that it's easy to create!
However, some kind of order may still emerge.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.