Schneier on Security
A blog covering security and security technology.
« Lousy Home Security Installation |
| Agriculture Security »
October 19, 2006
Security and Class
I don't think I've ever read anyone talking about class issues as they relate to security before:
On July 23, 2003, New York City Council candidate Othniel Boaz Askew was able to shoot and kill council member and rival James Davis with a gun in school headquarters at City Hall, even though entrance to the building required a trip through a magnetometer. How? Askew used his politicians’ privilege -- a courtesy wave around from security guards at the magnetometer.
An isolated incident? Hardly. In 2002, undercover investigators from Congress’ auditing arm, the General Accounting Office, used fake law enforcement credentials to get the free pass around the magnetometers at various federal office buildings around the country.
What we see here is class warfare on the security battleground. The reaction to Sept. 11 has led to harassment, busywork, and inconvenience for us all well, almost all. A select few who know the right people, hold the right office or own the right equipment don’t suffer the ordeals. They are waved around security checkpoints or given broad exceptions to security lockdowns.
If you want to know why America’s security is so heavy on busywork and inconvenience and light on practicality, consider this: The people who make the rules don’t have to live with them. Public officials, some law enforcement officers and those who can afford expensive hobbies are often able to pull rank.
Posted on October 19, 2006 at 12:25 PM
• 38 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
"I don't think I've ever read anyone talking about class issues as they relate to security before"
And I think people should. You've made a point that economics can teach security a thing or two especially when it comes to incentives, costs and benefits. And class issues come into play when a particular class can afford certain costs while others cannot.
The 2003 story is akin to the George Moscone's story in 1978-- http://en.wikipedia.org/wiki/George_Moscone has pretty good coverage. Basically, the councilman crawled in through a basement window to avoid the metal detectors. There's almost always a way around security theatre, you just have to look hard enough for the curtain to pull aside.
"The people who make the rules don’t have to live with them."
This is a great point.
This occurs because we all know that terrorists and other criminals are not bright enough to figure out how to successfully impersonate a law enforcement officer or other authority figure...
It is one of the reasons that CEOs do not complain about the restrictions. They just take private planes. I know of at least one company that has their own privatly owned fleet of planes just so they can get around all the inconvienences of the current restrictions. (Actually put in place when the rules were much more sane.)
Unfortunatly when this is pointed out, the rulemakers just try and extend the insanity to the smaller planes, instead of taking it as a sign that things are incredibly broken.
Class issues? Definitely part of the problem.
Appears to be an issue of social engineering on the gaurds by an insider-threat.
But don't disregard evidence pointing to an inside-job.
And luckily, even if they could impersonate an authority figure no one would believe them because all terrorists are of Middle Eastern descent, and would stick out.
This is a difficult issue I've run up against in corporate network security. While employees are subject to measures, some managers and even more executive levels think those rules don't necessarily apply to them.
"*I* don't need my screensaver to engage after 10 minutes, I'm the CEO!"
Isn't this the same issue that was talked about last week? That time, it was people with security clearances.
This is talked about informally all the time -- you just need to listen for it. There's a reason that the boss doesn't have a disk quota.
It's the golden rule -- them that has the gold makes the rules.
It also happens when some VIP (such as a senior Congresscritter from the opposition party) gets stopped continuously for secondary screening (for example, because he has an artificial hip joint) and makes a great big stink about it.
While his underlying premise is valid, his own example is irrelevant to his point; what the heck has class warfare got to do with Lidle's flight?
Anybody of any class could go buy/rent a small plane or pay $50 for a sightseeing trip down the Hudson and up the east river.
And how does having filing a flight plan or being in contact with ATC make anybody safer? In case nobody noticed, ALL of the 9/11 airliners were on a filed flight plan and talking to ATC (since all airliners always have to do so when carrying paying passengers).
And of course, why keep adding restrictions to light planes when the very incident referred to in the article proves that light planes are not a threat - no "innocent" (ie not affiliated with a hypothetical terrorist aircraft action) was killed or seriously hurt and no major damage occurred.
9/11 was cause by HEAVY AIRLINERS; restricting light planes (but not airliners) is like banning cars (but not trucks) from Oklahoma City because a govt building was blown up by a HEAVY TRUCK!
[and of course, the answer to my question, as always, is: "security theater" in lieu of security]
I notice this in airports. I see pilots and flight attendants who bring in water bottles, sodas, and other drinks. I also haven't seen one flight attendant or pilot provide a clear plastic bag full of their lotions and deoderants.
These are positions of trust who are not subjected to the same security controls as the rest of the public.
"I notice this in airports. I see pilots and flight attendants who bring in water bottles, sodas, and other drinks. I also haven't seen one flight attendant or pilot provide a clear plastic bag full of their lotions and deoderants."
I'll probably catch flak over this, but searching pilots is a waste of time, since they don't need explosives to bring down the plane, nor do they need a weapon to assume control of it.
@richj: the problem is:
people who LOOK LIKE aircrew ?= actual aircrew
its easier to search everyone the same than to develop a method to prove identity
see "searching people with security clearances" a couple of days back.
What scares me far more than another hijack a la 9/11 is the hijackers merely acquiring a "retired airliner" cheap and using that without bothering to hijack one. Completely bypasses the vault door on the house of straw (see link below and pick the color which is most holy)
FWIW, we have a very similar problem where I work in Brooklyn, NY in that there is out of control use of government agency parking permits for personal vehicles. These cars can be seen parked all over the place, blocking sidewalks and restricting pedestrian traffic. Until very recently the saddest/funniest thing you would see were the personal cars, with fire department parking permits, park in spaces blocking fire hydrants, right behind NYFD headquarters!
"I'll probably catch flak over this, but searching pilots is a waste of time, since they don't need explosives to bring down the plane, nor do they need a weapon to assume control of it."
Should all seeming flight staff be waved through by appearance, by documentable necessity of presence, or is it all a complicated charade of basis ineptness?
Please note, those who are able, have the First Class money plus a bit of a premium, now have the option of traveling in relative privacy by a new generation of micro-jets.
Common carrier passenger service is now the Greyhound of the middle class.
Google me - I'm around.
Please, do be attentive, be intelligent, be reasonable, be responsible
"What scares me far more than another hijack a la 9/11 is the hijackers merely acquiring a "retired airliner" cheap and using that without bothering to hijack one"
I'm not clear why this 'scares' you; this is far more expensive than buying a few tickets, particuarly if you have some relatively cheap volunteers for the suicide mission.
Some state office buildings have metal detectors. In one particular building, you sign in as a visitor, you then have to go through the metal detectors on the way to the elevators. They always go off, so the security guard just ignores it and waves everyone on through without further ado.
Well, this is all theater anyway. I recall the shooting incident in the Congress awhile back where the guy walked up to the guards at the metal detector and simply shot them both, then went inside, where, since guns aren't allowed, *he* was safe for quite awhile.
This is the fallacy of "gun free zones" making us "safe" -- in truth they make us less safe. Criminals and nut cases don't follow the rules, doh! If you feel like "going off" and killing a bunch of people, choose a gun free zone for a higher score.
@derf -- I've accidentally gone through a detector that did *not* go off while I was carrying a concealed gun. The other way these fail is that they set them fairly numb to avoid them going off on big key rings and such. A good concealed gun doesn't have too much metal in it, and many newer ones including mine are mostly non-ferrous metal at that (mine is nearly all titanium). I knew the rules, I simply forgot I had the thing on me because it's so light and small.
There's at least one significant error in the article. Askew didn't use his politician's privilege to get in with a gun and kill Councilmember James: James used his politician's privilege to let his killer in. (The class of "politicians who had a pass around the detectors" was smaller than implied by the article.) This strongly suggests, to me at least, that if there hadn't been such a pass-through, James would still be dead, but he'd have been shot and killed in his office, or on the street outside City Hall, rather than in the City Council chamber. I'm not sure there is any security measure sufficient to prevent someone from dropping his/her guard in front of an enemy.
Bob, renting a small plane requires a pilot's license, which in turn means either military flying experience or having been able to afford flying lessons. They're in reach of many people, but not of "anyone of any class."
I second Bob. The NYC crash is not an example of double standards. The same flight rules apply no matter who is piloting an aircraft, whether it is a baseball star, an ambulance-chasing news helicopter or a student pilot.
The article goes on to say that there was "no need to check in with government air traffic cops." Indeed. While a pilot's license may seem exclusive and extravagant to the majority of us who can not affort the $10k training and the ~$200/hr to operate an aircraft, the skies are open to anybody with the appropriate licenses. Not everybody can afford to drive a car either. But at least the process is fair. Everybody can participate without needing to grease any wheels.
Now if air traffic was limited to commercial operators, THAT would indeed set double standards, because then only the select few who rate their own "airline" would be able to fly as they please.
When looking for double standards in general aviation, a great example was the world soccer championchip in Germany earlier this year. During matches, non-commercial aircraft were forbidden to enter a 30nm zone around every stadium for "security reasons." Excluded from that restriction, however, were aircraft carrying FIFA personnel. (That's the private for-profit corporation that arranges the championship.)
Beyond all this smoke and mirrors, of course, the fact remains that no general aviation aircraft was ever used for a terrorist attack. (The one in NYC was presumably an accident, and a few years ago there was a suicide in Milano.)
Of course, small aircraft have a MTOW (maximum takeoff weight) below one metric ton, of which only ~200kg are useful payload. Combined with the required logistics of getting a pilot's license and renting an aircraft, using an old truck gives you so much more bang for the buck. And last time I checked, it was still legal to drive trucks around Manhattan.
And, of course, if airspace around NYC were tightened: As if it would spoil a suicide bomber if they were denied ATC clearance a few miles (and a few minutes' worth of flight time, at up to 5km per minute) away from their final destination.
Class is hugely influential in determining how much scrutiny people are subjected to. I travel regularly between New York and Toronto, and the various methods of making the trip subject you to vastly different levels of scrutiny at the border: bus riders get practically body-cavity searched, train riders get significantly harassed, plane passengers get a moderately quick questionnaire, and drivers are practically waved through, especially away from the main crossover points like Niagara Falls. The class implications are obvious: bus riders are assumed to be poor riff-raff whose rights aren't worth consideration, while people who can afford their own cars are above reproach and are not to be inconvenienced.
After driving and flying a few times, I was shocked to see the kind of treatment people got on the train during its 2-hour border inspection: women and brown-skinned people in particular were subjected to all kinds of inappropriate harassment.
This is not surprising when we acknowledge "security" as it is usually practiced as an activity aimed primarily at reinforcing social heirarchies and keeping people in their place.
"If you want to know why America’s security is so heavy on busywork and inconvenience and light on practicality, consider this: The people who make the rules don’t have to live with them. Public officials, some law enforcement officers and those who can afford expensive hobbies are often able to pull rank."
Great stuff, Bruce.
Now let me ask you if there is a practical way to deal with this inherent problem with our current 'social' institutions?
I believe that it can not, even with the best legislation spun from the best and the brightest.
The security problem is in the basic design, and no amount of patches will fix this - especially when the patchwork makers do not need to follow their own rules.
I suggest scraping the whole thing. But we apparently differ in that regard, because of our fundamental disagreement of what security really is, and what it means to have a legal system that acknowledges natural rights and allows symmetric power relationships to secure and thwart aggressive efforts upon one's person.
Bruce, how can we effectively solve the problem once and far all? Or at least mitigate it to a level of simply being a nuisance, but not a blunt ad-hoc weapon of suppression, ready to be launched against the entire society in the name of thwarting currently vilified group X for the general welfare?
Congress does this too. I have thought for a long time that the next Constitutional Amendment should be that Congress can pass no law that imposes a duty on others but not on the Congress and the Federal government. They should have to play by the same rules that they think should apply to us.
There was an article some years ago on this blog regarding IRA using fake documents to bypass security measures. (Can't find the link anymore)
That's kinda similar. Adding those special privileges decrease overall security.
"I have thought for a long time that the next Constitutional Amendment should be that Congress can pass no law that imposes a duty on others but not on the Congress and the Federal government. They should have to play by the same rules that they think should apply to us."
Good idea, no doubt, but It will NEVER happen.
I'm still waiting for Congress to approve the READ THE BILLS ACT. You'd think reading the actual contents of the bills they pass would be something much easier to pass, and something more people could get behind on, and yet...
For another class issue related to security see: http://www.nytimes.com/2006/10/19/us/...
The Arizona attorney general says that people whose wire transfers were incorrectly seized can follow procedures to get their money back. Interesting enough, many of those who make wire transfers do it because they need the money moved quickly and may not have the extra funds to cover government red-tape delay.
@Fred: It scares me because BILLIONS are being pumped into squeezing a single attack vector ever smaller (passengers taking control of an airliner) and ~nothing is being applied to other, more likely risks.
Stipulated an air ticket is cheap compared to buying a retired airliner; HOWEVER, the training, practice runs and risk of discovery/being thwarted at the last minute are significant; if you want to hit a specific target (super bowl for example) at a specific time you might consider it worth the investment to spend 1/3 million on a run-out L-1011.
I think it would be great fun (from Al-Quaida's point of view) to buy one, start a "temporary" charter airline, offer a really great price for some long trip; say NYC to Capetown, and have a bunch of infidels pay you to be on board the suicide flight (obviously without their knowing).
And think how much bigger the explosion would be (compared to 9/11) if you left all their baggage at the terminal and put a couple thousand pounds of C-4 in instead.
@Vicki: It doesnt take a license to ride on a sightseeing flight, pretty much anyone who could spend a day at Disney World could easily afford it.
Think of it as mission drift: security once meant safety, but now it's become domination -- the overlords lording it over the underclass.
I don't understand why people worry about hijacking planes. There is no need. I remember a little before 9/11 there was this Egyptian airline pilot that allegedly put the plane in a dive to comit suicide. He could have perfectly had commited suicide against the twin towers.
Just like that there are MANY pilots (almost all of them) out there that can do something like that. Can we police them all? Airplanes are dangerous machines capable of doing a lot of damage bt they are too practicle to just dispose of so we will keep the farce that we made them safe until the farce fall on its face. By then the people implementing the farce hope they will not have to deal with the concequences. It is just short term results they care about. In stock terms it would be a pump and dump scheme.
I am reminded of the fact that one of the first WTC bombers had to buy a child's ticket, and was caught because he tried to get a refund on the rental truck by claiming it was stolen. The goal was to upgrade his ticket with the refund.
There isn't a whole lot of money in terrorism, so it makes some sense to raise the bar a bit by installing security measures that take more money to bypass. How many prominent businessmen have given up everything in a suicide-bombing attack because they had nothing to lose, and their families would get a modest payment from radical Arab political figures?
By exerting pressure on the funding side of things, we also reduce the operating expenses that these groups have at their disposal. We are basically increasing the risk of detection and the cost of moving money around, at least in theory.
And if anyone knows of security measures that _can't_ be bypassed with truckloads of money, do share. I'm sure they're not all-pervasive, so the terrorists will just choose cheaper targets.
Defending against enemies with nothing to lose, in a [relatively] free country is an unreasonable thing to expect government to do. We can only make them more expensive, more risky, and less appealing; hopefully that will decrease their impact and frequency. I think a lot of the effort should be in isolating the groups politically (NOT by making ultimatums) and undermining their motivators by reconsidering the root causes. Perception plays a big part, and I suspect having the moral high ground might be undervalued; it shrinks the pool of candidates and accessories/facilitators.
``Nothing surprises people so much as plain dealing and common sense.'' -- Samuel Clemens (Mark Twain)
Lest you think I'm appeasing or giving in to coercion, let's also feed terrorists's remains to hungry hogs on broadcast television. I wonder what the Koran has to say about one's eternal disposition after passing through a pig's digestive tract. ;-)
> I see pilots and flight attendants who bring in water bottles, sodas, and other drinks.
Erm, this is perfectly legal. You are allowed to take on any soft drinks you like, so long as you buy them (or, in the case of water, fill it at a drinking fountain) inside the "secure" zone. You just aren't allowed to bring your own drinks through the checkpoint.
Airplanes are dangerous machines, this incident will be repeated...
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.