Schneier on Security

X the Unknown • April 27, 2007 2:27 PM

I think the idea of being aware of “hinkiness” is basically on the right track, given Bruce’s caveat that relevant expertise matters, and should be taken into account.

The main problem, of course, is ascertaining “relevant experience”… Clearly, however, our (U.S.) society is going in exactly the opposite direction, here. Instead of expecting people in positions of authority to exercise judgment in questionable cases, we are promulgating “Zero-Tolerance” policies. This just makes the impact of the inevitable false-positives that much worse.

In a situation where you will get a high rate of false-positives, discerning evaluation by the responder is crucial. In the student-with-gun example, presumably the police contact inquired: “how do you know it sounded like a gun?” The gentleman responded with details about his military experience, and seemed generally credible-enough to make the situation worth investigating. If it had turned out to be the TV, a Vacuum attachment, or some such, there would have been little or no harm done in checking it out (assuming they didn’t just call out the SWAT team, and kick the door in…which they didn’t). A similar process applies to the “suspicious recycler” – the police should have evaluated the overall credibility of the report, and possibly checked things out. There was certainly no need to go through with an arrest, on the basis of easily-ascertained information (it was just a box of paper).

You’re going to get an extremely high rate of false-positives in the “hinkiness” evaluation business, expecially if you are taking your reports from random citizens. You want calm, reasonably-experienced people evaluating the overall credibility of such reports, before deciding whether or not to initiate any kind of action (including dispatching an officer to check things out). Of course, since you are relying upon their “gut analysis”, you also have to protect them when they get it wrong – which will also happen. If they get it wrong too often, of course, they have proved to be incompetent at that job, and should be fired or re-assigned, as appropriate.

For things like airport security, in particular, Bruce is arguing for having observers with particular skill/experience in the security field, on site – as well, I presume, as some mechanism by which ordinary people can easily-enough report things they find suspicious. We certainly used to have a system very much like this – the Customs Inspectors. They did not (and, as far as I know, still do not) minutely examine every article of baggage and clothing brought into th ‘States. Instead, they mostly rely on their ability to “sense hinkiness”, to determine what merits particular attention. They caught a surprising number of smugglers, this way.

Clearly, the general technique of relying on the “feelings” of Customs Agents doesn’t catch every possible smuggler. Some get through. It was judged that the balance between the effectiveness and deterrence of that technique, versus the much higher cost and inconvenience of full-cavity searching every person entering the country, made the missed smugglers a worthwhile trade-off. I think the same sort of logic probably holds true for catching terrorists. You simply can’t reasonably expect to “catch them all” – some are going to be people who literally didn’t know they were going to snap, until it happens, for example.

Bruce is asking: “What is the most reasonable and cost-effective way to achieve a good balance between detection and deterrence, versus inconvenience and cost (including the cost of lost freedoms)?” He is suggesting that having experienced professionals making informed evaluations is probably a better bet than having lowest-wage hirelings blindly following some “Zero Tolerance Policy” and a checklist.

I agree with him.