Schneier on Security

Roger • July 13, 2007 9:54 PM

I originally thought this was obviously a hoax. There was so much that didn’t look right. As well as the things others have mentioned, these include:
* just 2350 lights? That’s a 40 x 60 seat grid, way too small to cover the area where the message was supposedly displayed;
* supposedly, the 2350 devices with packaging, and 3 batteries fitted each, weighed 1/4 ton. Hmm, a AA battery alone weighs ~1 oz depending on type, so 3 x 2350 x 1 oz = 441 lb, either they took very tiny batteries or the rest of the stuff must have been very light!
* the money doesn’t make sense either; $10,000 for some brief advice from 2 lawyers — who did he hire, Johnny Cochran? $20,000 for 2350 “cheap Chinese LED beer coasters” — that’s $8.50 each, wholesale! [see footnote] $800 to get a shirt embroidered with a 4 colour logo? (Real price, about $5 to $10.)
But John’s writing style always includes a lot of irony, hyperbole, and just plain made-up bits (after all, he’s a professional marketer!), so maybe those numbers were supposed to be part of the joke.

But after seeing “I’m a believer’s” screenshots, I’m opening the door to the possibility that SOMETHING happened — but the Zug crew screwed it up completely.

However, the screwup isn’t just that the blue lights were far too dim and ended up randomly distributed; there also just aren’t that many of them. For example in the first screenshot (which is the clearest) I count about 40 possible blue lights.The second, wider shot maaaybe has as many as 60 — and on the basis of the 3rd, that seems to cover pretty well all of them. No wonder no-one can read a “message”.

Hargrave claims that he got 2350 lights into the stadium. Either 97.5% of his (rather expensive) lights failed to work at all, or 97.5% of them never made it in, or something. (Or the whole thing is, in fact, a hoax.)

But, let’s still give him the benefit of the doubt. What security lessons can actually be learned here? Actually, not very much. Hargrave didn’t sneak in, as a legitimate marketing promoter he had actually secured a valid press pass after a background check (he rightly points out that the media are given a lot of privilege and power in the US, but hey, maybe that’s the price of a free society.) His crew didn’t sneak in either, he bought tickets for them. And he didn’t “smuggle” his equipment in, it was presented at a security checkpoint, scrutinised rigorously (despite being presented by a security cleared white man in a suit), and allowed in only after being (correctly) identified as harmless. Note, incidentally, that the security screeners followed some of Bruce’s advice here; even though Hargrave had been identified and had passed a background check, they based the screening on the potential for danger, not on his identity or race.

There may be at least one valid lesson, which comes from the inimitable Rob Cockerham. Rob found that even though the security passes had no special anticounterfeiting measures, and despite hours of work with Photoshop, he was not able to make fake security passes that looked convincing enough to pass even casual observation. So he came up with the clever idea of making a completely different “pass” which looked fairly professional but made no attempt to resemble the official ones. Because of the sheer proliferation of passes and badges of various kinds, no-one could identify them all by sight so this turned out to work quite well. (And it had the additional advantage that if caught, they couldn’t be accussed of forging an official document!) Clearly, in a scenario like this, there should be only ONE acceptable type of pass, and everyone should be able to recognise it on sight. If that had been done in this case, then even though it was just printed on laminated card without any special security features, it would have thwarted this $40,000 semi-legit intrusion attempt!

Another thing, I guess, is that it demonstrates that doing things on this sort of scale is really quite hard — whether it be pranks or terrorist attacks. You can get a hundred details right, but miss one or two and a spectacular coup turns into a farce with all the armchai experts chuckling “incompetent dolts!”

Footnote:
1. “Sir” John Hargrave notes that he bought real tickets for most of his crew, but doesn’t comment on how much they cost — unlike everything else, where he gleefully exaggerates the price. However Rob Cockerham’s description of the stunt says they were bought from a ticket scalper, probably at $2500 each. For each of 4 people. Plus plane tickets, car and van rental and motel rooms (on Superbowl day.) So now we know where most of the money went.