Schneier on Security
A blog covering security and security technology.
« Poppy Coins Are not Radio Transmitters |
| 1933 Anti-Spam Doorbell »
May 9, 2007
Sometimes it Is a Bomb
Sometimes, that strange backpack is a bomb. Not very often, but once in a great while.
Still, I don't think it's possible to solve this by pre-emptively assuming that all strange objects are potential bombs. There are just too many strange objects in the world.
Posted on May 9, 2007 at 2:17 PM
• 25 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
> Still, I don't think it's possible to solve this by pre-emptively assuming that all strange objects are potential bombs.
Your inclusion of the words "assuming" and "potential" renders the idea qualified to such an extent as to become entirely reasonable to hold. All strange or ordinary objects are potential bombs. But so what.
Would this be "homicide with an unusual weapon" or a "terrorist act"?
Its ok people - we've got it under control - go back to your normal activities.
ig: The article says "The case was being investigated as a homicide with an unusual weapon."
Is "homicide with an unusual weapon" a standard phrase over there?
I'm just curious how you tell the difference between "homicide with an unusual weapon" and "terrorist act".
I assume they meant "we're not treating it as a terrorist attack, even though bombs are often associated with terrorist tactics rather than homicide."
One thing I don't really know - how often are things like carbombs used as weapons of terrorism vs. how often in targetted homicides?
Sorry to double-post, but
Well, in a terrorist attack where a bomb was planted in the parkade underneath a casino, you'd kind of expect the bomb to be big, so as to hurt people in the casino above. More like a bomb the size of the whole trunk of the car, and less like a hand grenade in a backpack (they didn't say it was a grenade, just that it was a quite small explosion). You'd also expect it to be exploded during a busy time, not at the end of the night shift.
This was a bomb placed on top of one person's car, with only enough power to kill someone standing directly next to it. It reads like it was not on a timer, but a motion trigger of some kind, so that it went off when he took the backpack off the car - so, an attack targetted at the owner of the car, rather than an indiscriminate mass-damage attack.
Could it not be argued that all explosions are, at the very least, murder attempts (and, upon success, murders), and can further be classified as a terrorist act if they served to terrorize?
In essence, I am arguing against the "or" nature of the question and, instead, proposing it to be of an "and" nature.
Sigh... Bruce, I know you have a lot invested in the "oh those dumb cops and officials" line of thinking when it comes to bomb identification stories, but I wish you would at least allow yourself to rationally debate the pros and cons of different policies. At the very least, I'm certain you are aware that no one (or at least no one relevant) is assuming that all strange objects are potential bombs, except maybe in the most intellectual of fashions. Why don't you just write that they "allow" for _strange_ (skip the all) objects to sometimes be dangerous, and maybe sometimes enough that its worth the resources to check in a variety of cases. Officials and police may or may not be very frequently making poor evaluations in that regard, but then lets talk about that and developing a better rubric to evaluate foreign objects instead.
My point is, clearly there are a nonzero number of planted bombs in America. That means that _some_ level of resources should be devoted to handling them. How should those resources best be used? Let's go after that question rather than saying "OMG dumb cops" 15 times, and then "oops well I guess that one was a bomb," and then repeating the cycle ad nauseam.
Just my advice though. Cheers.
dragonfrog: "One thing I don't really know - how often are things like carbombs used as weapons of terrorism vs. how often in targetted homicides?"
In this country, car bombs are usually weapons of homicide, and usually set to explode when the target turns on the ignition.
This one seems similar, given its size and limited range.
Good thing this didn't happen in Boston.
I didn't expect this kind of "business as usual" unflappability on the part of US law enforcement. Makes a nice change.
Sean writes: "That means that _some_ level of resources should be devoted to handling [bombs in America]."
How about this: we fund a group called a "police department," and if a bomb goes off we call them and they try to find out who did it.
Sean, you say no one important is assuming that all strange objects are potential bombs, but isn't that exactly what happened with the ATHF advertisements in Boston? The police were trying to prevent an assumed "bombing." I extrapolate that if police try to prevent bombings (not just investigate them afterwards), nothing good will come from the effort.
This gives me an idea for a movie plot:
You have a cynical wife with a husband that she does not love anymore. The husband works in a position of power or has some bad friends (but this is optional).
The wife plays the afraid wife. She has listened to the american news media and has heared too many stories of bombs beeing planted. She starts seeing bombs everywhere, and starts phoning them in to the police department. The first couple of times they will send out the bomb squad, but after the 4-5th time she calls in to report a bomb they will just hang up on her.
She will then create a bomb and which is such placed that her husband will pick it up (place it in front of the car garage for example). She will "discover" the bomb and call it in. The police, beeing so tired of her calls will ignore her, her husband will also be tired of her seeing bombs everywhere. After some time he will go and pick the box up.
The bomb goes off when it is picked up. Boom. No more hated husband. The wife called in the bomb, so will not be the prime suspect in the police eyes. On top of that she might get a hefty setelement from the police because they did not respond the threat.
PS: The wife should not take out huge life insurances on the husband as that is allways a dead giveaway, but rather hope for the police to pay up.
Ok, so it's not possible to solve. But what is the option? Sounds like you forgot the meaning of "risk management" and jumped to "ok, there are too many strange objects in the world so forget about that strange backpack in a very targeted airport"...
I'm sorry, having spent part of my life in Israel, I prefer to loose a meeting to do traffic disturbs related to anti-terrorist activities than to be go out to a club and never come back.
Andre Fucs: "Ok, so it's not possible to solve. But what is the option?"
Ignore them. You don't *have* to try to stop the bombs. Accept that occasionally some people will be killed and spend the money on saving lives elsewhere (intelligence? healthcare?).
As a bonus, people will be *less* scared because the news won't be filled with bomb threats (just the occasional bomb).
Andre Fucs: "I prefer to loose a meeting to do traffic disturbs related to anti-terrorist activities than to be go out to a club and never come back."
You're talking consequences without risks - i.e. nonsense.
I would prefer to *accept a very small risk of* going out to a club and never coming back rather than *regularly* loose a meeting because of anti-terrorist activities.
So, it might appear that the mafia is alive and well in Vegas... Thoughts?
@dragonfrog: "One thing I don't really know - how often are things like carbombs used as weapons of terrorism vs. how often in targetted homicides?"
In Chicago, several years back, car-bombs were a "popular enough" method of disposing of organized-crime rivals that guys were forcing their wives to go out and start their cars for them. This was before remote-ignition, of course - which may well have been driven in part by the perception of danger about car-bombing.
I agree with Andre's point. In the U.S., where things which go BOOM and look like innocent/innocuous objects is a relatively rare occasion. In other countries, say, Israel, it is a far more common thing (unfortunately), and has led to a modification of how people behave.
As trite as it sounds, the world ain't what it used to be, and to continue to go about our daily lives as is nothing has happened in the past 6 years is somewhat naive. There was much picking on the Boston PD's response because most of us (thankfully) have never experienced an IED. (For a sample of IED makers' ingenuity, hit up google's image search, and then try convincing someone who's either lived in Israel or spent some time in one of the two sandboxes that the blinky-light-n-wires devices can't have been, for the very least, suspicious).
My point was I don't think that they (in boston) _assumed_ anything, a word which implies an incredible amount of stupidity. I think they decided they couldn't rule it out and got scared of losing their jobs or others' lives or whatever. My point is then that there is a debate about how to make these bomb decisions better, and painting officials as having the reasoning skills of a bunch of 12 year olds isn't useful.
AND as to your police department comment, I think it should be obvious that just waiting until bombs go off is not the optimal strategy. Maybe there will be so few of them and they will hit such irrelevant targets (no more big buildings coming down) that it would be an acceptable strategy, but again, my point is that a debate exists there, and I'm tired of coming to (ostensibly) a security blog that I know is written by an intelligent person and having the terrorism related aspect read like the Enquirer and contain absolutely no interesting or insightful information. Not that of course anyone (especially Bruce) owes me anything, but again, that wouldn't be my point.
And I would also have to make an exception to that comment about an absence of insight, that essay you wrote Bruce on the pervasive CYA mentality that drives overreaction was very very good (IMHO). But, please, lets not end there and then have 8 months of cop-mocking.
I'm starting to agree with Sean. In the beginning, I think that the general point was more that the authorities were encouraging out-of-proportion responses to items that were not bombs, in order to not appear to have over-reacted themselves. There's nothing wrong with assuming that some strange object you find somewhere could be a bomb (unless, like one person I observed, you pick it up, hold it to your ear, and shake it as a diagnostic method). And there's nothing wrong with pulling out all the stops, and mobilizing the bomb squad, if you're really concerned that something and/or someone (or several someones) might be blown up. Bombs, whether planted by international terrorists, or some joker who hates his co-workers, are a pretty high-stakes threat. It's only to be expected that people are going to respond more seriously than to other threats.
There is no good way, short of 1337 psychic powers, to get things to the point where you catch *everything* that *is* a bomb, and *nothing* that *isn't.* But we should have the expectation that responders will learn from their incorrect judgments, whether they turn out to be false positives or false negatives, and fold those lessons learned into future responses, so that going forward they are better able to spot real threats, and weed out non-threats. What many of us (including Mr. Schneier, I'm guessing) think that we have seen are exercises in breathless security theater, designed (intentionally or not) ultimately to justify and show the correctness of the ultimately *incorrect* (even if understandable) responses that have been made to certain incidents.
Despite the high-stakes nature of a bombing, we're going to have to learn to live with the fact that we won't catch all of the bombs. There is a certain level of information required to stop a bombing, and sometimes the bomber will prevent enough of that information from coming to light that you can't prevent an incident short of dumb luck or coincidence, even if you know to be on the lookout for such an act. We have to learn to accept this, and jettison the expectation of perfection that the public holds (which itself is something of an artifact of the authorities' attempts to assure the public that said authorities will protect them from any and all threats).
If we're going to be critical of the authorities' responses to potential security breaches, we should be able to point out what lessons they aren't learning that previous experience should have taught them. Although a better target for criticism may be the general public, as "security consumers" who want the perception of perfect security, rather than realistically managed risks. (Although it can be pointed out that it does little good [and potential harm] to reinforce unrealistic expectations by pandering to them.)
tordr: Nice movie plot, but delete that bit about getting a settlement from the police: in the USA, you can't sue the police for not protecting you.
> My point is, clearly there are a nonzero number of planted bombs in
> America. That means that _some_ level of resources should be devoted to
> handling them.
I disagree. I would say that they're so fantastically rare that in almost all cases of "random thing might be a bomb", any expenditure of resources is guaranteed to produce no positive results, and is essentially wasted money. Bombs are so rare that there really ought to be a requirement for a pretty compelling case to be made that something is *probably* a bomb, as opposed to something that is out of place, before you respond in an emergency fashion.
This poor guy was a victim, but essentially his course of action was correct.
I summed up my opinion on bomb threats in the US a couple of weeks ago on my own blog, the references for the below statistics are there if you want to see where I got my numbers from.
Reproduced here, the post:
As a public service, let me now inform you, gentle readers, of some statistics.
Between 1988 and 1997, a ten year period, 427 people were killed by explosive devices, a rate of 42.7 per year. By comparison, 5,702 people died due to fatal occupational injuries in 2005. The American Cancer Society estimates 564,830 deaths in the US from cancer in 2006. Stroke killed 150,147 people in 2004. Coronary heart disease gave another 452,300 victims to the reaper in 2004. Ah, you say, but I’m in pretty good health, I work out and eat healthy (which makes you a rare citizen of this country), and I’m totally paranoid, so I’ll just park it at home and I’ll be safe, right?
3,030 people killed in home fires in the U.S. in 2005 (not counting the firefighters actually trying to put the things out). 3,306 unintended, non-boating related drownings in 2003. 13,700 people over the age of 65 died in 2003 from injuries sustained in a fall. 23,157 accidental poisoning deaths in 2003.
All in all, 2,487,415(.9) people in the US are projected to shuffle off their mortal coil in 2007… which means (assuming that the 42.7 number is a reasonably accurate guess for 2007) that explosive-related deaths represent .00017% of the overall fatalities in the US every year.
Or, yet another way of looking at it, the population of the US is 301,139,947 (according to the aforelinked CIA factbook) which means one out of every 7,052,458 people will die from an explosive device, so the probability that you’ll be hoisted by someone’s petard is approximately .00000001418.
Now, this isn’t strictly speaking a rigorous analysis, because I’m grabbing statistics that are easily accessbile with a web search instead of doing a proper year-by-year correlation study, but any way you want to look at it, the likelihood of you being killed by an explosive device is so fantastically small in comparison to the thousands of other ways in which you can have your ticket punched that worrying about it is… well, actually, probably doing nothing more than increasing your likelihood of being one of the 65 million people in this country who suffer from high blood pressure (which leads to those stroke and heart disease fatalities as well as kidney failure and other things that also will make you dead as a doornail).
So, if you see an abandoned backpack, don’t lose your mind and call the bomb squad. Just check it for identifying information and turn it into the lost and found.
Nothing have changed the last 6 years. Most of the world lives on comfortably, perhaps with exception of a few insane rules forced on them from America. Most of the world don't care about the so called "post 11/9" world that is so common in American rhetorics.
It seems more and more true for each day that passes:
America: The land of the terrorized.
There was a case in Newton area high school too when four suspicious backpacks prompted to evacuation in April.
Reportedly the reason was that the backpacks included the name of new social networking site:
"This poor guy was a victim, but essentially his course of action was correct."
Building on _possible_ o-crime connections:
You're all assuming (especially Sean) the level of risk was that of a 'normal' person. If I had pissed off the Mob then I would take more care moving backpacks off my car.
If an innocent bystander took it off his car to hand in at "lost+found" then yes, that's the correct course of action for them (shame they died but it was the 'right' thing to do).
If that person called the police then the police should essentially tell them to get lost and call hotel security.
If _he_ had called the police and suspected a bomb then that course of action would have been right too - as determined by his unique ability to assess the situational risk.
The police in this instance should have reacted - the nice twist is that he would have had to justify the risk by persuading them that he was involved in organised crime!
Key lesson: not everyone can fully assess the risk in a given situation.
It is not rational in a functional society to see deadly risk in everyday things - that is a psychological illness called paranoia.
The fact that the US society as a whole could conceivably be diagnosed as paranoid is telling.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..