Schneier on Security
A blog covering security and security technology.
« Designing for Security |
| How to Escape from Plastic Police Handcuffs »
August 15, 2007
Nice article on security theater from Government Executive:
John Mueller suspects he might have become cable news programs' go-to foil on terrorism. The author of Overblown: How Politicians and the Terrorism Industry Inflate National Security Threats, and Why We Believe Them (Free Press, 2006) thinks America has overreacted. The greatly exaggerated threat of terrorism, he says, has cost the country far more than terrorist attacks ever did.
Watching his Sept. 12, 2006, appearance on Fox & Friends is unintentionally hilarious. Mueller calmly and politely asks the hosts to at least consider his thesis. But filled with alarm and urgency, they appear bewildered and exasperated. They speak to Mueller as if he is from another planet and cannot be reasoned with.
That reaction is one measure of the contagion of alarmism. Mueller's book is filled with statistics meant to put terrorism in context. For example, international terrorism annually causes the same number of deaths as drowning in bathtubs or bee stings. It would take a repeat of Sept. 11 every month of the year to make flying as dangerous as driving. Over a lifetime, the chance of being killed by a terrorist is about the same as being struck by a meteor. Mueller's conclusions: An American's risk of dying at the hands of a terrorist is microscopic. The likelihood of another Sept. 11-style attack is nearly nil because it would lack the element of surprise. America can easily absorb the damage from most conceivable attacks. And the suggestion that al Qaeda poses an existential threat to the United States is ridiculous. Mueller's statistics and conclusions are jarring only because they so starkly contradict the widely disseminated and broadly accepted image of terrorism as an urgent and all-encompassing threat.
American reaction to two failed attacks in Britain in June further illustrates our national hysteria. British police found and defused two car bombs before they could be detonated, and two would-be bombers rammed their car into a terminal at Glasgow Airport. Even though no bystanders were hurt and British authorities labeled both episodes failures, the response on American cable television and Capitol Hill was frenzied, frequently emphasizing how many people could have been killed. "The discovery of a deadly car bomb in London today is another harsh reminder that we are in a war against an enemy that will target us anywhere and everywhere," read an e-mailed statement from Sen. Joe Lieberman, I-Conn. "Terrorism is not just a threat. It is a reality, and we must confront and defeat it." The bombs that never detonated were "deadly." Terrorists are "anywhere and everywhere." Even those who believe it is a threat are understating; it's "more than a threat."
Mueller, an Ohio State University political science professor, is more analytical than shrill. Politicians are being politicians, and security businesses are being security businesses, he says. "It's just like selling insurance - you say, 'Your house could burn down.' You don't have an incentive to say, 'Your house will never burn down.' And you're not lying," he says. Social science research suggests that humans tend to glom onto the most alarmist perspective even if they are told how unlikely it is, he adds. We inflate the danger of things we don't control and exaggerate the risk of spectacular events while downplaying the likelihood of common ones. We are more afraid of terrorism than car accidents or street crime, even though the latter are far more common. Statistical outliers like the Sept. 11 terrorist attacks are viewed not as anomalies, but as harbingers of what's to come.
Lots more in the article.
Posted on August 15, 2007 at 6:18 AM
• 42 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Very true. Terrorist and politicians really do have a symbiotic relationship. It's encouraging anytime I hear of people who get this part right -- the MS media has been doing such a terrible job.
Very true. Terrorist and politicians really do have a symbiotic relationship. It's encouraging anytime I hear of people who get this part right -- the MS media has been doing such a terrible job.
Yes, but you know as well as I do (we've both done the research) that humans react weird psychologically to large, infrequent incidents. It partly has to do with our adjusting mentally to frequent incidents, like car accidents, to the extent of barely noticing that they occur. It also seems to tie into the amount of air time that is devoted to aggrandizing these so-called threats. Every vulnerability becomes critical in the face of the omniscient, omnipresent uberthreat.
I think that at some point we have to accept that the default human response is not rational. Once people can accept this tenet, then it will be easier to remove the emotional aspect of the debate and instead focus on these statistics, allowing us to focus time, energy, resources where they should rightly be going (like to feeding the hungry, educating the uneducated, caring for the sick, etc, etc, etc). Until then, we're stuck with Chicken Little.
Speaking^H^H^H^H^H^H^H^HWriting as a scot I should know what "glom" is but I didn't, thank you for that.
I think someone on this site once said that Osama bin Laden would just be an old fart in a cave if it weren't for over-reactive politicians and the terrorism industry.
I'm not really sure these comparisons are valid. You are trying to justify the actions of random acts of nature/people to that of pre-planned meditated attacks.
To me, that gives an out to those defending security theater. "Yes, the odds might be lower, but we know based on how we are viewed by the terrorism that large buildings, our transit systems, and our economic system are in danger -- just as those living in Florida know their houses are in danger of hurricanes."
You want to stop security theater? Take a look at NYC, DC and Baltimore and other cities were crime rate has dropped as a result of putting more into police infastructure without getting involved in privacy issues.
There's no reason to give in to terrorism, but at the same time it appears whatever terrorist network supposedly exists is inept or planning only massive attacks.
That seems like a recipe for failure because Americans are not terrorized. They are not pulling their kids out of school, refusing to travel to vacation destinations, or going to high profile events.
They are still going to work and the mall, all things that were disrupted by the simple attacks of the D.C. sniper.
A true terrorist network would be making similar scale attacks simultaneously... seemingly at random... every day. That way they would create a fear that nowhere is safe and your children could be at the wrong preschool at the wrong time.
Instead, the terrorists are either dead, non-existent, or stupid. The only other explanation is they only desire large attacks, or only desire to use something unprecedented in terrorism like a nuclear weapon.
There must never be a reward for terrorism.
However, the federal government's waste and response is just symbolic of waste and fraud throughout the government. Our representatives are more concerned with upping the dollar returned to dollar taxed ratio because the federal government is top heavy. Senators brag all the time they got back $1.04 per dollar for their state.
A truly effective government would be one where the feds help out the "poor states" and leave the money everywhere else so they can solve their own problems at a local level... definitely more efficiently and with more citizen input... unquestionably with better results.
It's ridiculous to have funding for Homeland Security and then see it spent to protect something like Joshua Tree National Monument. It's one of my favorite places to visit, but it's certainly not going to be attacked. But if you're a senator from California, you need to make sure you're getting those dollars back!
You'll know we have a prudent federal Homeland Security grant system when only high risk areas receive money. But see... that's not fair nor politically correct... so instead we will use Homeland Security money to paint for nice new paint jobs on fire engines and maybe a sign outside the police station.
Sure, these may be prudent uses of money... but definitely not federal money.
I think another factor is that there are things that people never want to happen again, like 9/11, and will go to great lengths to prevent them, despite the improbability of those things ever happening again. People like assurances; they like to know that some kind of control has been put in place, even if it is probably not really needed.
I have seen this in IT a lot. After something totally improbable happens and the odds of it happening again are a million to 1, the executives still want "something" done to prevent it from happening again.
To remove the threat to us peasants the terrorists need better targets.
So to make us safe all protection needs to be removed from the heroic politicians and government employees who will thus protect us in the most effective manner. This will also reduce the cost considerably removing bin Ladens best weapon.
Anyone who disagrees is undoubtly an al Qaeda supporter and should be sent to Cuba for a confession to be extracted.
People always trot out the difference between terrorism being intentional and other, higher frequency, deaths being unintentional. This isn't quite right.
Bee stings, death from allergic reaction ? I strongly suspect the bee had an intention.
Bathtub deaths ? Suicide (usually intentional) or perhaps intoxication (also typically intentional).
Death on the road ? Surely everyone in a vehicle intended to get in the vehicle ?
It's not about intent, it's about context.
To add to Peter's comment, consider that something on the order of 2,000 women are murdered each year in the U.S. by their husbands or boyfriends. Maybe we need to work harder on reducing domestic violence!
The media have a market bias in favor of stories that are more sensational and in favor of reporting stories in a sensational manner. They have no vested interest in calming their viewers. They get higher ratings and more money if they present a story in a way that is more sensational.
And its competitive. The broadcasters who are most effective at convincing their audience to be alarmed and worried win the larger number of viewers. Dry newscasts like PBS get low ratings, and sensationalized news/entertainment programs get higher ratings.
So they do not even consider presenting the terrorist threat in context with a reasonable balance of concerns and risks.
@Peter: Contextual arguments only work in certain situations.
Sure everyone intended to get into the vehicle but how many intended to ram into the car in the opposite lanes killing all involved? If so, would that be classified under terrorism or under vehicular deaths or both?
Sure the bee intended to sting to the individual to thrwart the danger, but not set off the allergic reaction. Again, the bee is not out to kill, it is out to defend (with the exception of maybe one or two types of bees)
Those are not even close to comparing the attackers who got into the plans and intended to crash them into the twin towers. Or those that drive car bombs on a daily basis in the middle east.
If you want to talk about "terroristm" as it relates to every day life, talk about the murder rates and crime rates in cities and what is done to prevent that. Those comparisons will show value.
One only has to examine the thousands of miles of our unprotected borders which has alloweds the ingress of terrorists unopposed, to realize the governments true committment in the fight against "terrorism". I don't consider leaving the back door open , while tracking, bugging and watching everyone who is not a terrorist, a plan for anything but the initial steps leading to the creation of a police state, and the fattening of the coffers of the large number of corporations who directly benefit by the continuance of our "the sky is falling" terror policy. Mr. Muellers book would seem to be a valuable, timely interjection into the current, flawed mindset of the sheeple who are buying this terrorist fantasy hook, line and sinker, who would trade their own childrens lives for ten minutes of "security". There is a daily event that occurs in America that kills 400,000 people EVERY YEAR. Yet, not one reduction in civil liberties has happened, no laws attempting to mitigate it's effect have taken place. It's not even a topic of discussion. Perhaps the tobacco companies are the real terrorists, but that's another story. When 3000 people are killed in a single event, we become mindless idiots who are only too happy to bend over and bow down to our new government master if it means that they will provide us with a (false) sense of security. Lose civil liberties? Oh, who cares, were safer now right? In fact, the more civil liberties we lose the safer we'll be right? Yeah, that's the way a "good" American should think right? Keep up the good work sheeple.
"We are more afraid of terrorism than car accidents or street crime, even though the latter are far more common."
And of course, we're more afraid of street crime than of car accidents, even though car accidents are far more likely to happen to us, and also more likely if it does happen to leave us dead or crippled. (I'd rather lose my wallet to a pickpocket than my legs to a car)
It may be as Bruce has suggested in the past - we have much more control over our own risk of car accidents, so we paradoxically feel better about making choices that lead to higher risk. We perceive street crime as a more random thing, so mentally elevate the risk and take precautions that make little or no sense against it.
Somewhat connected to that - I live in a slightly "rough" part of town (read, working-class, it's the latest area the cops have chased the street prostitutes to) - the sort of neighbourhood that sheltered suburbanites might be afraid to walk. But I feel safer there where there are people about, than in rich neighbourhoods where the streets are always deserted.
above anonymous post about street crime vs. car accidents was me - forgot to add my name...
The likelihood of another Sept. 11-style attack is nearly nil because it would lack the element of surprise.
I've noted that since 9/11, the element of surprise was completely lacking in:
1. Bali nightclub terrorist attack.
2. Madrid train station terrorist attack.
3. London subway terrorist attack.
4. Beslan school terrorist attack.
5. Glasgow airport terrorist attack.
How much more absurd can Mueller’s comments be?
When elements of security theater become widely-accepted and ingrained in popular thinking, then security theater becomes security mythology.
Reason may someimes prevail over theater, but seldom over mythology.
How much do you think this is going to cost (and not just in lawsuits):
"GE Security..."Checkpoint of the Future"...incorporated an array of futuristic scanning technologies: automated carry-on scanning, automatic biological pathogen detection, millimeter-wave full-body scanning, explosives trace detection on passengers, and a so-called "quadrupole resonance carpet" to detect threats in shoes."
All of the hype regarding terrorism is about one thing: control.
Politicians want to control spending, thinking, behavior, actions. Media wants to control what you watch.
The politicians gain power via control. They get pork where they want it, they get longevity in their position, and they gain notoriety. The media gets viewers, and ratings, and thus advertising dollars. Not to mention beating their competitors.
It's all about control. Sadly, the constitution is all about limiting this control, and our government from the start was about limiting the control that individuals might try to exert over us.
No one is saying that attacks of this nature aren't legitimate. We all know they are. But the only way they can be classified as 'terrorist' attacks is if we are truly terrified. When we are no longer terrified, they are no longer terrorists, and simply criminals.
As long as you are willing to be terrified, there will always be people of power willing to label criminal activity as terrorist behavior, to further exert control over you.
The intention of a terrorist, as opposed to the random nature of, say, a bee sting, is microscopically relevant.
When performing a risk analysis, you measure expected loss versus the cost of mitigation. There are, certainly, intangibles involved in the expected loss column, but the article linked here is essentially saying that the intangible (terrorist intent) is grossly and significantly over-stated.
> If you want to talk about "terroristm" as it relates to every day life, talk about
> the murder rates and crime rates in cities and what is done to prevent that.
> Those comparisons will show value.
You're missing the point, but regardless even if you compare terrorism *only* to other "intent-related" costs to society, the fiscal alignment is astronomically skewed.
You know, I've begun wondering whether security theater actually *does* make people feel safer. I mean, people enter an airport thinking about their vacation in Florida or making that big sale, and then they get to the great big TSA-run reminder that DANGEROUS FANATICS are just THROWING themselves at the barricades EVERY SINGLE DAY and WHO KNOWS what might happen at ANY MOMENT during your flight, so STAY ALERT but of course don't let the TERRORISTS win.
Consider the ending of this article on the state of security theater on Amtrak:
"A Tribune survey found that most passengers observe little security when boarding or traveling Amtrak trains.
"Yet almost all riders said they felt 'very safe' and likely would choose Amtrak again for cross-country travel."
Now, do they feel safe because they never read alarmist articles like this, or is it because their trip didn't start with a trip through an intrusive security checkpoint?
(The article, by the way, is perfectly correct about the lack of luggage screening, ID checks, etc. The only near-encounter with the TSA I've ever had on Amtrak was during a stop at the Minot, ND station, where some Border Patrol agents walked through the train and half-heartedly harrassed people at random.)
@Pat: I am not missing the point and I do understand risk analysis. What I am trying to get accross is the statisitcs being used are not the best choice.
The way I see it taking the average likelihood of a home being destroyed by a hurricane. Wouldn't you agree your risk analysis would come out different if you compared southern Florida with maine? Same thing with auto accidents -- greater chance in Jersey then in North Dakota. So you spend more in Jersey for traffic control methods then North Dakota. Even within a state like PA, the cost for Traffic control in Philly greatly exceeds that of Wilkes-Barre. If the same was spent in Philly, I'd guarantee there'd be a larger number of deaths and it would draw attention.
Now, am I saying that the article is wrong? No. I just don't agree with the statistics used as being a valid comparison.
"It would take a repeat of Sept. 11 every month of the year to make flying as dangerous as driving."
Which is, coincidentally, equivalent to the annual rate of flu death in the United States.
The lead-in is a great quote:
"There's little downside to being alarmist about terror, so we spend too much on measures that evoke feelings of security without actually improving it."
"Watching his Sept. 12, 2006, appearance on Fox & Friends is unintentionally hilarious. Mueller calmly and politely asks the hosts to at least consider his thesis. But filled with alarm and urgency, they appear bewildered and exasperated. They speak to Mueller as if he is from another planet and cannot be reasoned with."
Alarm, urgency and panic are what TV sells...
@Petréa: simongabriel addresses this a couple comments above. Security theater is not about making people feel safe or comfortable, but about shaping the perception that the authorities are *doing important and required work to make you safer*. Whether the general public actually feels safer or not is irrelevant, as is (mostly) the actual security provided. It's part CYA, part "justify our budget," and part "give us more control," with a remainder of actual effective security thrown into the mix.
> What I am trying to get accross is the statisitcs being used are not the best choice.
I'm not clearly understanding your objection.
From the article:
"For example, international terrorism annually causes the same number of deaths as drowning in bathtubs or bee stings. It would take a repeat of Sept. 11 every month of the year to make flying as dangerous as driving. Over a lifetime, the chance of being killed by a terrorist is about the same as being struck by a meteor. Mueller's conclusions: An American's risk of dying at the hands of a terrorist is microscopic."
You are arguing that comparing international terrorism deaths to bee sting deaths is not a legitimate comparison. However, when it comes to strictly "preventing deaths", there is no quantifiable difference between an intentionally caused death and an accidental one. Dead is dead.
Certainly, if you're making attempts to mitigate any potentially fatal risk to the general populace, your mitigation methodology is dependent upon what you're trying to stop, but the author isn't talking about mitigation techniques, per se, he's talking about the total cost to society of combating international terrorism.
Yes, there was an enormous fiscal cost to losing the World Trade Center, and additional costs involved in the impact on the U.S. economy. However, the massive expenditure on the Iraq/Afghanistan war(s) and the huge increase in money spent by the DHS are far in excess of these costs; we're spending more money trying to prevent another terrorist attack than the attack itself would cost. From a strictly "loss of life" standpoint, even an event 100 times as deadly as 9/11 wouldn't kill as many people in a year as heart disease.
So, either way, we're spending a ton of money on terrorism mitigation with little real return, while we're siphoning that money away from preventing other causes of death which have a demonstrably higher likelihood.
So how come the people on the train have no complaints, when the government is clearly not doing this important and required work?
@Petréa: That's my, and simongabriel's, point. I for one, agree with you when you wrote: "You know, I've begun wondering whether security theater actually *does* make people feel safer."
Security theater is not meant to reassure people or to give more than a low-level of security. It is a display, meant to give the impression that something necessary is being done and that the people who are doing it are important and should be supported.
In that sense, making people feel safe is something of a double-edged sword. You want people to feel that there is a lot of danger they must be protected against, but not so much that the authorities look ineffective. So some baseline level of fear is considered a good thing. They want the public scared enough that they are considered required and important (and given the adequate funding to continue doing their jobs) and to show that they are *doing something.* This has the benefit of that when their measures *do* fail, they will have cover: "We were doing everything we knew how to do -- you saw us! -- but those insidious and clever terrorists figured out a way around all our measures."
Regarding Amtrak, the fact that passengers have few complaints is IMHO a direct result of the fact that 1) there was no odious security theater in place and 2) the perception (real or not) that riding on a train in the continental US is less dangerous (in terms of terrorist threat) than flying.
Actually, I think I'm being a bit to harsh. I'm sure that at some level security theater is about reassuring people enough so that they will go about their business, continue flying and all that. But I contend that they don't want the public *too* reassured. What they want is a level of fear that will keep them in their jobs, plus a little bit more fear added in to see to it that their budgets only go in one direction: up.
Politicians need something, given the end of the cold war, to keep the military-industrial complex pork barrel rolling. See Why We Fight , the 2005 documentary by Eugene Jarecki supported by the Eisenhower institute.
I'm much happier to see them demonizing relatively weak threats than inciting a war with China, which seemed what they were determined to do before they latched onto the "war on terror".
I would even claim security theater is meant to make the people feel more insecure.
Without it, most people wouldn't think that much of possible attacks.
But let's have a look into the mirror.
Who is talking about this theme over and over? Isn't it you and me?
Of course here is a double bind: If we criticize the government, we keep the water boiling - the theme present.
We could be talking of more probable issues ourselve: Everyday crime, global warming, accidents.
Instead we repeatedly focus on terrorist attacks.
Of course one part of our interest is clarification, but one part is the thrill of the theme - which infects media, politicians, security folks as well.
For victims and dependants, it will soud abhorrent, but terrorist attacks are a big entertainment.
In the 1918 Influenza Pandemic 675,000 Americans died.
THAT is a significant hit on society. Yet were the 1920s a period of terror? Rather than destroy society, there seems to have been a vast renewal in the years after 1918.
Any death diminishes us, but to surrender a way of life in the face of a threat is simply wrong.
I would wager the reason that the train service doesn't need this type of security theater is that it's simply not that relevant of a transportion system, when all is said and done. More people fly, it's more visible to get the message across, and then there's the fact that actual activity happened with regard to planes.
Of course there is some minimal security, and I really don't think the government wants harm to come to the way of the populace. Those that spout about how the government wants to secretly have terrorist attacks to come to our soil, that notion doesn't make very much sense.
Think of it this way: The populace goes crazy for every 'prevented' attack, so why actually implement an attack? There's nothing to gain from it. At least on US soil. If there was ever a conspiracy IMO it would be to simply encourage these bungled acts of 'terrorism' in order to keep pushing the line of security further. There doesn't need to be a successful attack.
I really do worry though if we catch something that actually has a serious notion of doing harm, and not just liquids and exploding shoes. If something big enough gets caught and sensationalized, that's going to practically give the government agencies that want that grave power all that they need.
I'll state it again from above. You are only terrorized if you let yourself be terrorized. Criminals are criminals. plain and simple. To clarify as a terrorist instead of just a criminal is simply to serve someone's agenda.
``Americans are not terrorized.''
To put it gently, malarky. An electorate which will stand
still for its government to, among other things,
* force a national ID card (see ``Real ID''),
* cause sufficient alarm to cause discrimination against
_ those without ID, no matter how innocuous they are (my
_ cousin saw a woman thrown off an Amtrak train because she
_ had no ID, without bothering to check whether she had
_ anything dangerous on her),
* wiretap anyone without oversight (the latest wiretapping
_ law allows only listening in on conversations with foreign
_ terrorist, but the only restriction is that the Justice
_ Department says so), and
* say ``I've got a little list'' to stop citizens
_ from travelling, but won't explain why people are
_ on it, nor allow correction of errors.
It's obvious we're no longer the ``home of the brave'', and
as a result are rapidly failing to be the ``land of the
Bruce, I think there's a misdefinition here. "The greatly exaggerated threat of terrorism, he says, has cost the country far more than terrorist attacks ever did" is logically meaningless. The "exaggerated threat of terrorism" and then the costly response are _part_ of the attack. The statement as written is like saying "the cost of the house burning down has cost the homeowner far more than burning candle ever did."
And in fact we are starting to put fire suppression into houses; we could do the same by just agreeing to recognise that these attacks are just bullying acts by gangsters. In which case they will have no force and the losers will just leave us alone.
"Land of the free" has been redefined to mean all of the free stuff you get because advertising pays for it.
It's now "Home of the Braves", the Atlanta baseball team.
Welcome to America of the new millenium.
There's something immensely gratifying to knowing that there is someone out there who cares about what you believe in enough to want to kill you.
@TerroristTheater: The specific tactic used in the U.S. in 2001 (seizing control of scheduled passenger air transports, and then using them to damage specific ground targets) depended heavily on the element of surprise. This is because there is quite a lot that the air transport system, air crew, military air defense and passengers can do in response to such an attack, making it (IMO) exceedingly unlikely that a repeat of this tactic could succeed today.
The steps that have since been taken to make cockpits harder to enter could (had the aircrew understood the likelihood of the ramming tactic), by themselves, quite possibly have defeated the 9/11 attacks. Other obstacles stem from the relatively long time (minutes to tens of minutes) between when an attack becomes obvious (at least, to some of those on board the aircraft) and when it can reach fruition, and the potential for numerous people to interfere during that interval.
In contrast, secretly planting explosives in public places doesn't require cooperation (or at least passivity) from victims who know that an attack is in progress, so it can work again and again even when people know and understand it.
I am curious. Exactly who is afraid of terrorists? I know I am not. It is time to stop flushing money down that rat hole. Also, I am really tired of politicians and talking heads telling me what to think. Terrorists are best ignored. There is no point in giving them the attention they crave. Yawn!
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.