Schneier on Security
A blog covering security and security technology.
« Diaries Written in Code |
| Privacy Policies: Perception vs. Reality »
September 4, 2008
Movie-Plot Threats in the Guardian
We spend far more effort defending our countries against specific movie-plot threats, rather than the real, broad threats. In the US during the months after the 9/11 attacks, we feared terrorists with scuba gear, terrorists with crop dusters and terrorists contaminating our milk supply. Both the UK and the US fear terrorists with small bottles of liquid. Our imaginations run wild with vivid specific threats. Before long, we're envisioning an entire movie plot, without Bruce Willis saving the day. And we're scared.
It's not just terrorism; it's any rare risk in the news. The big fear in Canada right now, following a particularly gruesome incident, is random decapitations on intercity buses. In the US, fears of school shootings are much greater than the actual risks. In the UK, it's child predators. And people all over the world mistakenly fear flying more than driving. But the very definition of news is something that hardly ever happens. If an incident is in the news, we shouldn't worry about it. It's when something is so common that its no longer news - car crashes, domestic violence - that we should worry. But that's not the way people think.
Psychologically, this makes sense. We are a species of storytellers. We have good imaginations and we respond more emotionally to stories than to data. We also judge the probability of something by how easy it is to imagine, so stories that are in the news feel more probable - and ominous - than stories that are not. As a result, we overreact to the rare risks we hear stories about, and fear specific plots more than general threats.
The problem with building security around specific targets and tactics is that its only effective if we happen to guess the plot correctly. If we spend billions defending the Underground and terrorists bomb a school instead, we've wasted our money. If we focus on the World Cup and terrorists attack Wimbledon, we've wasted our money.
It's this fetish-like focus on tactics that results in the security follies at airports. We ban guns and knives, and terrorists use box-cutters. We take away box-cutters and corkscrews, so they put explosives in their shoes. We screen shoes, so they use liquids. We take away liquids, and they're going to do something else. Or they'll ignore airplanes entirely and attack a school, church, theatre, stadium, shopping mall, airport terminal outside the security area, or any of the other places where people pack together tightly.
These are stupid games, so let's stop playing. Some high-profile targets deserve special attention and some tactics are worse than others. Airplanes are particularly important targets because they are national symbols and because a small bomb can kill everyone aboard. Seats of government are also symbolic, and therefore attractive, targets. But targets and tactics are interchangeable.
The following three things are true about terrorism. One, the number of potential terrorist targets is infinite. Two, the odds of the terrorists going after any one target is zero. And three, the cost to the terrorist of switching targets is zero.
We need to defend against the broad threat of terrorism, not against specific movie plots. Security is most effective when it doesn't require us to guess. We need to focus resources on intelligence and investigation: identifying terrorists, cutting off their funding and stopping them regardless of what their plans are. We need to focus resources on emergency response: lessening the impact of a terrorist attack, regardless of what it is. And we need to face the geopolitical consequences of our foreign policy.
In 2006, UK police arrested the liquid bombers not through diligent airport security, but through intelligence and investigation. It didn't matter what the bombers' target was. It didn't matter what their tactic was. They would have been arrested regardless. That's smart security. Now we confiscate liquids at airports, just in case another group happens to attack the exact same target in exactly the same way. That's just illogical.
This essay originally appeared in The Guardian. Nothing I haven't already said elsewhere.
Posted on September 4, 2008 at 5:56 AM
• 49 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
The only problem is that the "fundraising" for "general threat of terrorism" is much harder than when you can show something that you really do.
Take the airport. Most passengers probably don't like all that treatment. However they see that something is really being done against terrorism (even if it has no big meaning) but people get the feeling that something is being done. And that feeling gives them also again a bit of security back.
Basically the governments say: "Hey look, we use your tax money to prevent terrorists to hurt us. You can really see and feel and touch it."
See Bruce's previous comments on "Security Theatre" - it's exactly what you're talking about.
"The following three things are true about terrorism. One, the number of potential terrorist targets is infinite. Two, the odds of the terrorists going after any one target is zero."
The mathematician in me says "infinite/zero (respectively) for all practical purposes", but yeah. :)
SJ that's only true for sheep. If you can understand Bruce's point, would this waste of money make you feel ANY safer?
Part of the problem is that we all know about the attacks that did happen, but nobody really knows about the attacks that would have of might have happened if nothing was done. It is far more difficult to make the success of intelligence and investigations apparent to the general public.
I totally agree that airport security, in it's current form, mostly in the US, is a huge waste of resources.
But it would be foolish to remove any and all airport security, and allow anyone to bring anything on board an airplane.
I can hear a couple of trigger-happy US folks shouting already; "if we're allowed to have guns, we'll shoot the bastards!".
First of all, only in the US would non-terrorists bring guns aboard airplanes, so it won't work elsewhere. Secondly, shooting holes in planes is not quite as spectacular as in hollywood, but it's still a pretty bad idea. And finally, what would stop a terrorist from wiring a bomb to a heartbeat sensor, setting it off when you shoot them?
Clearly, there must be some security force to make sure people don't bring large explosives, guns, and knives on planes. Checking luggage isn't such a bad idea, either. But there is absolutely no point in confiscating a kids play scissors, lighters and a thousand other things that can hardly be used as weapons.
Especially the whole liquids thing is stupid; they never check what the liquid actually is. A would-be terrorist could just keep trying getting some ingredients on a plane, because there is no punishment for failure; bomb components are confiscated, but never identified, and whoever was carrying them is allowed to fly.
I think the key sentence there is "Psychologically, this makes sense."
So far, all of the reality-based community's efforts have been focused on pointing at these instances, acknowledging that they appeal to our baser instincts, and arguing that we can't afford to appeal to our baser instincts on such matters.
Psychologically, that doesn't make sense. It doesn't work. If it worked, then journalists (and whatever Christopher Hitchens is) wouldn't be screaming when they subject themselves to voluntary waterboarding. They'd be coolly detached, observing their own reactions, and afterward, commenting on how odd the cognitive dissonance was.
But they scream. Psychologically, it makes sense.
In eight years, the debate hasn't changed. People want to feel safer. They would rather take drastic action than expose themselves to infinitesimal risk. Fighting that is fighting millions of years of evolution (and whatever Noam Chomsky is).
We know the rules of the game; the past few decades have yielded mountains of insights on human perception and bias. Maybe it's time we stopped believing that, with enough sunlight and public discourse, we can convince people that their instincts are wrong. Maybe it's time we figure out how to take advange of those instincts - the same way the fear does. Only backwards.
Anyone have any bright ideas?
@SJ: good point.
But everybody should remember that:
security != feeling of security
Shooting holes in the plane is vastly preferable to having someone blow it up. It really is not a major problem. It'll force an emergency descent and landing, but that's it. As for the heartbeat sensor, suddenly the required bomb becomes vastly more complex, and getting it past the other security checks becomes significantly more difficult.
Bruce, have you _ever_ saw an actual terrorist? You see to many James Bond movies, where "Dr. Evil" character types are really smart.
Back to Earth, vast majority of terrorists are not like this. It's not "zero cost" to change targets, where did this BS came from? Intelligence cost nothing? Forged documents cost nothing?
Thx for pointing out the other article :)
And besides, security is an illusion. I mean it's a fact that we all die one day. Some people die of age, other of sicknesses, others of ....
I mean there's a paradoxon: If I go out I could be hit by a car and die. Hence I musn't go out.
However when I stay at home, my house might collapse (because of an earthquake, structural failure, whatever...). Hence I musn't stay at home. So, where should I go to?
The authorities do what the people expect them to do, so the people will FEEL safer and thereby approve. Quit bashing the authorities as imbeciles. There are some, but their response is largely in anticipation of what the people think.
Just like second-guessing, if a million people submitted a million different tips, even though they couldn't all be investigated, and even though few appeared credible, after the fact everyone will slam the authorities because they had received a tip but didn't act on it. Happens all the time.
In this case, people hear what terrorists attempted elsewhere, so they expect the authorities to respond to it. And I mean OR ELSE. Just as soon as the authorities don't double up, everyone will go "Say, did you hear what the terrorists were planning to do in blah blah blah...the authorities don't care...why aren't they doing anything about this?".
Do you continue portraying others in this way simply because you think it makes you appear more sensible, or because it's what your readers expect you to do?
Bruce, I totally agree with your line of thinking with Security Theater. The sad part is that along with being a species of storytellers, we have a penchant for buying into the stories that inspire fear, or even encourage the spreading of the same.
Stories that inspire feelings of safety are far fewer, and much less sensational.
And isn't that what "Security Theater" is all about? Giving people the "sensation" of safety?
Hmm...maybe it's more about extending the "sensation" of fear...
Jay, above, noted "...People want to feel safer.", and that may be true...and so we have developed systems to "show" them that we're addressing their fears, rather than actually making them physically safer.
But again, is this to give us the illusion of "we are safe now", or to give us the illusion of "If it weren't for these folks we'd all be blown up by now"?
And another question might be..."How can you fund a homeland security department if everyone feels safe?"
Seems to me that "Security Theater" also plays a role in a larger picture...there's money to be made when people are afraid. Not so much when they feel completely safe.
Speaking as a Canadian, the main security concern here is NOT "random decapitations on intercity buses." That was quickly recognized as a one-of event. There are some ongoing repercussions, but people have moved on.
A much bigger security issue is listeriosis, due to contamination at a large meat processing plant, and now apparently at some cheese factories. This is a real threat, with something like 20 related deaths to date, and ongoing debate about food safety issues - real questions, not theatre.
Another ongoing issue is concern about cops with tasers - again, a real threat, with something like two dozen related deaths, and causing debate about a real question.
We certainly have our share of security theatre, but I think you are projecting American excesses onto the rest of the world in a way that far exceeds reality.
While I don't disagree, there's a couple of things that bug me:
1) "But the very definition of news is something that hardly ever happens" - I used to watch the news on a regular basis and it was repetitive - someone was killed in one of three parts of the city, someone was being sued for product defect/malpractice/whatever, there was a car accident where someone was critically injured or died. That's a regular basis, that's not "hardly ever happens"
2) Saying it is a waste of money to protect one thing over another (ie: super bowl vs. world series): Whose to say that the security at one didn't prevent the attack there but forced the terrorist to change the target and they were successful. In the case of the successful attack at the super bowl, more would be lost than at a world series game due to size of stadiums (the umpteen thousand people that lived will say the money was well spent). This is like saying it's a waste to have locks on doors because someone can break through a window. Or it's a waste to by a club because someone else's car will get stolen who doesn't have one.
Again, I don't disagree that money needs to be spent intelligently (airport security -- I'm still waiting for the candiate that says they'll dismantle TSA as a way of cutting federal dollars), but it just *appears* that this comes across as black or white -- money spent on security is either a waste or not and unless it is on intelligence and response it is a waste (with the exception of a few items which are based on opinion -- some would argue blowing up a mall in a suburban town would have more impact that blowing up a plane).
Obed, that's called CYA security. It's a syndrome of it's own and is bad. Just like managing your company to metrics only, you end up chasing opinion and short-term goals and easily miss real threats and opportunities.
Is it the fault of individual bureaucrats? I'm never sure. Every post-disaster investigation seems to find some or many folks who have been screaming for a fix. Did those ignoring it do so on purpose, or is the culture to blame.
Talking about issues like this has a chance to improve awareness, and maybe enough people in the public, inside the security organizations, eventually change their thinking and just maybe the culture changes to one where useful things are done.
I can see checking for (e.g.) liquids for a short while after you've caught some of the terrorists. You don't know if you've caught all of them. After a couple weeks any that you've missed would have changed to another method.
In other words, let's start dealing with the root causes that drive people to commit these acts. Bin Laden and all those before him didn't suddenly appear --- there were signs, warnings, antagonizing acts by the "victim states", etc.
I must agree with JSmith: Canadians are highly concerned with the recent listeriosis deaths. It starts to appear that "self-regulation" where industry (eg: meat packing) or services (eg: airlines) regulate themselves with little or no government oversight is a disaster waiting to happen. Historically, Canadians are more accepting of Government regulations, laws, etc. for the common good but in recent years the mantra of "let the private sector do it" in the hopes that the cost to the public would be less has taken hold. IMHO this is the wrong approach.
Part of the trouble is attributable to a particular pathology of security bureaucracies.
There is a perverse incentive system that rewards the writing of new security regulations and restrictions, irrespective of their actual security value. The ability to write such regulations is coextensive with the power to demand budgets and personnel to enforce them. In addition, the normal bureaucratic obstacles to writing such regs are attenuated, since nobody wants to be "against security", and nobody wants to risk being blamed for the next security failure.
Even a (hypothetical) high-level political leadership with Bruce's sensible view of risk mitigation would find it very difficult to impose that view on the bureaucracy. Congress could do it, especially the appropriation committees, but they're just as scared as everyone else, and anyway they created this problem in the first place when they wrote the Department of Homeland Security and the TSA into existence.
Ultimately, it's the voting public's irrational fear and demand for 100% safety from terrorism at any cost that is the wellspring of this nonsense. That's what the politicians and the civil servants are responding to. Which means that we're unlikely to get out of this sorry, dangerous, embarrassing mess in the forseeable future.
Yes, the current approach to "security" is illogical. The Emperor is not merely naked, but the inadequacy of his "manhood" is pitifully visible to anyone whose eyes are open.
Unfortunately, "security" is impervious to logic. It's all about emotions, fear, and Leaders who eagerly exploit emotions and fear to enhance their own power. It is similarly impervious to the sort of cost-benefit analysis you proposed in an earlier post. The data required for such an analysis is classified, in part to protect it from the Enemy but mainly to protect it from unpatriotic liberals who seek to aid the Enemy by questioning our Leaders who are doing everything they can to keep America safe, strong, and free.
The obligation of patriotic citizens is to have pure, strong, unquestioning Faith that every measure our Leaders impose in the name of "security" is necessary, effective, and completely justified by robust (classified) intelligence. As long as the "security" measures continually remind us of the threat of Islamist Terrorism and keep us in a continual state of Fear, they are highly effective.
"We screen shoes, so they use liquids."
Uh not sure that's correct.
As far as I'm aware there has been no liquid explosives used by terrorists on a comercial flight since before 9/11.
Also the only use of liquid explosives on a comercial aircraft flight by terrorists in recent times I can remember was for a Pan Am flight.
And if I remeber correctly the terrorist concerned had done considerable research and experimentation before he pre mixed the explosive and hidden it in a container in his shaving kit (even then it did not work as intended).
Further unlike the terrorists (/ stary eyed idealists) of recent times he had no intention of killing himself or employing others to do his work. He left the bomb under his seat prior to getting off at a transfer point. Apart from killing the passanger that sat in the seat after him, and blowing a hole through the floor into the lugage area below, the aircraft maintained structural integrity and was landed safely (I can't remember if there where others injured or not but I will assume there must have been some).
The original reason for the liquid ban was that U.K. based "inteligence" had claimed that a group where going to use a doctored high energy drink as the fuel and concentrated H2O2 as the oxident.
However the only evidence offered that this was viable as an explosive was under extreamly controled labarotory conditions by U.K. government experts. They used a concentration of H2O2 that would not be available except through specialised channels. Further it was not shown (publicaly) that the "ploters" where actually capable of doing the considerable number of other things that would have made it a viable explosive on a commercial aircraft flight.
Possibly the experts where the same that showed flour being used as the fuel in an improvised explosive for another trial. Where the prosecution brushed over the fact that as an explosive it was only realy viable for a very short time after specialised drying and mixing (which possibly explains while it failed to go off in use).
Further the terrorists who crashed into the U.K. airport with a fire burning around gas canisters had failed to do their homework. Even if sucesfull they would have produced a boiling liquid fuel which although producing a spectacular fire ball produces little in the way of a shock wave (they needed to add an oxidizer to the fuel to make an FAE/X type bomb).
Most of these "home grown" U.K. terrorists (Richard Reid included) appear not to do the required level of investigation / experimentation to ensure their bombs are viable for the way they intend to use them, or think through carefully how they will actually put their plans into action.
Which begs the question in the U.K. (Which has had considerable terrorist activity in past years over the "Irish issue"),
Where are the proffesional terrorists that know what they are doing?
I am assuming that either there is no threat from proffesionals just idealist amaturs or the proffesionals have been negated by some means.
Policy makers actually operate on a kind of cumulative consensus. Each new measure builds on a previous response. Each time this happens the "local" logic of the decision is not too bad (if we ban guns then we must ban knives. If we ban knives then we must ban other sharp objects etc...). However no one ever steps back from this to see how ridiculous the whole thing has become.
It is easy for contradictory policies to develop in different areas.
For example it always seems odd to me that at home (the UK in my case) the most important freedom is deemed to be the "right to life" and we must sacrifice all our other freedoms to reduce the risk of a handful of people being killed in a terrorist attack. Overseas however (eg in Iraq) other political freedoms are more important and hence hundreds of our servicemen and thousands of Iraqis must sacrifice their "right to life" in order that Iraq can have a democratic government!
"In the US, fears of school shootings are much greater than the actual risks."
It was brought to my attention recently that far more children have died in school from bullets than from fires in the past 20 years or so. The actually risks are very low, but when it comes to death at school, shooting may still be #1.
Because I am specialize in private security, I have the luxury of saying "if the target I am responsible for is so hardened against attack that any terrorist looking to make a statement goes and attacks the target down the street, then that is a win for me and mine".
I really don't know what I would do if I was a public policy maker. I do not envy the decision makers at the TSA or DHS.
Bruce, if I get elected President and appointed you Security Czar (it could happen, I am a US born citizen who owns 2 dark blue suits and I have not been convicted of a felony any time recently), what policies would you institute? I've heard a lot of what we are doing wrong (and I agree with most of what you say), but what would you do instead?
Anyone else is welcome to post their plans.
We are indeed a species of storytellers.
Once upon a time scientists invented an intelligent computer. It was inaugurated in a public ceremony with press and dignitaries present. The scientists cringed as a politician walked up to ask the computer a question.
The politician asked "Do you really think like a human?"
The computer replied "That reminds me of a story".
That's interesting, but I'm not sure why it's significant that school shootings are the #1 cause of student deaths in school. I imagine that far more children die outside of school rather than in school. And really, how a cause of death stacks up *relative* to other causes doesn't seem all that important as compared to how great a cause of death is in absolute numbers. If the #1 cause of children's deaths is still extremely low and there is no reasonable, cost-effective way to lower it futher, couldn't we just say that we're in good shape and leave it alone?
Just wait for the first bomb that has an RFID scanner attached and waits for a US passport to go by before it triggers. That should cause some hysteria.
@Max: That is a great idea! That might actually show the folly of putting remotely-readable transponders into all of our identification documents (not to mention tags on our clothes, luggage, high-value banknotes etc.)
Although, maybe there is a way to make the same point without actually blowing people up. Find some way to accost a prominent politician at an airport and read the details of their passport out loud off of a handheld device that scanned them via RFID, or something. (And hope you don't end up in Gitmo, I suppose.)
I am not as expert as people seem to be, here, but I think that the question of cost is not "transparent" for the terrorists either. If the easiest ways to commit highly-symbolical mass-murders are made difficult (some parts of the "security theatre" are supposed to provoke this) then they have to use more advanced weapons and tactics, and it means that the average guy is not going to do better than carrying the bomb made by the "engineer". And there are not as many skilled technicians as average dudes.
I know that the example may generate some ire, but it seems that Israel has been funding a lot the Intelligence operations, without giving up with a quite effective "Security Theatre" (test Ben Gurion Airport, and you will find Heathrow Security rather easy). OK, the same example is also supporting strongly the Intelligence efforts proposed by Bruce, in the sense that Israelis have also been hunting the "engineers" of the different terrorist groups, through undercover operations.
The core difficulty, for the politicians in the government, is to find the most efficient balance between "Theatre" & Intel., knowing that it is an extremely fluid and complex domain.
@moo: that's another usage-- assassination. Scan someone's passport while standing in line next to them, then set a bomb at a chokepoint that waits for that passport.
@ Max Kaehn,
"Just wait for the first bomb that has an RFID scanner attached and waits for a US passport to go by before it triggers."
Oy! I've already got the copyright on that idea...
Seriously though if you look back at previous pages on this blog, I have repetedly banged on about how RFiD passports actually make us (the legitimate holders) less secure, not more as the Politicos and their advisors claim.
Oh and by the way to tell a U.S. Passport from say a U.K. Passport does not involve knowing any "secret data". Each countries RFiD passport arangments are electricaly slightly different. These differences can be detected in the way the chip behaves when it gets the excitation field from a reader.
Oh and they also make life easier for terrorists who want to go ID shopping...
"We spend far more effort defending our countries against specific movie-plot threats, rather than the real, broad threats."
"We need to defend against the broad threat of terrorism..."
What is a broad threat of terrorism? Examples please. Seems to me the more broad the threat, the less it will be viewed as terrorism.
"Nothing I haven't already said elsewhere."
Or others have said as well, but the question is now whether you can reconcile the years of "humans behavior is inherently flawed/wrong and illogical" with the "please behave logically" line.
About Movie-Plot Threats (which fits the concept of "Security Theater" better than I want to think about, though we may have to go back to the "Keystone Cops" comedic routines impinging on what we try to call "real life") I suspect that the real problem is that the initiative is in the wrong hands.
When our mindset is on defense, we cede initiative to others. Defense doesn't do much for imagination, either... but the attacker is proactive and chooses the ground.
The hell of it is that many of the steps taken to play to the projected fears we're being sold may, themselves, provide the stepping-stone to those with the initiative and imagination to invent new attacks.
The REAL hell of it is that fear sells... so the news media will be motivated to puff up a mole-hill into a mountain in order to sell commercial time and/or news-papers, so any terrorists have a powerful ally in nations with a "free press".
I'm not sure I understand, what is there to reconcile? Humans are inherently irrational but can also overcome that given the will and desire to. Telling people how they're being irrational and why it's bad for them is the first step toward making them stop.
Here's a crazy idea. . . how about acting in a way that doesn't provoke people into hating us?
Here's a clue: they don't hate our freedom. Okay maybe a few fringies might but in general, they don't. What they hate is our meddling in their affairs unnecessarily by establishing hundreds of military bases around the world, exploiting "them" economically and otherwise, and generally acting like schoolyard bullies.
The fact that millions of people stream across our borders in order to get a little slice of the American pie says that we have something going for us, even if it's just jobs. These people most assuredly don't hate our freedom -- they love it, or at least the economic bounty which it provides.
If we acted in the world more like the people who attract all those immigrants to our shores and less like pugnacious, belligerent jerks, swaggering all over the globe, overthrowing governments which we don't like and propping up those which we do, we might just need to spend less on airport security, border fences, spying, wiretapping, and all of the other non- and counterproductive booshwah that we believe brings us security (while really just bringing us less freedom).
As I say, it's a crazy idea but it might just work.
"And finally, what would stop a terrorist from wiring a bomb to a heartbeat sensor, setting it off when you shoot them?"
If the terrorist is bringing a bomb onboard, he's going to either 1) blow up the plane or 2) threaten to blow up the plane in order to be able to do something worse than blowing up the plane. So I fail to see that a terrorist putting a deadman switch on his bomb is going to be significantly different than a terrorist bringing any other bomb onboard.
I would very much like you to put together a list of questions concerning the security and constitutional issues we explore on this site and submit them to the presidential candidates and post their responses here.
I read your piece in my company's morning news alert. I flew from Edinburgh to London and back yesterday for a meeting.
On the outward trip, airport security wanted my shoes and belt off for scanning, along with the usual laptop out on display, jacket and coat off, etc. On the way back, I it was laptop and coat but no shoes or belt. I'm white. The man in front was brown, the man behind was black. They were both asked to remove their shoes and I wasn't. I already had both removed in anticipation and was able to defuse what was starting to become a heated discussion about 'profiling' with the bored-but-becoming-interested mixed-race attendant. Meanwhile, there was a blockage in the line as a man three or four ahead was pulled for travelling with an old Mailbag as his clothes carrier. Odd maybe, but, in the UK, not illegal. It may have had more to do with the fact that the passenger was young and 'untidy' with all the appearance of a backpack/traveller type. The attendants said they'd been specifically asked to pull and search anyone travelling with a mailbag. And how often does that happen? And, if mailbags were flagged as a threat, why was he not pulled over by the heavily armed police we have at all main airports, long before before he got in line at security? The whole thing is pointless and has never caught an attempted terrorist. The two incidents simply provoked the badly-trained, under-educated and, no doubt, poorly-paid attendants to go into overdrive, with a swarm of them appearing to tense everyone up a notch. I was glad that my flight was not for an hour, but this is the kind of unconsidered reaction by 'authority' to perceived 'threat' that makes things worse by the time it's passed down the line. It's been a while since I flew to, or across, the US, but in the UK flying is a last resort for many. The irony is that I had two train journeys and two London Underground journeys, in the middle part of the trip, with more people and zero security checks. And these after the London Underground bombs on 7/7/05 and the Madrid train bombings in 2004. What's so important about planes?
"So I fail to see that a terrorist putting a deadman switch on his bomb is going to be significantly different than a terrorist bringing any other bomb onboard."
The difference is that shooting him doesn't help you.
It may be slightly off topic but the fact that this is possible needs to be repeated again and again to inhibit trigger happy poilicemen and security personnel from killing innocent people.
If the London police had taken this on board they wouldn't have shot dead an innocent Brazilian man in July 2005.
How many people are really terrified by terrorists? I used to think to myself, "I wish people would just stop being afraid and be sensible," and I applauded the commercials to that effect. Now I really believe people are _not_ afraid anymore, yet we still have countless and idiotic examples of security theatre. In fact, I think the less we are afraid the more the powers that be will desperately try to demonstrate how we should be afraid. Fear is good for their power. So yes, the imbeciles in leadership positions are very much to blame.
Again, I ask, are _you_ afraid? Maybe it's just those nameless masses that are afraid, all the while somehow not you or one person you know is actually still afraid?
@Steve: "Here's a crazy idea. . . how about acting in a way that doesn't provoke people into hating us?"
When you are in a capital city far away from the U.S., have a look at the embassy buildings: For example, the Austrian embassy is just like the shop at the next corner, no fences, no gatekeeper. They may be good fellows in the international community, you think. Then the Iranian embassy: well, some fences, some cameras, occasionally a police car drives by. Then the US embassy: steel fences at least 10 feet high, armed guards all over the lawns, dozens of cameras in all directions, permanent police check points built up with very concrete walls, they even blocked the road permanently for all through-traffic, just to be safe. About thirty years back, this was not "necessary". So there must be something they did wrong in the last 30 years.
Intelligence and investigation don't win votes. Grants make constituents happy. So money that could have been spent on intelligence is spent on police cruisers, helicopters, IED squads, "remediation" projects, and a thousand other pieces of pork. I'm pretty sure all the people who voted for these things were elected by the people. The fault lies not in our stars, but in ourselves.
"I'm not sure I understand, what is there to reconcile? Humans are inherently irrational but can also overcome that given the will and desire to. Telling people how they're being irrational and why it's bad for them is the first step toward making them stop."
I'd rather feed them all to raptors. That would make them stop, too. As a bonus, there would be less people around to gum up everything.
The amount of time/money wasted on movie plot threats is phenomenal. Equally phenomenol is that the countermeasures do little to counteract the threat. For instance, in Texas some want to give teachers guns. This, they hope will stop campus rampages. In the threat assessment, they specifically mentioned a new major road passing through the town bringing in strangers who might harm the children. Do they think this Mad Max? Last time I checked, most campus rampages were enacted by students, students who were not unwilling to die. Perhaps teachers could kill the students before the students have a chance to act, and that may save lives. In any case the threat they seemed to be worrying about is not the threat that is historically present. It is interesting that they are more concerned about what they see in the movies than what the see in the news.
The security stuff at the airports, while annoying, expensive and backward looking, is probably not something we could do away with. Too many crazys that would take advantage.
However, I agree with the idea of using intel more to stop threats before they become real. A .50 caliber bullet from a sniper rifle is a lot cheaper than all this other stuff.
Of course, then we have all the other issues about due process, and who decides who to shoot when, etc.
So how do we deal with that?
Personally, I don't care. Give the intel guy on the ground the mission to find them and take them out; then if he decides he's got enough evidence, he does it and I'll trust his judgement. It's not likely he'll take out a total innocent, maybe a wanna-be instead of a real terrorist.
But a lot of other people would not be willing to go down that road.
Once again, it comes down to the American public and our "leaders" not being able to logically decide what we want and stick to it. We want to be safe but we don't want the hassle or expense. And yet we will allow a city to tell us what food we can eat or take someone's property to let a developer have it.
We are our own worst enemy.
One, the number of potential terrorist targets is infinite.
Government response: Then we must spend an infinite amount of resources on fighting terrorists!
@ Bruce Schneier and Andrew S:
"The following three things are true about terrorism. One, the number of potential terrorist targets is infinite. Two, the odds of the terrorists going after any one target is zero..."
The second statement is intuitively and empirically false (else they wouldn't have hit the WTC), and both are factually false. The number of potential targets is not infinite, just as the number of grains of sand in the earth is not infinite. Both are very large numbers, but neither is infinite, and both are estimatable, at least for an upper bound-type estimate on the targets.
The Earth's surface consists of a finite, and estimatable, numbers of square meters or square feet or whatever, including the sea surface and ocean floor. Any given stationary target (building, stadium, Wal-Mart, etc. can be placed in one of these grids. If the target is a person or persons, that number is even smaller, and even closer estimates are available.
If the target is a moving object -- car, train, subway, bus, airplane -- the total number of those is large, but estimatable. The surface-bound objects occupy units of space at any given moment, as do the persons -- same math. Aircraft could theoretically raise the calculations greatly by the number of cubic units of airspace contained between the earth's surface and the sevice ceiling of aircraft, but if the target is a specific aircraft or flight, the number of those is pretty well-known, and if just any aircraft in general, ditto. Still not infinite.
In short, I agree fully with Bruce's big picture, but using poor math to support it doesn't help get it across. In particular, if the chance of terrorists striking any particular target is indeed zero, then we shouldn't spend anything at all on security, nor have laws against such acts -- clearly, a reductio ad absurdum.
A couple of your comments remind me of things from my past,
Your comments on,
"One, the number of potential terrorist targets is infinite. Two, the odds of the terrorists going after any one target is zero..."
Are correct, however I suspect that you have not read the works of Douglas Adams. In Hitchhikers he used exactly this argument phrased in almost the same way about inhabitans of the Universe and sex. It concluded that mathmaticaly there could be no sex whilst observing that there was actually quite a bit of it going on.
Now I don't know if Bruce has read Hitchikers but he is of that age (sorry Bruce that makes you sound like an octogenerian where as in realaty you are only just over half way there ;) so he may have been unintentionaly using the argument.
The second observasion is about your comments is,
In your paragraph,
"The Earth's surface consists of a finite, and estimatable, numbers of square meters... ...can be placed in one of these grids."
Reminds me of how weather forcasting software works.
A little further thought about the equations used for weather forcasting and a first cut model of what you are describing shows them to be broadly similar.
So the thought occures that you might just have thought up a new "gold seam" in getting DHS/etc funding.
Go write a paper and live long and prosperously on it ;)
LOL! Haven't read "Hitchhikers", but am aware of its existence. Is this the time to recount the old (but not quite octogenarian) joke about the professor describing to his class the meaning of the phrase "for all practical purposes"?
He lines the boys up on one side of the room and the girls on the other, facing each other. Then he tells them to step forward enough so as exactly to halve the distance between them. (Yes, I know some ancient Greek -- Xeno? set this down first, but this one has a funnier ending.) They are to repeat this process, each time cutting the distance between them exactly in half. The professor points out that mathematically, they will never meet, but actually, after a rather small number of iterations, they will be close enough "for all practical purposes".
The other "Anonymous" (second comment from the top) caught the math error but came to the opposite conclusion, that the chance of a single-target attack was zero "for all practical purposes", which still leads to the faulty conclusion that the correct amount of money and personpower to spend on security is zero.
(Incidentally, I don't know if you are the same "Anonymous", but that's why Bruce's comment box asks, under "Name",
"Real names aren't required, but please give us something to call you. Conversations among several people called "Anonymous" get too confusing.")
Yes, I was aware of the weather forecasting model, and that it is in three dimensions, since much of what they measure is above the surface, and that increases in computing power and measuring capability allow the division of that space into increasing numbers of smaller blocks, much like the first introduction to calculus consisted of measuring the area under a curve by using ever more, ever smaller squares.
Thanks for the reply and for the great idea re: DHS grant money. I suppose that since you suggested it, I owe you a job on the team and a share of the grant money. Your mission, should you choose to accept it, will be to calculate the relative probabilities of attack on, say, a square meter of craggy rock in a remote, uninhabited section of the Rocky Mountains (or Australian Outback, or Sahara, etc.) versus, say, a square meter of Manhattan, of Washington, D. C., or of the City of London.
Here's to living long and prospering by beaming up tax dollars! (That's what a lot of people do, and apparently, that's where the politicians think the dollars come from.) -- I.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.