Schneier on Security
A blog covering security and security technology.
« Victoria's Secret Competition Gets Hacked |
| 1941 Pencil-and-Paper Cipher »
November 27, 2008
FBI Stoking Fear
Another unsubstantiated terrorist plot:
An internal memo obtained by The Associated Press says the FBI has received a "plausible but unsubstantiated" report that al-Qaida terrorists in late September may have discussed attacking the subway system.
The internal bulletin says al-Qaida terrorists "in late September may have discussed targeting transit systems in and around New York City. These discussions reportedly involved the use of suicide bombers or explosives placed on subway/passenger rail systems," according to the document.
"We have no specific details to confirm that this plot has developed beyond aspirational planning, but we are issuing this warning out of concern that such an attack could possibly be conducted during the forthcoming holiday season," according to the warning dated Tuesday.
Rep. Peter King, the top Republican on the House Homeland Security Committee, said authorities "have very real specifics as to who it is and where the conversation took place and who conducted it."
"It certainly involves suicide bombing attacks on the mass transit system in and around New York and it's plausible, but there's no evidence yet that it's in the process of being carried out," King said.
Knocke, the DHS spokesman, said the warning was issued "out of an abundance of caution going into this holiday season."
Got that: "plausible but unsubstantiated," "may have discussed attacking the subway system," "specific details to confirm that this plot has developed beyond aspirational planning," "attack could possibly be conducted," "it's plausible, but there's no evidence yet that it's in the process of being carried out."
I have no specific details, but I want to warn everybody today that fiery rain might fall from the sky. Terrorists may have discussed this sort of tactic, possibly at one of their tequila-fueled aspirational planning sessions. While there is no evidence yet that the plan is in the process of being carried out, I want to be extra-cautious this holiday season. Ho ho ho.
Posted on November 27, 2008 at 12:27 PM
• 49 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Bruce, that "Ho ho ho" made me spit water on my computer screen. Thanks for the laugh.
The idea that terrorist might carry out attacks in the subway system, suicide missions or not, is not new. Subway systems in London, Paris and Tokyo have all been targets of attacks in the past that made many victims.
Subways are used every day by millions of people, so it's an efficient way to spread terror. I'm sure there are terrorists discussing the idea of attacking a subway system every day.
This is exactly the opposite of "security theatre" - "fear theatre"?
It sounds to me like the FBI is a mouthpiece for the terrorists; thanks to the FBI, the terrorists don't even need to attack anymore.
By the way, you see the guy across the subway car from you? He's carrying a briefcase. Time to panic.
This gotta be the most sarcastic comment by you in your blog. Cheers for that. :-)
I just read "Ho ho ho" and had a arabican nasal expulsion ...
> This is exactly the opposite of
> "security theatre" - "fear theatre"?
"Fear theatre" is usually called "FUD tactic." As in "Fear, uncertainty, doubt."
"fiery rain might fall from the sky" - that's not al-Qaida, that's Ming the Merciless! To the rocket ship, quick!
Headline news: "Security Guru Schneier predicts terrorist attack this holiday season!".
He says he has no specific details, but wants to warn everybody today that something might happen. He thinks terrorists may have discussed an attack, and while there is no evidence, he wants everyone to be extra-cautious this holiday season.
'aspirational planning' = shooting the bull with their buds?
I'm not making any specific threats, but some mimes may get pantsed this holiday season. Ho ho.
So, what exactly are people supposed to do when faced by such a warning? I would hope that everybody is already reporting unaccompanied packages and luggage.
It seems that nobody reads the classics any more. In the Boy who Cried Wolf, the boy falsely called the alarm so many times, the day the wolf really appeared nobody paid attention to his cries for help.
(Yes I am aware that there are no recorded wolf attacks on humans... it's a parable not natural history.)
Fiery rain you say?
Well, I for one am NOT going to be afraid of that. At least, that is, until you tell me exactly what colour coded level of fear I should be experiencing.
BTW, I have recently been informed that Arab terrorists use "Arabic numerals" in their plotting. So if you happen to see any "Arabic numerals" in the subway, be sure to alert the authorities.
Thank you, Bruce - I think this is the snarkiest comment I've seen from you so far, and I love it. It really made me laugh, and apparently, I'm not the only one, either...
Bruce, you know damned well that the TSA elves forbid feeding the reindeer burritos with extra Salsa del Muerte half an hour before takeoff.
They neglected to mention that they were tapping the line of a Hollywood producer when they gathered this "intel".
And Peter King is such a useless fearmongering shill. Gods, when will Nassau County get a real congresscritter... stuck with that hidebound GOP nimrod for 2 more years. Le sigh. Dammit, if I wanted to reminisce about the 1950's I'd watch reruns of "Happy Days". I just can't WAIT to see what Barack Obama does to Peter King's little DHS boondoggle parade in 53 days. Yes, I'm counting.
It reminds me about the UK terror warning a couple of years ago, which had all the makings of "self denial of service attacks".
Amongst the "people with two mobile phones" may be terrorists was a warning to lookout for,
"strange men with beards and bags"
And I noted at the time that around this time of year there where quite a few strange men with beards and bags, oh and dressed in red...
Happy XMass Ho ho ho...
"people with two mobile phones"
I hope that the point in my security career when I was carrying 3 mobiles and 2 laptops as part of my job (about 8 years ago now) excludes me from this suspicion on the basis of to much kit? LOL
Before anyone asks;
1x personal mobile
1x work mobile
1x support mobile (rotated around the on-call engineers)
1x work laptop
1x support laptop (had additional remote access security so was again rotated)
I and most of the people I know still carry 2 phones... one business and one personal... so I guess we're looking for half the population again!
Hollywood Film Threat time again...
"And I noted at the time that around this time of year there where quite a few strange men with beards and bags, oh and dressed in red..."
So we have a terrorist scenario where all the high street Santa's are padded out with semtex instead of pillows... It would make the IRA Harrods Bombing (can not believe it's 25 years ago this December) look like amateur hour!
Happy Christmas... Ho Ho Bang!
Far be it for me to defend the Bush administration's FBI, but aren't there circumstances in which this would be a good tactic for the good guys to use? Say they do actually have some evidence that a plot is in the works, and don't think they have the ability to interrupt it in time. Wouldn't it be a decent idea to issue a public alert, not so much to alert the public, but to let the bad guys know they're onto them and possibly spook their operation?
(I of course realize the desired effect here is almost certainly more Be Afraid! Be Very Afraid! with a side helping of Covering Your Ass.)
There has been subway terror attacks in London, Paris and Tokyo, but you will notice that never in Israel. I am now at liberty to tell you the secret to our success:
The subway project in Tel Aviv has been in the "plausible but unsubstantiated" stage for the past two decades, with not a single grain of soil shifted for that purpose yet.
Well, we've seen evil robot Santas attack
the Earth in "Doctor Who".
"Wouldn't it be a decent idea to issue a public alert, not so much to alert the public, but to let the bad guys know they're onto them and possibly spook their operation?"
As you may have seen in the news there is currently a situation in progress in Mumbai India.
According to news reports there where warnings issued that the usuall suspects were planing a "Grandstand Operation" to celebrate the US Pres Elections.
Further there is also a significant situation in Thailand.
As you can see from the news it did not in any way stop either event occuring, either by Government action or those commiting the acts being in any way detered.
Further there where quite public warnings about the "sports drink bombers" which resulted in the current liquid ban. In that case the suspects where arrested, but it only encoraged others to drive a fire bomb into an airport in the UK.
In essense the warnings have been shown to have no effective deterent effect, and it would appear that it is counter productive, in that not only does it not prepare people or Governments to act to deter (Cry Wolf Fatigue) but it also appears to encorage others.
Therefor apart from (supposadly) giving people a warm cosy fealing of security (which it plainly does not now) one can only be a case of agencies "wallpapering their fannies"...
@ Clive Robinson
"Further there is also a significant situation in Thailand."
Just to note that the situation in Thailand is a political demonstration and has nothing to do with terrorism. It is inappropriate to link it with recent events in Mumbai.
Note that it was an internal fbi memo, they didnt publish it, the associated press did, so if anyone is stoking fear its AP. Its good that the FBI would make notes that things are plausible so that agents can look for indications that someone was trying, if they didnt then people would attack them for that.
If you look at the article the AP story is doing the same thing that Bruce did in his post.
"WASHINGTON (AP) — Federal authorities are warning law enforcement personnel of a possible terror plot against the New York City subway and train systems during the holiday season, and police are beefing up security in preparation.
An internal memo obtained by The Associated Press says the FBI has received a "plausible but unsubstantiated" report that al-Qaida terrorists in late September may have discussed attacking the subway system."
The AP writer said that federal authorities were warning people, but really they were not until this article was to be written. It was an internal memo not a public warning, and it was not stated how it was obtained, so it could have been a torrid love affair just to get the documents as easily as it could have been handed off, but the lack of description means no one really knows.
> As you may have seen in the news there is currently a situation in progress in Mumbai India.
All of which shows that for the vast amounts of money and incredible resources available to the FBI and DHS the best they can do with that is make inane wild guesses. I don't think anyone holed up in a hotel in Mumbai right now would be too impressed with these agencies level of service in this area.
To tackle terrorism they need to go to the source, not just Al Queda HQ on the Pakistani border ;), but the schools that train and indoctrinate them and the countries that bankroll there (a big hello to you Saudi Arabia). And then there is that Middle East thing.
No. Too hard. Let's just keeping throwing more money at our paper tigers instead.
"Just to note that the situation in Thailand is a political demonstration and has nothing to do with terrorism. It is inappropriate to link it with recent events in Mumbai."
Within the context of what I was saying it was appropriate.
That was with warnings being handed out two significant cases of civil unrest have occured in two parts of Asia.
It does not matter if one is nomanaly political unrest and the other nomanaly terrorist. The result, harm to individuals and the economy of the respective countries is the same.
Both countries have had in very recent times had both terrorist activity related to Al Queda and civil/political action bordering on terrorism.
My point was that even with a warning available both countries were effectivly powerless to stop the events occuring.
I suspect that this was due more to information overload than to any realisticaly avoidable negligence.
This would be just that tiny bit funnier still if you quoted "NO specific evidence" (emphasis mine) in your "Got that:" paragraph.
Thanks for my morning chuckle :-)
"So we have a terrorist scenario where all the high street Santa's are padded out with semtex instead of pillows"
As a plot line (santa as a terorist) it has been covered by the first Futurama Xmas Special (by Matt Gronig of Simpsons fame).
It had such lines as,
"Forget your mistle tow this is my tow missle" (from Santa).
"Look out santa's belly is shaking like a bowl of nitro glycerine" (from ex officer 1BDI).
Shortly followed by Santa saying,
"Merry Xmas, Ho ho.." And exploding upt the chimney.
If you have not seen it I'm fairly sure it will be on TV near you within the next month or so, and I would recomend it as an antidote to all the Three Letter Agencies outpourings 8)
Um... is there any mention anywhere of what people should DO in response to this possibly plausible unsubstantiated threat? Heighten their distrust of Muslims or Muslimesque people? Not ride the subway?
Oh by the way, I have it on good authority that every single person riding the New York subway on December 24th will die. I have very real specifics as to who said this (me), who they said it to (the cat on my lap), where it was said (my office at home), when they said it (see timestamp), what they had for breakfast (1 egg, a slice of home made bannanna bread, cup of Columbian Supremo coffee, note possible South American drug connection there), and what they were wearing (Ex-girlfriends Naval Academy sweatpants)
All in all it sounds like I have better information than the FBI on this one.
I am so glad that you have done the right thing and warned us about a rain of fire possibly falling from the sky.
We can't be too careful, you know.
But you left out what I consider to be the most insidious possible plot that terrorists might be thinking about right now, or at some unknown time in the future:
What if they unleash Godzilla? What if they send King Ghidora, too? (Us kaiju fans will remember the famous line from one of the movies: "Do Not Drive Your Cars, When King Ghidora Is In Your Neighbourhood!"
Or worse, what if they send Santa Claus, riding King Ghidora? What if it's not him sliding down the chimney, but it's "Alien" or "Predator", or both of them together?
What if Santa's main elf helper in the sleigh, isn't really an elf, but is instead Pee Wee Herman? How'd you like him wandering around in your living-room, only a few steps from your kids?
My vote is to replace the entire threat assessment staff of the TSA and FBI, with the screenwriters for the Motion Picture Industry. That way we'll have a firm grip on ALL the possible scenarios.
A Telco Security Dweeb
Back at the end of 2005 I was taking a class in lower manhattan (if curious, it was IBM P5 Virtualization, if that means anything to any of you) and, on Tuesday morning, had to walk to/from the Staten Island ferry terminal.
It wasn't because of terrorism.
NO ONE can disrupt the transit system of NYC better then the Unions going on strike. Nothing short of a transit strike will be all that noticeable, IMHO.
How is this "stoking fear"? This was an internal memo to law enforcement, "obtained by the AP"... so that would mean that the AP is "Stoking fear... not the FBI. Would seem like the FBI is only communicating information to local law enforcement to me.
Why would a terrorist plan a suicide bombing of the new york transit?
Its not like you couldnt plant a bomb at any time with a remote detonator, or better yet, a gas release system that could fill numberous tunnels at rush hour, on a timer. Its not like the subway maps are not available, or the schedules. Heavens. Must ALL terrorists be as arrogantly stupid as our law enforcement agencies?
I think you mis-spelled "stoking", you missed out the "r".
Have a safe holiday
There was an insane rumor doing the rounds at Sydney that terrorists were going to attack a McDonalds. The rumor started when a terrorist dropped something at a shopping centre and a passerby noticed and picked it up. The terrorist said "thank you very much for this. and now I must return the favor by warning you not to stay away from McDonalds." He wouldn't say why of course. Sounds like BS, but the media whipped it into a frenzy. If the incident happened, maybe he was just worried about the passerby's waistline?
"fiery rain might fall from the sky"
NYPD spokesman Paul Browne and the FBI just came in their pants when they read your fictitious threat. Keep up the good work.
Tequilla?? Are you saying that they might cross over the border with Mexico??
Boy, its a good thing that I'll be spending the holiday season in Riyadh, we never get any warning of plausible terrorist attacks here and now I know why! We don't share a border with Mexico.
I'm more afraid of Black Friday shoppers than of terrorists.
Well, they got it partially right:
Terror attacks: right
Location: wrong (only 1/2 a world away)
Target: partially wrong (the terrs did attack a transit station, but also other targets.)
My mildly snarky take on the above: http://blog.etee2k.net/index.php/etee/2008/11/...
>I'm more afraid of Black Friday shoppers than of terrorists.
As well you should be. Black Friday shoppers trampled a Wal-Mart employee to death Friday. The U.S. death totals for Black Friday:
What if the terrorists were able to hook up nerve gas to Santa's sleigh without him noticing? That would be awful.
When I look at political campaigns, advertising, lawmaking, I can see that terrorism is *the* most widely accepted strategy. In the U.S., that is. Draw your own conclusions:
ter·ror·ism: the systematic use of terror especially as a means of coercion
ter·ror: a state of intense fear
It's not a very smart move from the Bush administration if they want to stimulate the economy (in terms of have the people do more christmas shopping) because of the financial crisis.
People definitly stay home in ny after this news flash.
It's interesting. The "be cautious ho ho ho" comments in this article point to information no more detailed than the information the federal government had before 9/11. Terrorists "might" try to hijack planes (newsflash there, huh), terrorists might try to attack the WTC (yet another newsflash), etc.
If they warn us, they are ho ho ho foolish. If they don't and something happens, the same ones who complained they did warn us will demand to know why they didn't stop it (the connect the dots argument).
Overblown vs connect the dots. They can't win. Whatever happens, the same people will use their hindsight bias to belly ache.
Ho ho ho merry christmas.
"If they don't and something happens, the same ones who complained they did warn us will demand to know why they didn't stop it."
No John that is not true. The people who understand that well-planned terrorist attacks are essentially impossible to prevent will not demand to know why an attack was not stopped.
As another person has already asked - just what are people supposed to do with this information? Since you apparently believe it is important that this information be made public - what exactly is the public to do with it?
"The people who understand that well-planned terrorist attacks are essentially impossible to prevent will not demand to know why an attack was not stopped"
Which is what, the few hundred regular readers of this blog? Come on. If I were the FBI or DHS and this memo was on my desk, I'd release it too. I'd rather be accused of being the boy who cried wolf than the guy who didn't warn the public about an attack.
@SumDumGuy: "Since you apparently believe it is important that this information be made public - what exactly is the public to do with it?"
That's the catch-22. It isn't important, per say, to make it public since it doesn't do much good and the public can't do much with it. However, it is pieces of information like this that lead to headlines like "The Government Knew," and protestations saying "we weren't warnned," "information was there and dots weren't connected," etc., after the fact.
One recurrent them here, usually correctly, is that openness and disclosures are appropriate so that we know what were are dealing with. Security breaches must be disclosed, and we have the option of not doing business with the entity. Software flaws must be publicized, and we have the option of not using the software. It gives people the information and lets them decide accordingly.
Therefore, one could argue, albeit it is a different ball game, that when we have intelligence, even flimsy intelligence, that something may be in the works, that it is best to notify the public and let them decide whether or not they want to incur that risk, however small.
There is also CYA. No consequence in warnings vs severe (albeit rare) consequences of not warning. If the equation were different, the psychology of the whole thing would be different.
Seems to me that your position boils down to - the population has irrational expectations so catering to those irrational expectations is the best we can expect.
I prefer another approach, you might have heard it before:
"This great Nation will endure as it has endured, will revive and will prosper. So, first of all, let me assert my firm belief that the only thing we have to fear is fear itself—nameless, unreasoning, unjustified terror which paralyzes needed efforts to convert retreat into advance. In every dark hour of our national life a leadership of frankness and vigor has met with that understanding and support of the people themselves which is essential to victory."
I just can't see that making a mountain of a molehill as has happened in this, and many other cases, could ever be considered frank and vigorous leadership.
@SumDumGuy: "Seems to me that your position boils down to - the population has irrational expectations so catering to those irrational expectations is the best we can expect."
I wouldn't say that. I'm just seeing both sides. I wish the population were more rational with better expectations, but that isn't the reality.
@SumDumGuy: quoting "the only thing we have to fear is fear itself."
Stirring words from FDR and I agree. But, let's keep in mind, he was also the president who set up the office of war information during WWII and filtered it in order to keep morale up because he believed public attitude was essential to success. (That's as far as I'll go here, since I've crossed the line here on political commentary, but context of the person who said the quote is essential.)
@SumDumGuy: "I just can't see that making a mountain of a molehill as has happened in this, and many other cases, could ever be considered frank and vigorous leadership."
I tend to agree with you. You make good points and I enjoy our discussion. I'm just saying that I understand why some information is made public. If the prospective consequences were different, the actions would be different.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.