Schneier on Security
A blog covering security and security technology.
« Another Schneier on Security Book Review |
| Influential Security Professionals »
December 12, 2008
Jim Harper Responds to My Comments on Fingerprinting Foreigners at the Border
Anyway, turning someone away from the border is a trivial security against terrorism because terrorists are fungible. Turning away a known terrorist merely inconveniences a terrorist group, which just has to recruit someone different. The 9/11 attacks were conducted for the most part by people who had no known record of terrorism and who arrived on visas granted to them by the State Department. Biometric border security would have prevented none of them entering.
(Another option is physical avoidance of the border -- crossing into the United States from Canada or Mexico at an uncontrolled part of the border. I know of no instance of this occurring (successfully), but it could. And, most importantly, there's no cost-effective way to prevent it.)
In summary, border biometrics have some benefit! They are at best a mild inconvenience to terrorists -- an inconvenience that the 9/11 attacks mostly anticipated. But that's not zero benefit! It's just negligible benefit.
Posted on December 12, 2008 at 6:21 AM
• 41 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
I agree with the opinion about terorrism. But I have spontaneously 1000 reasons in my mind why it can be "usefull" (for one or another "agency") to have all the fingerprints of people crossing a countrys border. I think it is against ethics or moral. But hey ... none of us should be so naive and realy belive that they belive it helps agains terorrism. We know and the governement know what's the reason for that "fingerprinting". IMHO
It isn't just the US. When I was in Italy recently, I had to supply a thumbprint to enter a bank. Considering all the guards at public buildings were armed with automatic weapons, I didn't feel like objecting.
Is there really a disagreement between you two?
Bruce: "zero benefit"
Jim: "negligible benefit outweighed by the costs"
"Turning away a known terrorist merely inconveniences a terrorist group, which just has to recruit someone different."
I'm not able to grasp that concept. Would someone please explain to me why we wouldn't let a KNOWN terrorist into the country and then ARREST that person for being a known TERRORIST?
#1. You have a known terrorist in custody.
#2. The other terrorists do not know what he has told you about their plans or who the other terrorists are.
#3. You have a known terrorist in custody.
I would ask both Bruce and Jim this question...and follow-up:
Have we really turned away any 'terrorists' at our border? If so, why?
If we have had someone in our custody and know they are a terrorist, why would we have let them go?!? It doesn't make any sense. I would speculate that we have only stopped/detered criminals and the politically unpopular (Cat Stevens) at our border. Unless someone can prove otherwise, I'd side with Bruce's zero number, rather than Jim's near-zero number.
I don't think we need to 'let them into the country', since they are in the country and in the custody of the border/customs officials at the time we are gathering biometrics and other demographic/profiling data.
I agree that there is probably little practical benefit in the context of terrorist threats. It is more likely that the true benefits to be derived from fingerprinting people at borders will lie with long term immigration management (as opposed to control).
In a global labour marketplace where economic migration is an ever increasing factor, we need to have mechanisms in place that will allow illegal immigrants to be identified and dealt with more efficiently, reliably and with dignity. We need approaches that offer the possibility of ensuring that honest immigrant's identities are not 'stolen' or abused by the more devious and dishonest elements of society.
Despite this, the primary issue will always remain the management of, and restriction of access to, personal data. If the media continue to conflate the many issues related to identity, biometrics and data security, there is very little chance that the uninformed observer will truly appreciate the complexities of the situation.
For a moment I found myself hoping that maybe DHS isn't telling us about the handful of "known terrorists" US-VISIT, ATS-P, or Able Danger (whatever happened to them by the way?) is allowing them to subject to special rendition or being disappeared, then I remembered that I'd rather our government be inept instead of wicked.
If you turn them away, you don't need to give them due process of law. You just send them back where they came from, and request some "co-operation" from them.
@ aikimark; I think when the new fingerprinting (10 digit) rules were implements DHS claimed something like 200 people had been turned back from the border b/c of issues.
It is a stupid rule -- but another benefit is a post-facto analysis; catch a guy (under an assumed name) run his fingerprints, then find he's been to the US five times. Could provide some investigative tools. Probably not worth the billions spent.
There is more hidden cost to the border biometrics. I have friends that used to do road trips across the US. Now they refuse to travel here because they don't want to be treated "like a criminal,"
having to prove their good intentions to the customs officer rather than the other way around.
In recent years, the US has lost the good reputation it once had of welcoming travelers. Not just at the border, but also with the war on photography and the fact that you now sometimes need three pieces of ID to rent a car.
So despite the decline of the dollar, tourists just travel elsewhere, and the US is loosing out on billions of revenue.
Yeah there are some that feel that way, but I think you are greatly overestimating their numbers. I'd put the loss estimate closer to "millions" or possibly just "hundreds of thousands" in lost revenue.
Tourism is incredibly powerful in terms of the cash it moves. A single event in a small town can have an economic impact measured in millions. To say America is doing itself economic harm by not being open for business is no exaggeration.
If you accept that you should identify each person entering the country, then how best to do that is just a cost-benefit analysis. To be honest I don't know why being fingerprinted or bio-scanned is any more outrageous than showing identity papers. And I don't know that foreign nationals have a "right" to enter a country anonymous or without record.
To be honest I'm not sure I could enumerate the benefits or requirements that we identify every person coming into the country, or why other countries do the same thing.
@partdavid: "And I don't know that foreign nationals have a "right" to enter a country anonymous or without record."
I've been to over a dozen countries in the past 4 years alone, and I have never been permitted anonymous entry. I doubt it is recordless either.
I do think some people have a deep disdain (or jealously) for America and people are naturually more likely to gripe about someone or something you already don't like. So, an identical experience at two places would yield much different reactions based on peoples existing dispositions. (I'm not saying that there isn't more scrutiny at our border than at others, I'm just saying the reacts are already destined to be more intense.)
"Another option is physical avoidance of the border -- crossing into the United States from Canada or Mexico at an uncontrolled part of the border. I know of no instance of this occuring (successfully), but it could."
I know of plenty of times it happens every year here in the south-west. It makes headlines every time a group of illegal immigrants gets themselves killed from exposure out in the desert. I don't know how Mr. Harper could have not run across those reports at some point. Unless he's saying that, while plenty of people have come across that way, we haven't captured any terrorists who've confessed to doing it.
We all know that fingerprints are "unique" to a person (except possibly for identical twins.)
The problem is, very little research has been done to find out just how unique fingerprints are.
If you are attempting to detect a few hundred threats in a population of millions travelling across borders each year the problem of false positives will certainly arise.
@Todd and andyinsdca
Mind the context of the statement in the original article.
He was not talking about illegal immigration, he was talking about Terrorists using physical avoidance to enter the country to commit terrorist acts.
Unless, of course, you consider illegal immigrants terrorists.
@Todd Knarr: I suspect his position is that detecting them because they died disqualifies it as having been a "successful" crossing...
@bob: It's the people who unsuccessfully attempt to cross the border through the desert that make the papers. Most of them survive it, though.
The survivors get picked up by people waiting on this side & disappear into the US. There probably aren't any good numbers on successful crossings in those instances.
And of course money spent not deterring foreign terrorists is also money spent not deterring domestic terrorists. But perhaps we could fix this by requiring a fingerprint check anytime anyone enters or leaves the boundaries of a city or town.
@havvok: Illegal immigrants want to get into the country without going through the normal entrance process. Terrorists want to get into the country without going through the normal entrance process. The first group is regularly succeeding by simply coming across where there aren't any checkpoints. The probability that the second group is failing to follow the first's lead is... well, negligible would probably be a high estimate.
I'm also shocked and confused by the terrorist/criminal distinction Harper seems to be making. Is there a case where a known terrorist isn't also considered a criminal? If so, don't we have a pretty serious civil liberties problem?
@David, Brandioch Conner: Is being a "known terrorist" a crime? Which statute does this violate (I'm not saying it doesn't, just looking for the specific law here).
Menachem Begin, a known member of Irgun (the organization that famously blew up Jerusalem's King David Hotel), visited the U.S. more than once as the Prime Minister of Israel.
Gerry Adams, widely suspected of involvement in bombings by the Provisional IRA, can also visit the U.S. (though he does get delayed: he's on the watch list).
I'm sure readers can find many more examples.
For that matter, many of the people on the bloated watch list are supposed to be "known terrorists". According to TSA, they are frequently turned away at airports. If being a "known terrorist" is a crime, why aren't they arrested?
Authorities at Fox News (notably, Sean Hannity) assert, with absolute certainty, that William Ayers is a "known terrorist." How is this man walking around free?
As a U.S. citizen, I'm deeply attached to the principle that the force of government must be constrained by law. It would be a horrible tragedy if people could be legitimately arrested in America because someone "knows" that they are "evil/subversive/members of criminal organizations/etc." Although the rules are often bent or broken, governments in the U.S. are required to prove that an arrested person has violated one or more specific criminal statutes, or else set that person free.
The unconscionable actions of the U.S. outside of our territory (Gitmo, and in various other parts of the world) since 2001 are exceptions that prove the rule: the Bush administration was careful to keep these "known terrorists" off of U.S. soil, so they wouldn't have the protection of due process.
For examples of governments NOT effectively constrained by such laws, I recommend study of: Germany 1933-45, militarist Japan (they actually had Thought Police), revolutionary Iran, Kampuchea, Afghanistan under the Taliban...
Doesn't the cash cost of US-VISIT underestimate the real cost? For example, it was reported in 2003 that US citizens visiting Brazil would be fingerprinted, in a "tit-for-tat" policy.
I don't know whether this is still going on, and whether those fingerprint records will ever cause measurable harm to US citizens abroad is debateable.
Still, it seems to me that foreign border services being actively hostile to your citizens because they think your border service are a shower of bastards, is going to cost those citizens from time to time.
@ My "HJohn at December 12, 2008 4:33 PM" comment.
I take that back. It was meant to be light hearted, but it doesn't come across that way in text. It comes across uncharitable, and that was not my intent. I'm certainly not one to talk, since I've ranted politically on occassion.
My apologizes. Have a great weekend bloggers.
After 8 years of this crap, the outrage just becomes a bit muted. WhatIsTheLaw is really just spelling out the implicit rhetorical irony that serves as shorthand these days for commentary about dysfunctional policy. I suppose the coming administration signals that it's time to become explicit about policy dysfunction again, and then yawn, because we've said it all before.
What realy shocks me is that with the worl economy in the "cr4pp3r" why on earth people are not saying "Hang on this policy is costing how much where's the ROI/cost justification in full".
Not just the 25Billion the two programs mentioned are costing (a large chunk of which goes into foreign economies)
But about the whole Afganistan / Iraq / Pakistan spend.
The real costs of this not just the immediate visable costs are going to be shouldered br every man woman and child in the US not just now but for the next three to five generations and will be equivalent to ten years per person of taxation...
And I'm sorry Bruce I don't mean to be rude but, you say it's of "zero benift" and Jim Harper says "negligable benift", please tell me how you guys define "benift"?
Oh just one thing for all readers to consider.
The US dollar is only currently held up by the fact it is still being used as a major trading currancy.
However it is lossing ground to amongst others the Euro.
Ask yourself what value the dollar will sink to when it is no longer seen as fit to use for international trading?
Will it be worth even a quater of it's current buying power?
Then have a look at what has happened in the likes of Argentina and have a good long think about what national security is realy all about...
> Would someone please explain to me why we
> wouldn't let a KNOWN terrorist into the country
> and then ARREST that person for being a known
You'd have to be able to prove it using evidence that is admissible in court AND that you don't mind *showing* to the court. If your only strong evidence that the person is a terrorist is based on intelligence from a source that you don't want to reveal (because, for instance, that could result in his being executed and thus no longer able to provide you with information), then you might simply choose to turn the known terrorist away at the border, yes. Or you might choose to let him in and do extensive surveillance on him, if you think you can legally get away with that. But you wouldn't arrest him, because you don't (so far as you are willing to reveal in detail) have any admissible evidence.
@Anonymous "December 13, 2008 10:29 AM"
But at the point where you're placing half a million people on a terrorist watch list and then applying that logic to all of them, you're essentially conceding defeat. How are you going to effectively surveill half a million people? If someone responds, "with the TSA," then I'll know for sure they're joking.
I'd argue that biometrics at the border would probably be of significant benefit in apprehending suspects if it weren't the case that the scope of the watch lists is beyond ridiculous. Trying to read minds and catch people who might do something wrong criminalizes everyone. Trying to read fingerprints and catch people who have killed others is well within the mandate of law enforcement.
"I know of no instance of this occuring (successfully)..."
Wasn't there a Mexican serial killer/rapist that was riding the rails and crossing the border at will about 10 years back?
suppose there were 1000 sent back, there might be another few thousand that changed their plans and didn't try because of the higher risk of being detected/detained, makes it a bit more efficient than one thinks at first, though still very expensive
i would think it's easier for middle-east trained terrorists to come thru the mexican/US desert border - they already live and train in a desert!
I'd put the loss estimate closer to "millions" or possibly just "hundreds of thousands" in lost revenue.
Better round that back up to the billions. Tens of billions. Every year.
A couple of years ago there was an estimate that the TSA's bungling had cost 200,000 jobs and $98 billion in revenue over a 2-year period.
Too many issues:
How do you get on or off of the "no cross" list? Is it like the "no fly" list? Was there a judge or jury involved? Are these people too dangerous to let into the country but not dangerous enough to arrest?
When the rest of the non-secure border allows a troop of elephants and a mariachi band to cross unchallenged, you only catch the stupid. That kind of defeats the purpose of the list, since they're not dangerous enough to just avoid the scrutiny by avoiding the checkpoint.
You can go through US customs on foreign soil - Montreal is one such place. Whenever I fly to Montreal (from Washington state) I go through Canadian entry customs at the Montreal airport (YUL) and when I return to the US I go through US entry customs at the airport in Montreal, even though the American airports I'll change planes at, AND my final destination have full customs facilities.
The difference between "zero" and "negligible" is of no practical significance. "Of no practical significance" is effectively zero. "Effectively zero" is zero for all practical purposes or considerations. How much closer to zero does "negligible" have to get?
There is a negligible chance that "negligible" is distinguishable from zero.
My newly married 21 yr old niece and her 23 yr old husband (live in Canada) were invited to Hawaii by some family friends. He is a videographer and was going to be filming the vacation. Well when US customs got them they carted him away and badgered, bullied him to tears for almost 4 1/2 hours, accusing him of secretly filming some "things"..what in the world does that mean..this is a holday? Then they (customs) wrote out a statement stating this secret filming was his intention and verbally abused him to sign! It's a false statement and of course he didn't and they were mad, so they fingerprinted him and put his name on some kind of list...how assinine!! Meanwhile my niece was told to stand in a corner, not to cross the line and stood there crying while they took her husband away for 4 1/2 hours! How shameful of them. i'll be thinking twice about travelling to the US. Those with innocent fancy cameras, video-taking devices if going on vacation beware..you may be treated like a criminal and harassed by the US bullies!!
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.