Schneier on Security
A blog covering security and security technology.
« Infosec Television Commercial |
| End-to-End Encrypted Cell Phone Calls »
May 26, 2010
If You See Something, Think Twice About Saying Something
"If you see something, say something." Or, maybe not:
The Travis County Criminal Justice Center was closed for most of the day on Friday, May 14, after a man reported that a "suspicious package" had been left in the building. The court complex was evacuated, and the APD Explosive Ordinance Disposal Unit was called in for a look-see. The package in question, a backpack, contained paperwork but no explosive device. The building reopened at 1:40pm. The man who reported the suspicious package, Douglas Scott Hoopes, was arrested and charged with making a false report and booked into the jail. The charge is a felony punishable by up to two years in jail.
I don't think we can have it both ways. We expect people to report anything suspicious -- even dumb things -- and now we want to press charges if they report something that isn't an actual threat. Truth is, if you ask amateurs to act as front-line security personnel, you shouldn't be surprised when you get amateur security.
I think this excerpt from a poem by Rick Moranis says it best:
If you see something,
If you say something,
If you mean something,
You may have to prove something.
If you can't prove something,
You may regret saying something.
EDITED TO ADD (5/26): Seems like he left the package himself, and then called it in. So there's ample reason to arrest him. Never mind.
Posted on May 26, 2010 at 9:16 AM
• 32 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Depends how it's reported; if he'd told someone about a package he'd seen there surely wouldn't have been an issue, in these days, but this sheds a rather different light on it:
The one fundamental thing that seems to be missing from security matters is common sense.
So let me get this straight. All a criminal would have to do is randomly leave a bunch of backpacks around filled with just papers long enough to get enough people arrested on felony false report charges. Then when no one would dare report a suspicious package... leave the real explosives in the same style backpacks. BOOM
If Alice sees a box and says something about it, and it turns out to be nothing, Alice goes to jail. But if Alice decides (for any reason at all) that Bob is acting "off," and says something about it, Bob goes to jail. Unless it's on an airplane, then Bob goes to Gitmo.
According to this page (after "Bomb scare suspect evaluated"), Hoopes was the person that left the backpack in the building and then called the police.
So...nothing to see here...move along.
Tim, quick! What's "Bad Wolf" in Arabic? My script just got a new group of bad guys.
A criminal would probably be better off extorting people. Demand money to not get someone fired, or you'll put them in a situation where they have to report a suspicious package that might have a bomb in it.
The big thing that Bruce left out of the story is that the man who left the backpack and the man who reported it are the same person.
At least per the link that AlexP posted.
This is a pretty clear-cut case of false reporting, if the more detailed article in the Statesman is accurate.
I'm not sure what to make of it. What Bruce has reported makes sense within the likes of Boston and other places previous behaviour.
However the page posted by Alex P does not make much sense, in that it is not internaly consistant. However journalists can be way of the mark in their reporting.
Also if the "suspect" has been detained all the time we don't know his side of the story.
Unless somebody has further info I guess we are going to have to wait for the trial (if it ever happens they may just decide he's nuts and lock him up indefinatly without a trial irrespective of what he may or may not have done).
However Bruce does have a point about the odd behaviour of the authorities. In the UK some people have been charged with wasting police time for declining to answer police officers questions even though the person has not been formaly cautioned (had their rights read to them).
Personaly I think the best advice is not to talk to the authorities unless you absolutly must and then be minimalistic in what you say or answer the question with a question.
I actually know of a person who aprehended a shop lifter (retail store thief) then to get charged with assult and spend many months with a court case hanging over them (it finaly got dropped prior to trial but it still hangs over them due to other laws).
Amen, bro. I happened to be first on the scene when some punks set off a small explosion in my alley at 2AM - I was there literally less than 30 secs after the BOOM.
Naturally, I was handcuffed and thrown in the back of the squad car while the police tried to get my neighbors to say they saw me do it. Thankfully, they did not, and none had the groggy false memory that could have had them say they had.
From now on, I say nothing.
Allegedly, the guy who reported the bag was the one who left it there. Check Alex P's link. This was not a passer-by reporting a suspicious bag.
Seems that you've got it wrong this time:
`According to an arrest affidavit, Hoopes left the bag in the pretrial services area of the justice center and then told a Travis County detective that he had "committed a terroristic threat" and that there was a "terrorist plot inside the bag." '
But if you see something twice, please don't think anything at all. It's just a glitch in the Matrix.
A little google-fu shows Hoopes planted the bag, then reported it. Apparently, he got bugged that a judge wasn't seeing things his way, and decided to retaliate.
Which shows that "see something, say something" will indeed get manipulated.
I was in NYC yesterday, not far from Times Square, at a very heavily-trafficked corner near a major hotel. There were 20+ filled garbage bags piled up at the curb. Since in NYC these are totally normal, they are technically not "suspicious packages". Dozens of people walked by while I was there and paid not the slightest attention to them.
Perhaps if someone left an incompetently-designed bomb in a garbage bag on top of one of these piles -- you know, like the SUV, drawing lots of attention to itself but incapable of actually exploding -- NYC would get federal security dollars for improving sanitation.
Here's a different angle (conspiracy theory actually). Ever heard of 'reconnaissance'? Is it uncommon for a member of a "group" to sacrifice himself in order for the "group" to see how we 'respond' thereby exposing potential weaknesses and vulnerabilities? Perhaps this guy did have a gripe against a judge or perhaps he just *said* that to throw off further suspicion! Hmmm.....
Sometimes we hear reports of people going to jail for crazy stupid reasons, but, most of the time, judges can sort out
It's a shame the arrestee turns out to have left it himself. If some random citizen were to do jail time for participating in the circus of fear, that would do the world a favour. "The only thing you have to fear is fear itself", as FDR used to say.
@CTist "Is it uncommon for a member of a "group" to sacrifice himself in order for the "group" "
I don't know of any frequency studies but i can see an opsec reason why it's not strategic to burn a witting accomplice just to gather response data.
His name is Faisal Shahzad. Someone may change their mind on the degree of their committment once they start interrogation. He can't talk fast enough.
But even if he clammed up, known associate investigations are pretty revealing.
An operation depending on burning resources like that are a high risk for failure.
Didn't the security guard that phoned in the Atlanta olympic bomb get arrested?
I was looking to see if after the event he was seen on CCTV camera leaving the backpack in the related articles?
This would have been another use of the CCTV used for evidence after the event.
Alas he confessed to being the culprit.
[Assuming this was mentioned in seriousness and not a satire on some of the more, erm, imaginative ideas out there]
@ CTist at May 26, 2010 12:52 PM
"Is it uncommon for a member of a "group" to sacrifice himself in order for the "group" to see how we 'respond' thereby exposing potential weaknesses and vulnerabilities?"
Yes, it is uncommon and that isnt reconnaisance.
Large military formations have a "reconnaisance in force" tactic (IMHO badly named but...) which involves mounting probing attacks to determine an area of weakness, then exploiting this with overwhelming force.
This does not involve sacrificing assets at any stage. The plan would be for patrols to seek out the enemy and engage or withdraw at the commanders request. None are expected to get destroyed by the enemy force.
With a terrorist group it makes even less sense, yet for some reason every time there is a failed attack we hear claims of "its a test." I suspect this is to stop people realising terrorism is hard, unlikely and normally mounted by incompetent idiots.
The fact is, if you were Terrorist Commander why would you go to the trouble of mounting a full fledged attack with the exception of not having a bang at the end just to see? Once you have gone to the trouble of "burning an asset" you may as well give him real explosives because its unlikely that attack vector will ever be open. The test is just as valid, you will lose just as many of your network but at least you will have got a hit out of it, rather than the light ridicule about sending an idiot to blow his underpants up.
Reconnaisance is about getting in and getting out unseen. Recon in Force is about probing for weakness then exploiting it with massive force. Testing security is done by the good guys.
Terrorists are almost certain to carry out reconnaisance. But after that its a legitimate, fully fledged attack with their best resources. If all they can send in is an old car with a bit of fertiliser in the back, that is all they have access to.
@Seems like he left the package himself, and then called it in. So there's ample reason to arrest him. Never mind.
It's pretty easy to jump to a conclusion that someone is an idiot when we don't know all that they know.
the security guard at atlanta was named Richard Jewel, the feebs tried for six months or a year to frame him for the bombing. His only connection was to report it and get people out of the way, the feebs could see competition from a self aggrandizing hero, and they are the only self aggrandizing heros they ever want to hear from. So it was necessary to leak suspicions to the press, so that the press would camp on the guys moms front lawn, while the media and the government mob were hating on him publicly.
The feebs asked him to cooperate and show them how he would make a bomb, the fool actually thought being cooperative with this was going to help him. the "cooperate" thing was then the key piece of "evidence" they held against him.
If you see something remember richard jewel and move away from the thing without a word to anyone.
Rick Moranis poem is right.
I did remember there being something seriously weird about the Police's case.
Like he had to have run a 1min mile to have been where they claim before the phone call.
I must admit it has affected my behaviour.
I was waiting for a flight in the US recently - a women had obviously forgotten her coat when she boarded.
As a good Canadian I was going to go the desk and tell them, so they could announce it on each plane and find the owner and return it. But then I remembered the response to the poor guy that walked through an open security door at JFK and imagined them shutting down the entire airport for hours and questioning me. So I'm afraid I just got quietly on my flight.
“Never attribute to stupidity what can be adequately explained by malice.”
Interesting... Every story I've ever had firsthand knowledge of, the press has gotten it wrong. Often grossly wrong. Usually pushing a particular agenda or angle.
We are so quick to believe the reports that this fellow left the backpack. Yet we've heard nothing from him directly.
Oh he probably did it. I'm generally prepared to give folks, including the police, the benefit of the doubt.
But I can't help but wonder... If you were the cop involved, and you had screwed up, isn't this the sort of story you'd create to cover your ass?
Many years ago while shopping in very over priced mall store one evening I spotted a lady tucking an outer garment under her long, length coat. Upset that she was not including me in her escapade of crime I simply picked up a store telephone and told the operator what I had seen, described the woman, the jacket, told her the woman was preparing to exit the store and then hung up. As I watched from the wings three security officers came running toward the exit. One pointed, apparently at the lady who was by then just outside the store and in the mall area. They apprehended her, relieved her of the jacket which was under her coat and escorted her back into the recesses of the store. I was content that I met my obligation to myself without regret and never had to participate in the outcome. It simply is NOT necessary to identify yourself when doing a good thing. A reward for a puppy that stops a child from crying is disgusting.
Even more years earlier when living in New York I found a wallet in the street. It had $25.00, some credit cards, pictures, that kind of stuff. I called the owner. He asked if I would bring it to his office in NYC. I was in Queens. At least 90 minutes of commute to deliver this attorney his wallet! After some discussion about alternative paths of return I said "okay and hung up". I then went to a shopping area in South Jamaica, Queens and simply dropped it on a busy sidewalk. No one stopped me as it fell to the ground and it was gone when I turned around to view my followers a number of seconds later. I then smiled inwardly, content that the owner was a jerk that could afford to provide some benefit to the new finder.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..