Schneier on Security

Roger • March 2, 2013 6:35 AM

It strikes me that the common thread in these 3 robberies is a very common one these days: process oriented or standards based security in which the actual working parts have been abstracted away until they are grossly inadequate.

• $750,000 in gold protected solely by a pane that can be quickly smashed open with a simple tool?
• a fortune in jewellery protected solely by a case that can be quickly smashed open with a simple tool?
• tens of millions in diamonds protected by nothing but a chain-link fence?

It is a longstanding, well-known principle that a security barrier needs to incorporate an intrusion detection system and a means of reaction, as well as a physical barrier that delays the intruder long enough for the reaction. Of course, the time taken to defeat a barrier depends on the resources expended; and what the opponent is prepared to invest depends on what he expects to gain.

In the first two examples there was no reaction capability (other than relying on someone to telephone the police, who would presumably arrive after many minutes); the value of the assets protected was considerable; and yet the barriers were not capable of resisting even the simplest, lowest cost attack for more than a few seconds.

The third example is slightly more complex. Airports certainly do have reaction capabilities. (I don’t know if Brussels has the capability to react to eight men with light automatic weapons, but they’d better!) Also, though the barrier itself was weak*, it was a stand-off barrier, which imposes additional delay on the attacker. Hence this attack would likely have failed — badly — if the reaction force was alerted as soon as the attackers reached the fence. The issue here indeed seems to be like the jetski guy: these airports combine weak perimeter barriers with little or no perimeter monitoring. The result is a supposedly “high security area” that half-naked, lost swimmer can just accidentally stumble into.

How can this sort of idiocy happen? Well, I saw an interesting demonstration recently. A certain secure area was being planned, by conventional project managers and engineers. None with any security experience. The site security manager was supposed to provide some security advice, but didn’t really seem to know much about physical infrastructure, and in any case was usually too busy to turn up to project meetings.

Instead, they mainly just referred to whatever various security standards they could find, principally on the internet. And applied them with so little understanding, there seemed to be a total disengagement of the brain. Such as a fence of the same design as one that we know local boys have been climbing over — but it’s OK, because it’s from a design document called “security fencing.” The sole perimeter monitoring is patrolling by the site guard force: 1 man static at the gate, and 1 to patrol 2 square miles, 6 miles of perimeter, and over four dozen buildings. Not surpsingly, he does it from the heated comfort of his truck, with headlights trapping his vision into a narrow beam.

There are alarms and cameras, but they are designed as plant safety equipment that only cover the inner sanctum, so you don’t see anything until the baddies are running away. The miles of fencing — some of which runs through dense woodland — doesn’t have any alarms, camera coverage, lighting or even Mk I human eyeball coverage. All the doors are to be fitted with fancy electronic locks that they found in some government standard, but they are not solid cored doors, not alarmed, and on a weekend are not within earshot of any person.

I could go on, but you get the idea.

• Incidentally, it looks like Brussels airport is now hardening the fence: but in a way that totally fais to address the problem. Hopefully as well as the highly visible concrete blocks they will also add some monitoring.

Roger • March 5, 2013 4:17 AM

@Clive:

As you may already realise, the infamous terrorist “Carlos the Jackal” already did this, on 13 Jan 75. It was a blackly comical farce in which no-one was seriously injured and the terrorists managed to make fools of themselves.

The RPG-7 was actually operated by a Baader-Meinhof Gang [1] member called Weinrich. From the edge of the runway at a range of less than 150m, he fired twice at an El Al Boeing 707 that was taxiing for takeoff. Both rockets missed; the second shot actually hit an Eastern Bloc jet and damaged it, but not nearly as seriously as you might imagine, and no-one was hurt.

In the process they damaged their car [2], and when it was abandoned shortly afterwards the police were able to seize the launcher and two more rockets.

Moronically, Carlos tried almost exactly the same stunt 6 days later. Having lost his RPG-7, he tried to use the much older and shorter range RPG-2. To get close enough, Carlos and 3 Palestinian Arabs smuggled the 1.2 metre long recoilless rifle onto an open air observation balcony facing the runway [3]. But they screwed it up again. Arriving late, they raced to the balcony but when they jumped up with the recoilless rifle in plain view, the Israeli jet that they meant to attack was already out of range. Worse, in the previous few days the French had added some armed guards; the terrorists were immediately spotted by a French policeman who opened fire with a submachine-gun.

The Palestinians took hostages and barricaded themselves in a toilet; the brave and wiley Carlos took advantage of this diversion to run away. Thanks to a string of tradecraft blunders, he was nearly arrested a few days later; he escaped to a notorious life of murder and mayhem because the French detectives sent to arrest him were unarmed, and he simply shot them.

Meanwhile, trapped in their toilet block, the hostage takers did even better: the French government conceded to all demands then flew them out to Iraq.

1. German communist terrorist cell, for those too young to remember.
2. I recall once reading that they had blown out the car windows with the backblast from their RPG, which would be hilarious. However I can’t find a reference for that now. Maybe I’m misremembering it.
3. Yes, there was absolutely no security control for someone wanting to go up to a balcony overlooking all the airport operations, whether to farewell their loved ones, or to start blazing away with a large, heavy and very conspicuous weapon. Ah yes, the good old days when airport security was so non-existent that hijackers would take over a plane by the simple expedient of bringing a pistol and a couple of hand grenades on board.