America's Flimsy Fortress

Bruce Schneier
Wired Magazine, March 2004

Every day, some 82,000 foreign visitors set foot in the US with a visa, and since early this year, most of them have been fingerprinted and photographed in the name of security. But despite the money spent, the inconveniences suffered, and the international ill will caused, these new measures, like most instituted in the wake of September 11, are mostly ineffectual.

Terrorist attacks are very rare. So rare, in fact, that the odds of being the victim of one in an industrialized country are almost nonexistent. And most attacks affect only a few people. The events of September 11 were a statistical anomaly. Even counting the toll they took, 2,978 people in the US died from terrorism in 2001. That same year, 157,400 Americans died of lung cancer, 42,116 in road accidents, and 3,454 from malnutrition.

One problem with securing the nation is the scope of the threat. Terrorists can attack airplanes, sports stadiums, water reservoirs, power plants, chemical storage facilities - the possibilities are endless. Securing the air transportation system isn't much of a solution, because countermeasures that aren't comprehensive are of limited value: If you want to defend targets, you have to defend them all. Protect half the reservoirs and the others will still be at risk. Protect all of them, and the sports stadiums are still vulnerable.

Even defending against a specific threat is very difficult. Security is only as strong as its weakest link; three locks on the front door do little good if the back door is open. Likewise, the air transportation system is only as secure as the country's most insecure airport, because once someone passes through security at one location, they don't have to do so at another. Los Angeles International Airport is planning a redesign partly for security reasons, but the weakest-link principle posits that a terrorist could simply drive to San Diego and catch a commuter flight to LAX.

Many of the security measures we encounter on a daily basis aim pinpoint the bad guys by treating everyone as a suspect. The Department of Homeland Security counts on technology to come to our rescue: databases to track suspected terrorists, facial recognition to spot them in airports, artificial intelligence to anticipate plots before they unfold. But that creates a problem similar to the one you see when airport security screeners waste their time frisking false alarms. Terrorists are so rare that any individual lead is almost certainly a false one. So billions of dollars are wasted with no assurance that any terrorist will be caught. When an airport screener confiscates a pocketknife from an innocent person, security has failed.

The only effective way to deal with terrorists is through old-fashioned police and intelligence work - discovering plans before they're implemented and then going after the plotters themselves. Every arrest of an al Qaeda member weakens the organization. Every country that's unwilling to harbor such individuals interferes with its operation. Of course, we still need some perimeter defenses around airports and government buildings. But more damage was done to al Qaeda by disrupting its funding and communications than by all the guards and ID checks in the US combined.

Security always involves compromises. As a society we can have as much protection as we want, as long as we're willing to sacrifice the money, time, convenience, and liberties to get it. Unfortunately, most of the government's measures are bad trade-offs: They require significant sacrifices without providing much additional safety in return. And there's far too much "security theater" - ways of making people feel safer without actually improving anything.

Airport screening isn't completely ineffective, and there may be ways to do it better. But the US needs to get smarter about its security trade-offs. Our money would be better spent tracking down terrorists abroad than on enforcing intrusive measures at home. Instead, guards at borders and airports should be encouraged to rely more on their instincts than on the technology they're using. With all the technology at our disposal, Fortress America may look impressive, but building it won't make anyone safer.

earlier essay: IDs and the illusion of security
later essay: Cyber Underwriters Lab?
categories: Airline Travel, National Security Policy, Terrorism
back to Essays and Op Eds

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..