Focus on the Threat
By Bruce Schneier
In the wake of Saturday's failed Times Square car bombing, it's natural to ask how we can prevent this sort of thing from happening again. The answer is stop focusing on the specifics of what actually happened, and instead think about the threat in general.
Think about the security measures commonly proposed. Cameras won't help. They don't prevent terrorist attacks, and their forensic value after the fact is minimal. In the Times Square case, surely there's enough other evidence -- the car's identification number, the auto body shop the stolen license plates came from, the name of the fertilizer store -- to identify the guy. We will almost certainly not need the camera footage. The images released so far, like the images in so many other terrorist attacks, may make for exciting television, but their value to law enforcement officers is limited.
Check points won't help, either. You can't check everybody and everything. There are too many people to check, and too many train stations, buses, theaters, department stores and other places where people congregate. Patrolling guards, bomb-sniffing dogs, chemical and biological weapons detectors: they all suffer from similar problems. In general, focusing on specific tactics or defending specific targets doesn't make sense. They're inflexible; possibly effective if you guess the plot correctly, but completely ineffective if you don't. At best, the countermeasures just force the terrorists to make minor changes in their tactic and target.
It's much smarter to spend our limited counterterrorism resources on measures that don't focus on the specific. It's more efficient to spend money on investigating and stopping terrorist attacks before they happen, and responding effectively to any that occur. This approach works because it's flexible and adaptive; it's effective regardless of what the bad guys are planning for next time.
After the Christmas Day airplane bombing attempt, I was asked how we can better protect our airplanes from terrorist attacks. I pointed out that the event was a security success -- the plane landed safely, nobody was hurt, a terrorist was in custody -- and that the next attack would probably have nothing to do with explosive underwear. After the Moscow subway bombing, I wrote that overly specific security countermeasures like subway cameras and sensors were a waste of money.
Now we have a failed car bombing in Times Square. We can't protect against the next imagined movie-plot threat. Isn't it time to recognize that the bad guys are flexible and adaptive, and that we need the same quality in our countermeasures?
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.