Layers of Security

Privacy PC
September 5, 2012

Bruce Schneier, the well-known American cryptographer and security specialist, gives an interview to Radio New Zealand's Bryan Crump during his visit to the country, discussing real-world security issues and whether anti-terror measures done by the authorities worldwide are as effective as expected.

(Bryan Crump): -- Bruce Schneier is a security specialist who seems to be trying to talk himself out of a job. His point is a lot of what we do to protect ourselves against terrorism is pointless. The best weapons against terror are, in his opinion, good intelligence and refusing to be terrorized. Bruce is based in the United States of America, was in New Zealand for a conference on identity and identity theft. Recently I spoke to him while he was here and began by asking what attracted him to this seemingly dry topic of airport X-rays baggage checks and the like.

(Bruce Schneier): -- The security actually isn't at all about attackers and defenders, police and criminals, good guys and bad guys, you know, it's going to be the ultimate kid topic, I don't think it's dry at all. I've always been interested in security, I've been interested in mathematical security, cryptography, and then computer and network security, then security technology, and then how people keep things secure and how people break security. And I think it's a mentality: you wake up in the morning, you look around to you figure out how you're going to hack a system. I remember as a kid, I was going to a voting booth and thinking: "How could I cheat here?" It's a way of thinking, and I think it's really interesting.

- In other words, you've always looked at it from outside to some extent, rather than from the inside keeping things out, you have always been curious how the outside gets in.

- Well, they're both the same. You cannot work as a defender unless you understand an attacker, so it's not inside vs. outside, it's taking a system and breaking the rules, and that's the way to think of it. And whether you're trying to stop someone from doing it, or you do it yourself, you still have to understand how the system works and how you can break the rules.

- People talk about the post-September 11th, 2001 security changes, but I remember that the first big changes in airport security were after the Lockerbie bombing in the late 80s, that's when I remember they started to, you know, run those things over your clothes, which used to squeak most things. I remember those in the early 90s, and that was post-Lockerbie.

-- Well, those were the metal detectors. It's got to depend on your country. In the United States it was the 1970s that we started having hijackings, before that there was no airport security. In many countries even after that there wasn't any airport security, because, you know, think of New Zealand, where are you going to hijack a plane to, most planes don't have the range to go anywhere, so it wasn't considered a risk, Hawaii was like that. And then changes happen slowly. In the United States after Lockerbie we got photo ID checks, they matched your ID to your ticket, we didn't have that before then. And so, changes happened after different events depending on the country. September 11th was a big change in the United States, not for the better, but it eventually made airport security more annoying, and then the United States government pushed those changes to Europe and elsewhere.

- Tell me now, when traveling in the States -- you left Detroit the other day -- what are the standard security checks now you have to go through?

- Going through the airport is much like you do here, unfortunately I haven't left New Zealand, I've just arrived, I don't know the checks here. You are going to go through a metal detector, and there's going to be an X-ray machine for your luggage. There's also a photo ID check, where your name is checked against your ticket, and the stuff in the background there: the United States maintains no-fly lists, and secondary screening lists; if you are on one of those lists, you'll be either denied boarding, or checked further. You have to take your computer out of your bag, that's checked separately, and that was actually standard in Europe even before 9/11, it moved to the United States, there's regulations on liquids, so you can't take a lot of those, you can't take a wine bottle in, you can only take very small bottles of liquids. And there are other little rules like that…

- You can't take sharp things in, those old nail clippers -- I couldn't bring them for years. Is that changed?

- Nail clippers sort of came and went, and it wasn't the nail clipper itself, it was the pointy thing, the nail file, and occasionally they would break them off and give it back to you.

- They were never that nice to me…

- Now there's no problem, I bring my nail clipper on and there's no worries.

- Are there still air marshals in the States?

- There are air marshals, but how many there are is unknown. So we know there's an air marshal program, but if you think about it, an air marshal program is a deterrent effect even if there are no actual air marshals, there could be just one, or ten, or a hundred -- we don't know, we don't know what planes they're on. The airlines don't like them because they take up first-class seats and don't generate any revenue.

- Because they are not allowed to drink, are they?

- Also they don't pay for their seats, more importantly. And I think they're supposed to dress in suits, I don't know the rules. The other thing is you have to take off your shoes. That depends, in the United States you still take off your shoes, in Europe most of the time you don't.

- I know in the United Kingdom you do, because family members were trying to get from London to France the other day, they had a baby with them, the baby had to take the booties off.

- Now, you know, when I left London last week I didn't, it seems particularly variable.

- Yes, obviously.

- Yes, it'll depend on the kind of shoes sometimes, whether you have a very thick heel versus a pair of sneakers. So the rules are sort of in flux, we now have a Trusted Traveler Program in the United States…

- What does that mean?

-- So if you're on it, which means you go through some background screening -- I think it's only available for frequent fliers right now and American citizens -- then you go through a special lane where you don't have to take your shoes off, and your liquids out of your suitcase, and your computer out of your case, and you don't have to take your coat off and your hat off. You can go through very quickly, actually it's very pleasant, it's like security was 15 years ago.

- Are you a Trusted Traveler?

- I seem to be.

- How much does that cost: all the security, all that's put in, just, say, since September 11th, 2001?

- Well, we know the budget of TSA in the United States is $10 billion a year, it's about 10 years…

- Sorry, TSA stands for…?

- Oh, the Transportation Security Administration is basically airport security in the U.S. Their budget's $10 billion a year, $100 billion in 10 years is what airport security has cost the United States. Now, I don't know, UK, Europe, Australia, New Zealand, Japan -- I mean, you can add this up, and it gets even more, this is actually very expensive. A lot of arguments are now made that it's not worth it, which, I think, is about time. In the early days after September 11th people were scared, and they were willing to do almost anything, now people are looking at some of the stuff and saying: "Hey, wait! Is this really a good idea?"

- So you see you are not alone, I think, in security analysts saying: "Hey, we don't need to spend so much money on this stuff, and what we are doing isn't necessarily that useful anyway." But at the moment (maybe you're about to tell me this isn't the case) most governments don't seem to be listening.

- Most governments don't seem to be listening, and there's an important reason for that. Being tough on security is a good political position to take. So imagine after September 11th there are two politicians, one who's saying, "Everything is horrible, we're all going to die unless you do these security measures." Then there's me on the other side saying, "Don't worry, relax, it's not that bad, you don't need to." Fast-forward 10 years. If nothing happens, the guy who overreacted can claim credit for preventing an attack, and if something happens, I'm out of a job. So it makes political sense for politicians on either side of the aisle to exaggerate the threats, there is no downside.

- I've read an article, I think it was in Vanity Fair, and you had a bet with a journalist concerned (this was way back in 2001) that 10 years hence from the September 11th attacks there wouldn't be another major terrorist attack on the States. So have you got your bet?

- Well, I mean yes, obviously yes, and that was a rare position. You had people saying there's going to be a repeat within years, that the world has changed, you know, kind of crazy things.

- There have been attempts though, haven't there?

- There have been sloppy attempts. What have we had since September 11th? On airplanes we've had the Shoe Bomber who was really sort of incompetent, he was caught because he was sort of an idiot. We had the Underwear Bomber who wasn't much better. And we've had some random plots in the U.S. which don't seem to be serious at all. One of the problems I think we have is the police, the FBI in the United States…

- Was it a full member of the military, Arab member of the military, Arab American, who shot a lot of people?

- Right, that was at that Fort Hood.

- Yes, that's right.

- That was a lone gunman, I mean, not something that any security system could catch. A lone man with a gun is going to be able to damage. When you think about terrorist plots that security is going to prevent, it's a 9/11 sort of plot, it's a plot that's complicated, requires planning, and, hopefully, you are going to catch before anything happens. We've had pretty much nothing.

- In other Western nations, I mean, London had the terrible attacks of 2005. Australia almost can claim a terror attack, although I think we have to remember the majority of people who died in the Bali bombings were not Australian, they were Indonesian.

- And we can add Mumbai.

- Yes.

- We can add the attacks in Spain.

- There have been quite a lot of terrorist attacks…

- Actually, there haven't. If you look at the numbers, the peak for terrorism is the 1980s. There hasn't been a lot. You know, when we think about them and they come to mind -- and we don't remember anything of the 80s -- when you look at the numbers, the last decade has been pretty calm for terrorism. If you take out September 11th, terrorism has been declining over the past 20-30 years. The exceptions are always countries that are trying to repel an invading army: Iraq, or Palestine, Afghanistan -- and that's where you'll see terrorist attacks. But normal terrorism in peaceful Western nations is very rare these days.

- Of course, the people who put in those security measures would say, as you have already hinted: "That's because of all the measures we put in".

-- Yes, but that's not true. I remember, I think it was like 2004, United States Attorney General John Ashcroft was in my home town, he was speaking and he said something like: "There have been no attacks in the 3 years since September 11th, and that's proof that my policies are working." I'm listening to him and thinking: "There were no attacks in the 3 years before September 11th, and you didn't have any policies." Now, what does that prove? It seems that terrorism has been on the wane even before September 11th. September 11th was a singular anomaly, it was an incredible tragedy, but it's not something that was repeated. People would be saying: "We are going to see 2-3 terrorist attacks a year in the United States, it's going to look like Northern Ireland…" And we've seen nothing of the sort.

- Bruce, let's go through those checks we mentioned before, point by point, and you can explain to me, because I'm not entirely convinced that it's not because of those measures, so tell me why the measures that we put in, which the authorities would say ‘work', don't work. Let's go back, say, to the X-ray scan. Isn't that very useful?

- The X-ray scan is useful, and in the United States it's been around since the 1970s. Think of airplane security over the years, we have the X-ray scans and the magnetometers, basically we take away obvious guns and bombs. 9/11 terrorists used box cutters. Okay, we take away box cutters and knitting needles, and Richard Reid put a bomb in his shoe. We screen shoes, and then now we have the Underwear Bomber. We put in full-body scanners, and then the terrorists use liquids. We take away liquids, they're going to do something else. This is actually a stupid game, because we're focusing on the tactic, we're focusing on the target. The mistake we're making in airport security is we're focusing on what the terrorists did last time, when in fact, as you see, terrorists tend to be adaptive, they will react. The reason a lot of what we're doing is security theater, is because it doesn't focus on the real threat, it just forces the bad guy to make a minor change in their tactics or target. Now, if we spend -- and I'm making this up $20 billion a year -- on airport security, and the terrorists go bomb shopping malls, we're not any safer. What I've always proposed is we take all our money and spend it on investigation and intelligence, and emergency response -- the stuff that works regardless of a terrorist's plan.

- Just to give an example of metal detectors and knives. Now, that was in reaction toward the September 11th terrorists, that they brought knives with them and they hijacked the plane with knives. Now, in New Zealand we had, not too recently, a woman -- she wasn't a terrorist, she was probably a person who was unwell mentally, but she got onto a flight in a provincial town and there was a scuffle, and the crew and other passengers did overcome her, but a couple were pretty badly cut. So I'm sure, and this was because there was no metal detector or knife restrictions in this airport, that those people would argue, even though they managed to deal with the problem, that they probably would have rather not had to.

- Well, maybe, but do they want those metal detectors in restaurants, on the streets, on buses? I mean, a crazy woman with a knife could happen anywhere, it doesn't actually make it better. We had an instant recently in the United States where a pilot got unruly, he was mentally unstable, and he was also subdued by the passengers. The Underwear Bomber, the Shoe Bomber, they were both subdued by passengers. Being subdued by the passengers IS security. And yes, someone's going to get caught up, and that happens in a bar room fight as well. We're not going to make the world safe from pointy objects, that's not the goal of airport security. The goal of airport security is to prevent terrorism, tragedies, large-scale death, and we can do that with pre-9/11 security, with the basic metal detectors.

And there are two types of airplane terrorists. The first is the lone nut case who is going to be stopped by pretty much anything. The second is the professional plot. The professional plot is probably not going to be stopped at all, because professional plot takes airport security into account. Our best hope against that is to stop it before it gets to the airport. Now, think of the liquid bombers. They were captured in London, 2004, I think, in their apartments, and that was before the plot got to the airport. It didn't matter if they were using liquids or solids, or gases, it didn't matter if they were targeting airplanes or stadiums, or movie theaters -- they were caught and arrested, that's good security. And remember, they picked liquids because we weren't screening for them. Now that we're screening for liquids, the next group will pick something else.

- Tell me a bit more about security. If, in your opinion, what we need to do is spend more of the money we currently spend on screening at airports, on intelligence, does that mean we have to have more spooks spy on us to see which of us is a terrorist or not?

-- Now, that's not good intelligence. Good intelligence is what you see on television: following the leads, it's not a matter of spying on everybody, it's a matter of looking at the suspicious people. We're good at this, we've been doing this for years, this is not something new, it doesn't require us to screen everybody's Facebook posts or read each other's Email, it's just following the leads, and that's how we keep tabs on terrorist organizations, this is what the UK has done, Israel does this, the United States does this. All countries have terrorist organizations in them, you think of Spain, France, Japan -- this doesn't require any new police powers.

- Just looking at airplanes, what would, in your opinion, be a good security system at an airport? What should we do?

- I think we should go back to pre-9/11 security, which is metal detectors and X-ray machines screening for obvious guns and bombs. I like positive bag matching, this is something that Europe did way before the United States.

- What's that?

- That's matching the bag to the passenger. If the passenger doesn't fly, the bag doesn't fly. You put your luggage on the carousel, it disappears and shows up when you arrive, it travels in the hold of the aircraft. And in the United States now and in Europe even before, those bags were matched to the passengers, so the airline was sure that every passenger on the bag was on the airplane.

Also bag X-raying, that's something we're doing in the United States much more than we used to, so even checked luggage gets screened. That's basically it, and I think anything else is largely security theater, it doesn't make us safer.

- But isn't that important? I mean, go back to 2001, and the panic that, I think, swept across the world, and people were just afraid of flying. Don't governments realize how important that is to our economies, even if what they do is just cosmetic, to put confidence back in flying?

- How important is it? I have $10 billion a year, I can make you feel better or I can do something useful, you can choose, and we can decide as a society: we're going to waste $10 billion on a really impressive illusion. And if we want to do that let's do that, but we should have that debate. My feeling is there are probably more important problems to solve. And sure, restoring confidence is important, but doing that directly would be cheaper. We don't have infinite resources, we've got a lot of serious problems in society, we kind of need to pick and choose.

- What are the downsides? Because we haven't really talked about that, we have talked about the cost of these things. Are there any other costs that cannot be measured by how much it costs to run the TSA?

- Well, there's a lot. I wrote about this in the United States and I can talk about the American experience. In the United States we've actually increased the number of deaths on the road, because people don't want to fly, so it's about 300-500 excess deaths per year, and that can be measured, so we know the numbers. It's probably different in different countries, but in the United States people not flying has resulted in deaths. There's the indignity of being searched, a lot of the enhanced screening, we haven't really talked about enhanced screenings, in the United States we're seeing a lot more invasive patdowns in some cases. There are abuse survivors who are unable to fly.

- Can you tell me a little bit about the No-Fly List? How does that work?

- We don't know how it works, and this is very antidemocratic, and it's going to sound almost totalitarian. You expect something like this in East Germany or in the Soviet Union. There's a secret list of people who are not allowed to fly, who are so dangerous that they are not allowed to fly.

- Do they know they're on that list?

- No. And yet, they are so innocent they cannot be arrested. No one knows how you get on the list, you're never told you're on the list, you're unable to take yourself off the list, to find out the reasons why you're on the list -- it's Kafkaesque. We don't know how many people are on the list, we hear numbers like 100,000 or 20,000, there are different lists, we're not sure exactly where they come from or how they are managed, we don't know if anyone's ever gotten off the list. There are ways, and it used to be that if your name was the same as someone on the list, you also couldn't fly. This was a disaster, because there were some common names on the list, I think there was a Bob Nelson on the list, and there are a lot of Bob Nelsons in the United States.

- Paul Jones could be a problem.

- Right. Now there is a redress system. You can get some kind of document from the government, the U.S. government that says, "I'm the same name, but I'm not the guy you're looking for".

- Does the TSA run that? That list, the dangerous flier list.

- I don't know, I don't think so. We think the list comes from the FBI and other organizations, the TSA manages how that list is used at airports.

- What about the Trusted Travelers scheme?

- Trusted Traveler is a different list, and I believe the TSA does manage this, and this is a list of people who have put themselves through background checks and have been deemed to be more trusted.

- It does sound to me like that's a great target for terrorists to work on: "Just get ourselves on that!"

- And I've argued that's why the list is a bad idea. Whenever you make an easy way and a hard way through security, you invite the bad guys to take the easy way, I call the Trusted Traveler list a simple way for the terrorists to know if the government is onto them or not.

- If this is such a cost, and you've mentioned all those other things quite apart from the cost of running a bureaucracy, then why aren't the airlines lobbying more because this is getting in the way of their business? Why aren't they saying to the government: "Stop all this! We don't need this!"

- You know, the airlines have a very love-hate relationship with security, they have fought security measures in the United states for decades. Reinforcing the cockpit door, which is something that was suggested in the 70s, the airlines fought successfully until 2001 when they did that.

- Now that's standard on planes?

- Now that's standard on planes.

- It's not a bad idea.

- Oh, it's a great idea! It's easy, it's cheap, it doesn't affect civil liberties, I'm really happy about it.

The one measure the airlines liked is the photo ID check, because what it did is it solved an airline problem: it stopped the resale of tickets. I remember when I was a kid I would see ads in a newspaper for a round-trip ticket from here to there for a female, because the ticket was in some female name. And you'd buy those tickets on the secondary market, the airlines never liked that, but they couldn't do anything about it. Now with the photo ID check they could at least stop that. But in general the airlines like it when security isn't their fault. They want to blame the government for all these measures, and then they stand back and say: "It's not us, it's the government". I think right now, if they lobby against security, they will be looked at unfavorably by the press, by the government. And remember the political difficulty of being against these security measures: if you're wrong, your career is over.

- Now, Bruce, you've just pointed something out and I was going to go back to that, which is, politically this is a good thing to do, generally it's good for governments: if they want votes, do this, say we are going to beef up security. So not only are you struggling to convince governments to stop doing this on airlines, but ordinary Americans don't seem to want their reduced security either?

-- Well, a lot do. It's really changed in the past decade. After September 11th people were scared and willing to do anything. We're seeing more people say: "No, we don't need this". I'm seeing more newspaper editorials, I'm seeing more commentators, and we're seeing a lot of TSA abuses with these enhanced screenings. In the newspaper in the past couple of weeks or so, there was a story about a four-year-old being screened and she was hysterical, because basically a strange man was touching her, this is very much like child abuse. We're seeing grandmothers, there was a war veteran who had $300 in cash stolen from him by the TSA, he was forced to put it in a bin, and when he went back to it, it wasn't there. We're seeing a lot more people saying this is too much. "The Economist" magazine had a debate online which basically said: "Is airport security worth it?" I wouldn't imagine that happening even 5 years ago. We're seeing a backlash.

- I know lots of people, and I'm probably one of them, who think: "Why did we have to go through that?" But then I was thinking about this, and I thought, well, when Obama tried to bring in, partially successfully, the health care plan, there was tremendous opposition to that in the United States, and a lot of it was built around "We don't want to lose freedom, we want to choose for ourselves". And I'm wondering, why is it that people don't rise up in the same way about airlines, which is something that maybe happens to them much more often in the airline security?

- Maybe that whole choose-freedom thing was back then kind of bogus, that was other Republicans not wanting to do anything that Obama liked. Obama's health care program was a Republican plan that the Republicans turned against. Be careful with the United States' rhetoric, it's a pretty dysfunctional political system right now.

- I'm just wondering why something which a lot more people probably experience tension with doesn't strike the same chord.

- Well, a lot of people don't fly, first of all, so might not realize it. And I think in many cases it does, that the revolt against the full body scanners was pretty impressive, and there are a lot of people who said NO. In the end, people want to fly. The problem with protesting is the people who are doing this to you are the wrong people to protest. When you're going to the airports in the United States you're very much in a constitution-free zone. You know that the people there can do whatever they want, you have no say, you're afraid if you complain you'll get put on a list, they'll call the police, they'll ruin your day, and you're just trying to get home to see your parents.

- And you can't make any jokes.

- You can't make any jokes, right.

- That's how one friend of mine got in trouble.

- Ha-ha! I don't think I want to know the story, there're some pretty bad stories, but yes, it's a joke-free zone. And people have been denied boarding because they had a picture of a gun on their T-shirt. There was someone who had a plastic lightsaber confiscated -- not only is it a plastic weapon, it's a fake weapon; stuff that makes no sense.

- Was it sharp in any way?

- No, it was a flashlight with a plastic tube at the end, but it was confiscated, because in some movie universe it's dangerous if you're a Jedi.

- I hope it was a kid.

- It was a kid, which makes it even worse! The abuses are almost silly when you run through them. We have problems that the former head of the Homeland Security Department lobbies for one of the full body scanner machine companies. And there's all sorts of things going on.

- Is there a culture of giving up your freedom though when you fly, maybe because people think now the war zone with terrorism is the airplane, for whatever reason? And in war time people will give up all sorts of things. Do you think that people subconsciously think there is a war going on, this war on terror, and, well, I don't like this, but there's this whole ‘mustn't grumble' thing…

- Certainly that was true in the Bush years, I mean Bush very much pushed the war metaphor, that we're at war with terrorism. And of course you're right: when you are at war, the normal rules of liberty and freedom, and privacy, and civil rights don't apply; everything goes out the window, it's a different game. Obama has not done that as much. I still think there's some of that. But more people are returning to normal, so we're seeing more arguments about whether it's worth it. The real debate should be: are these measures worth it? I mean, yes, they might make you safer, but, you know, so will locking yourself in your house and never leaving. The question is: is it worth it? Is the increased safety worth the cost? Life itself is risk, and that's not bad, absolute safety is impossible, and that's okay.

The question is: what should we do, and what's too much to do?

- Are you interested simply in what's happening in the air space of the United States, or security right across American lives?

- I look at security everywhere, a lot of what I work on is Internet security , and Internet banking , and our privacy and medical security -- everything going on there. I'm here, in New Zealand, for an identity conference, which is going to look at identity and privacy, and security. I look at voting machines and ID cards, I know there's a debate in New Zealand right now about ID cards. I really look at the whole gambit of security, and how people and technology interact.

- What's the response that you've had, then, to terrorists, especially since September 11th? How do you cope with any sense of danger? How do you think most people should cope if we're not going to spend all this money on things? Now, you did point out that every time we've come across something, then the terrorists go to next thing, but nevertheless when security's found a gap -- they've plugged it. Once you know something's there, you have a moral responsibility, one argument is to do something about it. What's the alternative approach?

- Actually, you kind of don't. I mean, I can let you know right now that you're not wearing a bullet-proof vest, and someone with a gun can shoot you. There has probably been a murder in New Zealand sometime in the last few months, so we know it's true. Does that mean everyone should go buy bullet-proof vests? It doesn't. You don't have to plug every hole, the question is: is it worth it? Is the cost worth the benefit?

- Do you fight terror by refusing to be terrorized?

-- That's my phrase, I think we fight terror by being indomitable. I mean, terrorism, if you think about it, is not a crime against airplanes, or property, or even human lives; terrorism is a crime against the mind. Terrorism's goal is to cause terror, it does that through wanting destruction of life and property. But it does that to achieve a goal, which is to terrify people. If we refuse to be terrorized, then the terrorists can't win regardless of what they do. If we are terrorized, even if there's nothing, the terrorists win even if they don't do anything. Do you remember the BOB scare? It happened in Australia, I can't remember the year. But there was an airplane, and someone found on one of those plastic air sickness bags the letters "BOB", and for some reason the flight attendant decided that this meant "Bomb On Board", and then the plane made an emergency landing. The terrorist didn't even have to be there, and he caused terror. That's us being crazy.

- I think, I strongly relate to what you're saying, but there's one nagging doubt, and that is, I have not lost anyone, friend or family, anyone close to me in a terror attack. Could you say the same thing if you had? Have you lost friends?

- I have not, but remember, there's a long tradition in our society that victims and victims' families are not in charge of punishment. You can say this about criminal justice, there's a murderer on trial, and has the judge lost anyone to murder? Why isn't the victim's family up there judging the murderer? That's not the way our society works. If you lost someone, you lost a loved one, you have a much more emotional reaction to this. But what we want is not an emotional reaction, we want a calm, logical, sensible reaction. Is it worth it? And of course, if you're a victim, you're going to have a different perception of that.

But the right one is the one that's more detached.

- Will there be more terror attacks on your country?

- Yes, of course. Terrorism will never go away, the history of terrorism stretches back to Ancient Egypt. As long as there are people there will be crime, there will be accidents, there will be terrorism, there will be psychopaths -- these are natural human things. The question is: will they be an existential threat? Will they destroy our way of life? And the answer to all of those is -- of course not. And the goal of security is to keep the rate of all these things to some acceptable minimum. The murder rate in the United States isn't zero, it's not zero in New Zealand; we have 42,000 people die each year in our country in automobile crashes -- an enormous number! And society has some natural risk tolerance: you know, the murder rate gets too high, we all start saying: "Hey, we need more police". If the murder rate gets too low, people start saying, "Why are we spending so much money on police, when we have other problems that need solving?" We as society have a natural barometer, and we pick the level. And these things will always exist, humans are never perfect, never always law-abiding, but that's okay.

- It does seem though the barometer in some cases, and terrorism is one of them, has kind of got out of whack.

- That's because we're scared. When people are scared, they'll do anything not to be scared anymore. And unfortunately, national policy built around fear tends to make less sense. It's only with the distance that history brings that you can really look at what happened and decide what is a reasonably measured reaction.

- Bruce, thanks very much for joining us!

- Thank you!

earlier story: Trust: Ill-Advised in a Digital Age
later story: RSA London 2012: Governments Will Fail in Bid to Control Internet, claims Bruce Schneier
back to News and Interviews

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..