Security Executive Stresses Trade-Offs
It’s a gutsy way to start a book on security. In “Beyond Fear,” published this month by Copernicus Books, Bruce Schneier asks us to set aside our revulsion and horror to grasp what the 9-11 terrorists accomplished. What they did, he says, was efficient, audacious, well-planned, simple and, from their view, successful. This understanding is key to moving beyond fear and improving security, says Schneier, who created some well-known encryption algorithms—formulas used to scramble and unscramble computer data. He’s also founder and chief technology officer of Cupertino, Calif.-based computer security monitoring company Counterpane Internet Security Inc. The privately held company has attracted more than $50 million from some big-name venture funds. To improve security, we must demystify it and consider the trade-offs, he says. He hates the idea of national ID cards, opposes use of computerized voting machines and abhors the notion of arming commercial airline pilots. He recently spoke with IBD about security.
IBD: Has the U.S. accomplished much in the two years since 9-11?
Schneier: We haven’t gotten very far. We had an enormous amount of international good will after 9-11, but we’ve squandered it. We’ve managed to increase animosity around the world, certainly among those who might do us harm. We’ve managed, unfortunately, to create a lot of potential terrorists. We also have done a lot of good in rolling up terrorist networks. We’re arrested leaders, disrupted terrorist training, funding and movement. But we’ve done a lot of things that have really affected civil liberties, with a minimum effect on terrorism. That’s a theme of the book, there’s always trade-offs. The notion of broad surveillance of everybody, (Attorney General John) Ashcroft’s TIA (total information awareness) plan, doesn’t work very well.
IBD: Using biometrics such as facial and fingerprint scans for security also is a hot subject, but you’re against wide use of such technology for things like national ID cards or Tampa, Fla.’s test of facial recognition software using secret cameras in a city entertainment district.
Schneier: Tampa just dropped that program. In two years, the system didn’t result in the capture of a single criminal. These systems don’t work primarily because of the notion of false positives. In any security system where attack events are very rare, false positives overwhelm real attacks. If you’re a security guard using a facial recognition system that’s flagged 1,000 people and been wrong every time, what are you going to do? You’re going to stop paying attention to it. You’ll think: This is stupid.
IBD: Is there a lot of stupid security?
Schneier: We always hide the failures. When the airline security people confiscate a pocket knife from grandma, that is a security failure. It’s not a success, because grandma’s innocent. The system incorrectly fingered an innocent. Airline security fails an absurd number of times a day.
IBD: Are there technology answers to improving airport safety?
Schneier: Generally, what improves security anywhere is the human brain. There are only two measures we’ve taken that have improved airline security since 9-11. One is reinforcing cockpit doors. The other is teaching passengers to fight back. And those two measures, like all the best security measures, have no effect on civil liberties. The rest is what I call security theater—which is somewhat valid and important. It makes people feel better. But it’s not security, it’s marketing.
IBD: Well, are there any civil liberties we should give up to improve security?
Schneier: That’s a personal question. In New York City, I had relatives that lived in a gated community. They gave up some freedom of movement for increased security. There may be people who say they liked living in East Germany, that they felt safer there. When talking trade-offs, measures that take away civil liberties aren’t very effective. As trade-offs go, that’s not a good one. You never argue security in terms of whether it’s effective. You always argue in terms of trade-offs.
IBD: What’s wrong with national ID cards?
Schneier: For one, it’s an enormous expense. We’re talking billions when you consider the whole infrastructure you need to create and the ongoing maintenance. Then you have to look at what you got for your $20 billion. What is the problem I’m going to solve with national ID cards?
IBD: What is the problem it’s trying to solve?
Schneier: I’m not sure. It’s not identity, because a driver’s license solves that problem. The 9-11 terrorists had driver’s licenses. Knowing who they were didn’t help. Civil liberties aside, it’s not worth it.
IBD: What’s wrong with computerized voting?
Schneier: There’s lots of potential for fraud. We’ve seen elections stolen already, on a small scale. You can’t trust the technology. Maybe in 30, 50 years.
IBD: Are computer viruses becoming a bigger problem?
Schneier: No, but it’s not becoming smaller, either. It will get worse before it gets better. One main reason is that the companies responsible aren’t liable. Microsoft produces lousy software. It wants us all to think that viruses just happen, like the weather. Microsoft and other software companies now have no business incentive to fix this situation. What if (Microsoft Chairman Bill) Gates said the company is going to take two years to really improve security, but in the meantime earnings will fall 50%. The board would fire him. I have faith in the American capitalistic system. Provide the correct business incentives, and we’re creative and smart enough to fix the virus problem.
IBD: What’s the main message of “Beyond Fear”?
Schneier: Relax, don’t panic. Otherwise, you make mistakes. The Patriot Act was done in a panic, and it’s a lousy law. Think rationally about the trade-offs.
Categories: Text, Written Interviews