Q&A with Bruce Schneier
Expert says security benefits must be weighed against tradeoffs
Q: When a company or government entity has a security proposal, how should they evaluate that? What sort of principles should they be looking for to determine whether this is going to be an effective security solution?
A: First, you have to understand that security is a tradeoff. Whether you give money, or time, or convenience, or civil liberties, or American servicemen’s lives, you give something and you get some security in return. There’s no such thing as absolute security: It’s a continuum and it’s a tradeoff.
The next question to ask is, is it worth it? You have to go through a security tradeoff, tease out what the risks are, how good the countermeasures are, what the costs are, and then decide “Is it worth it?”
Pulling it apart can take an emotional debate and make it more rational because it forces you to stop and think and not just jump to a conclusion because you know it’s right, but figure out why it might be right.
Q: A lot of security proposals make a tradeoff between security and privacy. Is it worth it?
A: If security and privacy were opposites, we would have all run to the former East Germany because it was such a secure place to live. It doesn’t work that way. The real debate is liberty vs. control. When people are afraid, they just want to feel better, and measures that don’t do any good but make you feel better, people are going to support.
Q: That’s “security theater,” your term for things that make us feel secure, but not actually secure. Are there times when security theater works?
A: Yes. After Sept. 11, if you flew, the National Guard troops were at the airport with uniforms and big-looking guns. Those guns had no bullets, which was probably for the best. A little bit of security theater helped people fly.
Q: Is that the primary thing that we need to overcome and cope with, our personal fear?
A: I think there’s a lot of fear from Sept. 11 that turned into a lot of bad policy. We undid 30 years of protections against government abuse for some misguided efforts to protect us from terrorists. Terrorists are extremely rare. Where is a credible terrorist? We have not caught one. So either we’re completely incompetent, which I don’t think is true, or they’re just not out there, which I think is much more realistic.
Q: Some argue that the terrorists only have to be right once, but we have to be right 100 percent of the time.
A: “We have to be right all the time” is fearmongering. If you need to be right every time, you live in a police state, you have no freedoms and no liberties, and you don’t want to live there.
Q: So the risk of terrorism you see is being vastly overblown?
A: It is overblown.
Q: Even if we had a Sept. 11 every five years?
A: Let’s do the numbers. In 2001, the big year for terrorism, 40,000 people died in car crashes, 3,000 in terrorism attacks. So even if we had a Sept. 11 every month, we still wouldn’t get to car crashes. … We certainly should spend money on security against terrorism, but it doesn’t mean dismantling everything that makes your society great.
Q: How would you rate airport security in the United States?
A: There were two, maybe three things that improved airport security since Sept. 11. The first one is reinforce the cockpit door. The second one is condition passengers to fight back. The third one, maybe, is sky marshals. Everything else is security theater. … It’s this silly game of defending against what the terrorists did last week. Take away guns and bombs, so they use box cutters. You confiscate box cutters and corkscrews, so they put explosives in their shoes. We screen shoes; they use liquids. We take away liquids; they’re going to do something else. This is a stupid game.
Categories: Text, Written Interviews