Everything We Know About Security Is Wrong

So says counterterrorism contrarian Bruce Schneier. And the transportation security administration is listening.

J.P. Vossen, a senior engineer at Counterpane, was inspired to join the company after hearing Schneier speak at a computer security conference. "He can explain some counterintuitive stuff very clearly," Vossen says. "I like Bruce's approach. That's the largest reason I'm working here."

In the years that followed, Counterpane grew to a 115-employee firm worth tens of millions of dollars.

This is where Schneier may have lived happily ever after, as a successful businessman and computer security geek extraordinaire. But then came the events of September 11, and what Schneier calls the "silly security season."

SCHNEIER'S HOUSE, WHICH has no more security than the locks on the doors, is a handsome stone structure on a leafy street across from Minnehaha Creek. Along with his wife, Karen Cooper, Schneier has lived here for the past 11 years. Most of the downstairs is one large open space, with no walls separating the living room, dining area, and sunroom, the last of which serves as Schneier's office.

Sitting near a window facing the creek on a recent afternoon, Schneier's blue eyes opened wide and his voice rose as he explained his frustration with how the media covers would-be terrorists. "We're just getting scared over idiots, like the London bombers," he argued, referring to the clique of foreign-born medical personnel in Britain who tried to set off three car bombs. "Nothing would have exploded in those cars. You would have had a bunch of hot nails."

Then there was the group of men who planned to blow up Kennedy airport in New York. "You ever been to Kennedy airport?" Schneier asked. "It's acres wide. You can't blow up Kennedy airport. And they had a stupid plan that wouldn't have worked. But we get all panicky. We end up saying, 'Oh God! These people are going to blow up Kennedy airport!'"

Such fears are examples of what Schneier calls "movie-plot threats"—grandiose scenarios that capture the imagination but are highly unlikely to succeed. "They're good for scaring people, but it's just silly to build national security policy around them," Schneier says.

On his blog last year, Schneier took issue with the idea that terrorists might target school buses. To protect against this dreamed-up threat, the Department of Homeland Security started training school bus drivers to be on the lookout for hijackers. In addition to being a waste of resources, Schneier pointed out, the measure may have actually put kids at greater risk, because bus drivers distracted by phantom terrorists could be more vulnerable to the much more realistic danger of oncoming traffic.

For an example of how to spend money appropriately, Schneier says one need look no further than the I-35W bridge collapse. By investing federal Homeland Security money in communications equipment and a disaster preparedness plan—a response mechanism useful in any type of attack or catastrophe—local and state authorities were able to coordinate their efforts and, in all likelihood, save lives.

"If they'd have put all that money into protecting the Foshay Tower, it would have been a complete waste," Schneier says.

IN JANUARY, SCHNEIER visited his newly born godson, Nicholas Quillen Perry, at Abbott Northwestern hospital in Minneapolis. As he looked at the snoozing infants in the maternity ward, he noticed that each one had an electronic bracelet around its ankle, which would trigger an alarm if the newborn were taken out of the ward.

Sizing up this anti-infant-abduction measure, Schneier was initially struck by the stupidity of it. Hospital baby snatchings, after all, are extremely rare. Since 1983, there have been fewer than 250 reported cases in the United States, out of more than 80 million babies born in that time. In other words, the chance of a baby being abducted from a hospital is less than three in a million.

But as Schneier watched the babies being removed from their cribs for one test or another, he began to wonder if this blatant display of security theater was such a bad thing after all. Parents of newborns are in a highly anxious state, prone to feeling less secure than they really are. Electronic bracelets, while not providing much actual security, can do wonders for the emotional well-being of the frazzled parents.

Which has led to Schneier's most recent revelation: Security theater can actually be a good thing when it brings our feelings of safety into line with the actual threat.

Take the tamper-evident seals on over-the-counter medicine. In 1982, seven people in the Chicago area died after someone slipped cyanide into packages of Extra Strength Tylenol. Responding to widespread fears, manufacturers introduced tamper-evident seals. Although these were security theater—they don't protect against syringes, for instance—the sense of safety they brought made the public's comfort level come back in line with the actual threat, which was, statistically speaking, quite minimal.

Sitting at a coffee shop around the corner from his house, Schneier considered the implications of his turnabout. Here he was, having spent years deriding security theater in all its manifestations, now saying that, in some cases, it's actually a good thing.

Did that mean he owed TSA chief Kip Hawley an apology?

« Previous Page
Next Page »