False Sense of Security

According to the dictionary, a false sense of security is a feeling of being safer than one really is. Apparently that's a bad thing.

Peter Sandman is a strong believer in what he calls precaution advocacy - to arouse some healthy outrage and use it to mobilize people to take precautions or demand precautions. He has helped environmental groups arouse public concern about the need for recycling, the dangers of factory emissions, etc. In such contexts, his concern is that people are disregarding or underestimating some category of risk, and he is urging the introduction of appropriate precautions - whether individual or collective.

There are countless risk and security experts who take a similar position - for example, advocating greater diligence in corporate security, especially cybersecurity.

However, as Dr Sandman acknowledges, the notion of a false sense of security is often used rhetorically, suggesting that a given regulation or other precaution is not only unnecessary but even counter-productive, making people careless or complacent. This argument is sometimes based on the notion of risk homeostasis or risk compensation - that people adjust their behaviour to maintain a comfortable level of risk. The classic example is people with seatbelts and airbags driving faster and more recklessly.

Dr Sandman notes that the rhetoric can sometimes be deployed by both sides of an argument - for example "gun controls create a false sense of security" versus "guns create a false sense of security". What this suggests is that the rhetoric is often about other people - the implication is that We have a true sense of security, but They would be misled.

The notion of a false sense of security also arises in connection with security theatre - a performance that may have little real impact on security, but is intended to reassure people that Something Is Being Done. When Bruce Schneier introduced this term in his 2003 book, he regarded security theatre as fraudulent, and believed it was always a Bad Thing. However, he later came to acknowledge that security theatre, while still deceptive and potentially problematic, could sometimes be valuable. His example is security bracelets on newborn babies, which don't do much to protect against the actual but extremely small risk of abduction, but do a great deal to calm anxious parents. If Dr Sandman's precaution advocacy is targetted at situations of High Hazard, Low Outrage (in other words, people not worrying enough), then Security Theatre could be legitimately targetted at situations of Low Hazard, High Outrage (people worrying too much).

So perhaps sometimes giving people a false sense of security is ethically justified?

---

Peter Glaskowsky, Bruce Schneier's New View on Security Theater (CNET, 9 April 2008)

Peter Sandman, False Sense of Security (25 May 2018), Precaution Advocacy (undated)

Bruce Schneier, Beyond Fear (2003), In Praise of Security Theatre (Wired, 25 January 2007)

Gerald Wilde, Risk homeostasis theory: an overview (Injury Prevention Vol 4 No 2, 1998)

Wikipedia: Risk Compensation, Security Theatre

Related posts: Surveillance and its Effects (May 2005), Technical Security and Context (September 2005), Hard Cases Make Bad Law (September 2009), The Illusion of Architecture (September 2012), Anxiety as a Cost (January 2013), Listening for Trouble (June 2019), Lie Detectors at Airports (April 2022)


Updated 28 June 2019. Thanks to Peter Sandman for comments.

Back Door Steps

Theresa May used to be rather keen on back doors. As Home Secretary until her move to Downing Street, she was responsible for the Investigatory Powers Bill, which insisted on back doors to enable the security forces to snoop on private communications. Now she insists that Britain will not remain in Europe by the back door. So what's wrong with back doors all of a sudden?

Now you might think I'm just making a snarky political point. Obviously the back door metaphor has a different meaning in the two contexts. But there is an important connection here, so please bear with me.

The European Data Protection Supervisor is dead against encryption back doors. By mandating encryption back doors, the UK therefore appears to place itself outside the European circle of trust. The proposed legislation would mean that any UK company or UK-based facility might be subject to an equipment interference warrant (aka back door), and would not be permitted to reveal whether it did or not. Aside from the competitive disadvantage that might follow from this potential vulnerability, UK companies and UK-based services would be challenged to demonstrate compliance with the European Data Protection Regulation, and might therefore be prevented from holding data on any European citizen. There is going to be a single market for data, and we wouldn't have access to it. Another blow for the UK service industry.

So evidently Mrs May is right. Backdoor membership of the EU is not on the table.

---

Anushka Asthana, No staying in the EU by the back door, says Theresa May (Guardian, 31 August 2016)

Jennifer Baker, Encryption backdoors appear on EU data chief’s ban wishlist (Ars Technica, 25 July 2016)

Lucy Mair, Supreme court strikes down Home Office's back-door changes to immigration rules (Guardian, 18 July 2012)

John Naughton, Theresa May’s surveillance plans should worry us all (Guardian, 12 June 2016)

Iain Thomson, FBI Director wants 'adult conversation' about backdooring encryption (The Register, 31 August 2016)

@TheRegister backdoors are like hookers they do what you pay them for but never have them exclusively!

— Frank Koster (@bluegoaindian) September 2, 2016

Purpose of Counter-Terrorism 2

Commonly described as heir to various great American and European writers (Joyce, Pynchon, DeLillo), and compared with writers from Gerald Manley Hopkins to Dostoevsky, David Foster Wallace died earlier this month, apparently at his own hand. By chance, I had just bought a book of his essays, and I was looking forward to reading his review of Tracy Austin's "autobiography", and his report on McCain's 2000 campaign. [See my post US Election 2008: Sincerity versus Authenticity]

Last year Wallace wrote a short polemic in the Atlantic about terrorism and counter-terrorism, called Just Asking, in which he suggested the following thought-experiment: that instead of reducing American liberty for the sake of security against terrorism, America could decide to keep its liberties and accept a certain level of terrorism. The victims of these acts would be democratic martyrs, sacrificial witnesses to the eternal values of American liberty.

Is this a monstrous idea, he asks? Then why do we not also regard it as monstrous to sacrifice 40,000 Americans every year to the liberties of the motor car?

Two hundred years ago, Benjamin Franklin warned of the false trade-off between safety and liberty. Now it seems to be impossible to have a serious political debate about this, either in America or in Europe. We apparently have no choice - the decisions are made on our behalf by elected politicians - or worse, by stupid functionaries.

And Wallace ends with two rhetorical questions: "Have we actually become so selfish and scared that we don’t even want to consider whether some things trump safety? What kind of future does that augur?"

Travel Hopefully

The quaint licensing laws of the United Kingdom used to contain the notion of the "bona fide traveller". At certain times and places (Sundays? Scotland and Wales?) inns were not permitted to serve alcohol to local customers, but could only serve genuine tourists, people who travelled "in good faith".

In some parts of the country, people would go on Sunday coach trips to the next town, where they could drink as travellers. This was certainly against the spirit and letter of the law - they were travelling in order to drink, not travelling "in good faith" - but they usually got away with it.

I remember hearing the great war correspondent James Cameron tell a stirring tale of having battled his way back to Scotland across several continents, perhaps from some remote corner of the Korean or Vietnam War, only to be denied a drink in the pub nearest his home because as a local he didn't count as a "bona fide traveller".

Today, in the photogenic but dysfunctional Terminal Five building at Heathrow Airport, the airport authority hoped to verify travellers' bona fides by taking fingerprints. Are you permitted to buy cheap gin? Are you permitted to get on this charabanc to Rhyl, with or without baggage?

Biometrics and identity cards can maybe tell the authorities who you are and where you live, but they are not enough to reveal your intentions, your bona fides. Did you pack this bag yourself? Has a mysterious stranger given you anything to carry? Are you conspiring to overthrow, put down, or to destroy any government by force? (tick YES or NO)

BAA claims that fingerprints are required to prevent terrorists from stealing into the UK, but of course what they really mean is "known" terrorists - people whose names and fingerprints are already on the blacklist, or people who are already "wanted" in other countries. Maybe we need some more technology - perhaps lie detectors, or the "tunnel of truth".

Meanwhile, there are suspicions in some quarters that the physical layout and passenger processing are principally designed not to promote the security of the country and its transport operations, but to promote the commercial profitability of the airport and its retail operations. Fingerprints overruled by the Information Commissioner, they are going to take photographs instead. Oh well, so that's all right then. Rhyl, here I come.

See also: Heathrow Terminal Five, Actually You Can't Fly Either

Shoes and the Devil

When Bruce Schneier passes through Heathrow, he skips the security queues by going through the fast track lane. So he has nothing much to lose by revealing a vulnerability in the arrangements for checking shoes safety - Defeating the Shoe Scanning Machine at Heathrow.

But many of his readers travel in economy class. They are hoping that the authorities do not make the shoe-testing more onerous than it already is.

Before publishing vulnerabilities, one need to judge the likely outcomes. Perhaps some people think it would be a good thing if air travellers are subjected to further stupid harassment (and risk of foot infection) at Heathrow, because this would reduce the quantity of pointless tourism and even more pointless business meetings.

But the people who would suffer the worst from a further tightening of shoe-related security would be fashion shoe designers, with carry-on bags stuffed with thousands of pounds worth of glamorous stilettos and supercool trainers. Perhaps Schneier should publish that vulnerability as well, drive shoe design underground, and force fashion victims to wear sensible shoes instead!

There are many strange beliefs and customs associated with shoes, some even stranger than the superstitious security checks currently practised at airports around the world. Not far from Heathrow is St Dunstan's Church in Cranford Park. It was St Dunstan who, according to legend, once nailed a pair of horseshoes to the Devil's feet, and this is thought to explain the use of the horseshoe as a good luck charm.

Modern technology has taken the horseshoe magnet and produced an electromagnetic equivalent. Before we can be permitted to board an aeroplane, our possessions must be purified by contact with magnets, so that we can be sure they are safe of the influence of the devil. (Magnets were first described in an ancient Chinese text called The Book of the Devil Valley Master.)

Makes about as much sense as the normal explanation.

Wikipedia: Horseshoe, St Dunstan
Link: St Dunstan's, Cranford Park

Easy Pickings?

Bruce Schneier picks up a story about the police putting warning stickers on vehicles with tempting parcels for the casual thief. [Conyers Police Department warns shoppers to protect valuables in cars, Rockdale Citizen, Friday, December 07, 2007] Bruce thinks the police are just helping the thieves.

In London, the Metropolitan Police put up notices, apparently addressing car thieves, advertising "Free Satnav in this area". Presumably the intended effect is to remind car owners not to leave their satnav in the car.

In contrast, in the city of Leicester, the police have resorted to handing out free cloths, to wipe the satnav marks from the windscreen. [Source: Leicester Police website] This appears to have exactly the same intended effect - to remind car owners about the vulnerability.

Obviously there is a risk that these warnings may sometimes trigger crime rather than help prevent it. But the principle of publishing vulnerabilities is based on the assumption that this information helps law-abiding people to defend themselves from attack more than it helps the attackers. (There are lots of comments in Bruce's blog discussing whether the same principles apply here as to software vulnerabilities.)

Even if these measures resulted in a short-term increase in the levels of crime, they might seem justified if the longer-term effect was to teach car-owners better security habits.

Security Theatre

Steve Swain, formerly with the Metropolitan Police and now a consultant with Control Risks, questions the belief that security cameras prevent crime or terrorism.

"I don't know of a single incident where CCTV has actually been used to spot, apprehend or detain offenders in the act. ... The presence of CCTV is irrelevant for those who want to sacrifice their lives to carry out a terrorist act." [CNN August 3rd, 2007, via Bruce Schneier]

Swain has also written an article in the latest issue of his company's newsletter challenging the fantasy of technology.

"In today's threat environment, technology for law enforcement agencies is seen as the answer to all our prayers; all seeing, infallible, indefatigable. If only." [Perspective, July 2007, pdf]

Meanwhile, the City of New York is planning to spend $90m million (annual running costs $8 million) on a network of security cameras, code-named "Ring of Steel". New York Police Commissioner Ray Kelly seems unconcerned that there is no positive evidence of any deterrent effect.

"We don't know acts that may have been planned that -- because of the surveillance and deterrence systems that are in place -- did not go forward." [CNN August 3rd, 2007]

Seems a remarkably thin justification for spending public money. So if security cameras don't actually prevent crime and terrorism, what is their real purpose? Swain suggests two answers: investigation and public reassurance.

"You need to do this piece of theater so that if the terrorists are looking at you, they can see that you've got some measures in place."

Oh, right. Chief Wiggum rules okay.

Wikipedia: Clancy Wiggum
See also: The ineffectiveness of security cameras

Pork Scratchings

Over the past five years, US states with Republican congressmen have got more security money than states with Democratic congressmen. Bruce Schneier, in a post called The Square Root of Terrorist Intent, refers to this phenomenon as "pork".

On the POSIWID blog, we like to dig through the undergrowth of politics to find the truffles of causality. Why do some states get more money than others? Is it because the Republican congressmen have been more effective than the Democratic congressmen at getting their snouts in the trough? Or is it because states with Republican congressmen are inherently more vulnerable?

By choosing to elect more Democrats in the recent elections, the American people evidently lean towards the second explanation.

In the same post, Schneier goes on to discuss a formula that is used to allocate security funds in the USA, which includes taking the square root of some measure of terrorist intent. (The formula is also discussed by Eileen Sullivan on CQ.com: The Root of All Terror, with lots of sarcastic comments on Wired Blogs.)

Although I haven't seen the formula myself, I can't see any problem with square roots as such. Square roots are used in many good formulas, and its presence in this particular formula makes it apparent that this is an attempt to perform a proper calculation rather than the usual vague waffle. Which perhaps explains why some people are resisting or mocking the square root - because they are uncomfortable with the idea that such things might be subject to calculation at all. Without the square root, they might well have ignored the whole thing.

Can we not measure intent? Surely that's what marketing departments do - measure and manipulate the intent of customers and prospective customers. We can also measure attention, and there is a strong link (although it clearly requires some interpretation and analysis) between intention and attention. Modern ("asymmetric") warfare is largely about altering the intentions of the enemy - which makes it effectively a branch of marketing.

By declaring some national assets for special attention (Old MacDonald’s Heavy Petting Zoo, Clinton's Apple and Pork Festival), this presumably alters the intentions of the enemy. Can pork-barrel politics keep up with a constantly shifting threat? Can pigs fly?

---

Meanwhile, another use of square roots in a security formula is explained in Can Statistics Help Catch Terrorists (BBC News, 11 Jan 2010)

Pact with the Devil

Is the University of Cambridge Computing Laboratory superstitious? Report number 666 (on computer malware) was published on 6/6/6 and is entitled Pact with the Devil [abstract, pdf, announcement]. 

This was clearly contrived. The Laboratory normally publishes a couple of reports every month. Report number 665 was published in April 2006, and then several reports were apparently held back so that the malware report could be assigned an auspicious number and date.

(Three further reports were published immediately after the malware report. Perhaps the numbers and dates are assigned by some bureaucratic computer system; but we may presume that the computer scientists at Cambridge would know how to cheat the system if they had chosen to do so. Perhaps it matters to some people whether this really was the 666th report, and not the 669th report with the code numbers swapped.) 

Superstition is an interesting phenomenon. The computer scientists can claim an interesting defence: they are not irrational themselves, merely exploiting the irrationality of other people. Contriving an auspicious number is a trick to get themselves some publicity for the report. (Hey, it's got me to post a blog about it, and I'm not admitting to being superstitious either.)

---

The report itself talks about malware that coopts users to help with propagation - exploiting their greed, malice and short-sightedness. 

It can be observed that a biological virus may alter the host's behaviour - for example, causing them to cough germs over other people. I understand that some people infected with a biological virus become so angry and alienated that they deliberately set out to infect other people. Obviously a biological virus that can cause this kind of behaviour is likely to be more successful at propagating itself.

The authors of the paper discuss various mechanisms and incentive structures that a crafty computer virus could use to bribe and blackmail users, causing them to assist with propagation. It's a scary thought. But the authors end with an even scarier thought - we may no longer be able to draw a hard line between malware and other propagated software. Until we have proper controls, "running other peoples software will remain an activity to be undertaken with caution". 

 

See also Pact with the Devil 2 (June 2006)

Dangerous Coffee

Airports are divided into two zones - landside and airside - with a security boundary between.

I have generally found that the sandwiches and drinks are cheaper on the landside. (One major UK retailer sells good sandwiches in its landside shops, but not in its airside shops). And in some airports the best coffee is landside.

Makes sense. Once the passengers have gone through security, they are captive. The airport can get an economic "rent" by making them pay more for food and drink while they're waiting for a flight. (Isn't that the real reason they want us to check in so early.)

I hate being ripped off. So I try to buy anything I need on the landside, before going through security. And at some airports, that includes coffee.

Oh, but you can't do that anymore. For security reasons, you now can't take coffee through from landside to airside. Yeah, what do you think I've got concealed in my latte - nail scissors?

Any stupid regulation can be justified by appealing to security. But it doesn't take much to work out who really benefits commercially from these so-called regulations.

See previous post No Fly on Us

Tourism Suppression Agency

Gary Leff (Webflyer) has identifed several alternative purposes for the TSA.

• (T)aking (S)cissors (A)way
• (T)housands (S)tanding (A)round
• (T)ourism (S)uppression (A)gency

He complains that what the TSA does is force people and planes to spend more time on the ground at airports. As Adam Shostack points out, it is Uncle Sam imposing this. [Adam and I have already discussed this - see No Fly on Us]

However, for people who worry about carbon emissions and climate change, people who think that tourism has environmental and social costs as well as benefits, and people who sell replacement scissors, the current behaviour of the TSA may be welcome. It's an ill wind that blows nobody any good.

No Fly On Us

"If you assume the No-Fly List serves an important purpose, the system as it presently operates contains a gaping, dangerous loophole that makes the list nearly useless."

(Andy Bowers, A Dangerous LoopHole. Slate, Feb 7th, 2005)

These so-called security measures have been widely criticized (for example by Bruce Schneier), and it is hard to believe that anyone in authority seriously believes they would actually stop an attack. According to the POSIWID principle, if we want to understand the true purpose of the security checks, we should look at what these checks actually achieve.

• People spend longer in airports and spend more money in the retail outlets. The airport ecosystem becomes more profitable.
• Fast-track procedures for business class travellers encourage more business class travel. Self-service procedures reduce airline costs. The airlines become more profitable.
• People become accustomed to (and therefore more tolerant of) queues and delays. This allows for more flexible utilization of staff, aeroplanes and landing slots by airlines and airports.

See previous posts: Broken Suitcases and Feeble Security.

As Adam Shostak points out, while there are benefits to some players, the overall economic effect is to reduce efficiency. In other words, this is a negative-sum game - the costs to the many outweigh the benefits to the few. But that's a very common pattern of system dysfunction.

It turns out that this vulnerability has been known about for ages. I knew I'd seen a number of similar things in Bruce Schneier's newsletter, but I have now been reminded that Bruce mentioned this exact vulnerability in August 2003. Moreover, Adam Shostak claims to have seen a detailed presentation given to senior TSA managers last February. So what is really going on here? I think this just adds weight to the POSIWID argument.

updated Feb 14th, Feb 16th.

Broken Suitcases

According to Chuang Tzu

To guard yourself against thieves who slash open suitcases, rifle through bags and smash open boxes, one should strap the bags and lock them. The world at large knows that this shows wisdom. However, when a master thief comes, he simply picks up the suitcase, lifts the bag, carries off the box and runs away with them, his only concern being whether the straps and locks will hold! In such an instance, what seemed like wisdom on the part of the owner surely turns out to have been of use only to the master thief!

The post-2001 world is supposed to be characterized by heightened security. In our daily lives (for example when boarding an aeroplane or opening a bank account) we are faced with an array of security measures: causing indignity, inconvenience and delay to many, and possibly intimidating a few minor miscreants. However, the notion that these measures will cause any trouble for organized criminals or terrorists is a sick joke.

The wrong security measures are not just useless - they actually make things easier for the master thief. So whose purpose do they serve?

Feeble Security

When a bank relies on Mother’s Maiden Name to protect customer security, or when an airline relies on dodgy biometrics to prevent bad people boarding its flights, we have to ask: if these mechanisms make very little credible contribution to genuine security, what is their real purpose?

Financial Industry view of security