The Slow Erosion of our Freedoms

As usual, security expert Bruce Schneier gets it right on the question of why "It's smart politics to exaggerate terrorist threats."

He lists 3 reasons.  Here's the first one:

Terrorism causes fear, and we overreact to that fear. Our brains aren't very good at probability and risk analysis. We tend to exaggerate spectacular, strange and rare events, and downplay ordinary, familiar and common ones. We think rare risks are more common than they are, and we fear them more than probability indicates we should.

Our leaders are just as prone to this overreaction as we are. But aside from basic psychology, there are other reasons that it's smart politics to exaggerate terrorist threats, and security threats in general.

The first is that we respond to a strong leader. Bill Clinton famously said: "When people feel uncertain, they'd rather have somebody that's strong and wrong than somebody who's weak and right." He's right. 

The second is that doing something -- anything -- is good politics. A politician wants to be seen as taking charge, demanding answers, fixing things. It just doesn't look as good to sit back and claim that there's nothing to do. The logic is along the lines of: "Something must be done. This is something. Therefore, we must do it."

The third is that....

You'll have to click over here for the last reason and some more fascinating analysis.  

 

Refuse to Be Terrorized

As usual, Bruce Schneier gets it exactly right.  Below is a short excerpt (complete with Bruce's hyperlinks), please read the entire post here.

And refuse to be terrorized.

As the details about the bombings in Boston unfold, it'd be easy to be scared. It'd be easy to feel powerless and demand that our elected leaders do something -- anything -- to keep us safe.

It'd be easy, but it'd be wrong. We need to be angry and empathize with the victims without being scared. Our fears would play right into the perpetrators' hands -- and magnify the power of their victory for whichever goals whatever group behind this, still to be uncovered, has. We don't have to be scared, and we're not powerless. We actually have all the power here, and there's one thing we can do to render terrorism ineffective: Refuse to be terrorized.

It's hard to do, because terrorism is designed precisely to scare people -- far out of proportion to its actual danger. A huge amount of research on fear and the brain teaches us that we exaggerate threats that are rare, spectacular, immediate, random -- in this case involving an innocent child -- senseless, horrific and graphic. Terrorism pushes all of our fear buttons, really hard, and we overreact.
 

Again, continue reading the rest of Bruce's piece here.  It's worth it.

I've never been fast enough to run the Boston Marathon, but I have run on the streets of that old city.  I cannot imagine the fear and the, well, terror, that must have flashed through everyone's heart who was there.  Sending all the good vibes I can muster.

 

Airport Security

If you don't read Boing Boing, you should.  It's a geeky but entertainingly readable science blog.

I could point you to many articles, but since I travel frequently I am particularly interested in what security guru Bruce Schneier calls "Security Theater."  Here's the latest:

To walk through an airport with Bruce Schneier is to see how much change a trillion dollars can wreak. So much inconvenience for so little benefit at such a staggering cost. And directed against a threat that, by any objective standard, is quite modest. Since 9/11, Islamic terrorists have killed just 17 people on American soil, all but four of them victims of an army major turned fanatic who shot fellow soldiers in a rampage at Fort Hood. (The other four were killed by lone-wolf assassins.) During that same period, 200 times as many Americans drowned in their bathtubs. Still more were killed by driving their cars into deer. The best memorial to the victims of 9/11, in Schneier’s view, would be to forget most of the “lessons” of 9/11.

Before you deluge me with comments to the effect that the lack of deaths PROVES that our counter terrorism efforts are working, you should read the whole article.

 

Schneier Gets it Right...Again

Via Bruce Schneier, always a good read, who points us to an article by Shikha Dalmia, "What Islamist Terrorist Threat?"

But this year marks the 10th anniversary of 9-11 and none of the horrible scenarios conjured then have materialized. Islamic terrorists have not flown more planes into buildings. They haven't detonated "loose nukes" or dirty bombs. They haven't released nerve gas into subway stations. They haven't poisoned the water supply. They haven't even strolled into one of America's hundreds of malls or farmer's markets and blown themselves up.

Maybe this is because enhanced post-9/11 security has made America invulnerable. Or maybe the Islamists never posed that a big threat to begin with.

//SNIP//

Over 5,000 American soldiers have died in Afghanistan and Iraq without on balance saving any civilian lives. It is time to call off the "war" on terrorism. Al Qaeda is not worth it.

Gary: In the meanwhile, we've sunk some $1 trillion into a pair of wars and another $1 trillion into Homeland Security. And blithely passed along that bill--outside the normal budget process--to succeeding generations, all the while trumpeting fiscal discipline.

 

Closing the Washington Monument

I love me some Bruce Schneier, the most sensible person on things security, whom I have linked to before (Security Theater and Cyberwar):

Securing the Washington Monument from terrorism has turned out to be a surprisingly difficult job. The concrete fence around the building protects it from attacking vehicles, but there's no visually appealing way to house the airport-level security mechanisms the National Park Service has decided are a must for visitors. It is considering several options, but I think we should close the monument entirely. Let it stand, empty and inaccessible, as a monument to our fears.

An empty Washington Monument would serve as a constant reminder to those on Capitol Hill that they are afraid of the terrorists and what they could do. They're afraid that by speaking honestly about the impossibility of attaining absolute security or the inevitability of terrorism -- or that some American ideals are worth maintaining even in the face of adversity -- they will be branded as "soft on terror." And they're afraid that Americans would vote them out of office if another attack occurred. Perhaps they're right, but what has happened to leaders who aren't afraid? What has happened to "the only thing we have to fear is fear itself"?

//SNIP//

The empty monument would symbolize our war on the unexpected, -- our overreaction to anything different or unusual -- our harassment of photographers, and our probing of airline passengers. It would symbolize our "show me your papers" society, rife with ID checks and security cameras. As long as we're willing to sacrifice essential liberties for a little temporary safety, we should keep the Washington Monument empty.

I did the math once as part of a talk I was giving on the 47th Alabama Infantry at Gettysburg.  As an American, your probability of dying on 9/11 was about 1 in 92,000.  Had you been alive on July 1-3, 1863, your chance of dying at Gettysburg was about 1 in 4,200.

Risk is relative.  Back to Schneier:

It's our reaction to terrorism that threatens our nation, not terrorism itself. The empty monument would symbolize the empty rhetoric of those leaders who preach fear and then use that fear for their own political ends.

The Threat of Cyberwar Has Been Grossly Exaggerated

The Earth-Bound Misfit is typically much more paranoid than I am, and weighs in heavily against the new NSA-run program, “Perfect Citizen.” Her post is here, and the original article in the Wall Street Journal is here. The WSJ says,

The federal government is launching an expansive program dubbed "Perfect Citizen" to detect cyber assaults on private companies and government agencies running such critical infrastructure as the electricity grid and nuclear-power plants, according to people familiar with the program.

I can see the need for ensuring that we have protection against cyber attacks, but the name. The name absolutely sounds like something straight out of Orwell’s 1984. Really, Perfect Citizen? You’ve got to be kidding…unless that was the intent—to make it sounds like 1984 on purpose.

Bruce Schneier, whose opinions on security I value more than anyone’s, has this to say:

The Threat of Cyberwar Has Been Grossly Exaggerated

There's a power struggle going on in the U.S. government right now.

It's about who is in charge of cyber security, and how much control the government will exert over civilian networks. And by beating the drums of war, the military is coming out on top.

We surely need to improve our cybersecurity. But words have meaning, and metaphors matter. There's a power struggle going on for control of our nation's cybersecurity strategy, and the NSA and DoD are winning. If we frame the debate in terms of war, if we accept the military's expansive cyberspace definition of "war," we feed our fears.

We reinforce the notion that we're helpless -- what person or organization can defend itself in a war? -- and others need to protect us. We invite the military to take over security, and to ignore the limits on power that often get jettisoned during wartime.

If, on the other hand, we use the more measured language of cybercrime, we change the debate. Crime fighting requires both resolve and resources, but it's done within the context of normal life. We willingly give our police extraordinary powers of investigation and arrest, but we temper these powers with a judicial system and legal protections for citizens.

We need to be prepared for war, and a Cyber Command is just as vital as an Army or a Strategic Air Command. And because kid hackers and cyber-warriors use the same tactics, the defenses we build against crime and espionage will also protect us from more concerted attacks. But we're not fighting a cyberwar now, and the risks of a cyberwar are no greater than the risks of a ground invasion. We need peacetime cyber-security, administered within the myriad structure of public and private security institutions we already have.

Security Theater

In my "Tools" post of yesterday, I got off track from geekiness to tools. In my work life I deal at times with security issues, and my original intent yesterday was to link to one of my favs in the security arena, Bruce Schneier.

In view of the recent terrorism and airline security news, check out http://www.schneier.com/blog/archives/2009/11/beyond_security.html ), and see if you don’t agree that Bruce makes a ton of sense.

One of Bruce's main points is that what passes for security is really just “security theater.” And as he points out, “Security theater consumes resources that could better be spent elsewhere.” May as well let Bruce ramble (but please do read the whole article!):

By not overreacting, by not responding to movie-plot threats, and by not becoming defensive, we demonstrate the resilience of our society, in our laws, our culture, our freedoms. There is a difference between indomitability and arrogant "bring 'em on" rhetoric. There's a difference between accepting the inherent risk that comes with a free and open society, and hyping the threats.

We should treat terrorists like common criminals and give them all the benefits of true and open justice -- not merely because it demonstrates our indomitability, but because it makes us all safer. Once a society starts circumventing its own laws, the risks to its future stability are much greater than terrorism.

Supporting real security even though it's invisible, and demonstrating indomitability even though fear is more politically expedient, requires real courage. Demagoguery is easy. What we need is leaders willing both to do what's right and to speak the truth.

Despite fearful rhetoric to the contrary, terrorism is not a transcendent threat. A terrorist attack cannot possibly destroy a country's way of life; it's only our reaction to that attack that can do that kind of damage. The more we undermine our own laws, the more we convert our buildings into fortresses, the more we reduce the freedoms and liberties at the foundation of our societies, the more we're doing the terrorists' job for them.