Bruce Schneier shared his ideas about the psychology of security, and the need for thinking sensibly about security, in his hometown late last month nwhen he gave a lecture at the Weisman Art Museum on the campus of the University of Minnesota.
Schneier's lecture was scheduled in conjunction with an exhibition of photographer Paul Shambroom's images of power (Shambroom's photographs capture scenes in industrial, business, community and military environments.) The association of Schneier's lecture with the photography exhibit says a lot about how the security guru's focus has evolved over the years from the bits and bytes of cryptography and computer security to include a more broad examination of personal safety, crime, corporate and national security.
The theme of Schneier's talk was the "security theatre", a term he uses to describe security measures that are designed to make people feel safer but don't necessarily do so.
"Security is really two different things. It's a feeling and it's a reality. And they're very different," he says. "You can feel secure even though you're not, and you can be secure even though you don't feel it."
One example of security theatre he gave is tamper-resistant caps for over-the-counter medicines, which were introduced in the wake of Tylenol-tampering incidents in the 1980s. As a means of preventing tampering, the packaging is more security theatre than an effective countermeasure. Someone intent on tampering with the contents could use a syringe, for example, Schneier says.
Security theatre can be dangerous because it takes money, time and attention away from genuine security efforts that are aimed at directing effective countermeasures at real risks. But security theatre isn't all bad, Schneier says. In some cases, security theatre used to allay fears that are out of whack with reality can be a good thing.
For example, as a means of making consumers feel more secure about buying nonprescription drugs (which mathematically are at minimal risk of being tampered with), the tamper-proof packaging served to bring people's feelings about security more in line with reality, he says.
Another example Schneier gave is the use of National Guard troops in airports following the 9/11 terrorist attacks. The troops had no bullets in their guns, making them fairly ineffective as a security countermeasure. But their presence helped make people less afraid to fly, which was important at the time.
Schneier talked a lot about aligning the feeling of security with the mathematical reality of security.
"If the feeling [of security] is greater than the reality, we have a false sense of security. If the reality is greater than the fear, then we have a false sense of insecurity, in extreme cases you could call it paranoia . . . or irrational fear," he says.
Convergence will occur naturally as people become more informed — and populate their "cognitive model" with factual information about actual risks and effective countermeasures. Of course, Schneier says, it's not that simple since the public is exposed to skewed data depending on the agendas of those providing information, whether it's the media reporting sensational stories, politicians looking to secure their own careers, vendors looking to sell their products and so on.
Having an agenda doesn't make someone malicious, but it illustrates the fact that security trade-offs — what someone is willing to risk vs. invest — are personal, Schneier says. "Different stakeholders will evaluate security trade-offs differently, and that makes sense," he says.
"Very often security trade-offs are made for nonsecurity reasons," he adds, citing as an example news that broke this week that the United States is outsourcing the printing of passports to a company in Thailand. "From a security perspective it's a really dumb idea — but think of the savings," he quips.
Following his talk, the standing-room-only crowd peppered Schneier with questions about surveillance cameras ("At best cameras seem to move crime around," he says), electronic voting systems ("Even if there is no manipulation, if there is the perception of, the likelihood of, the chance of, or the belief of manipulation, then the acceptance of the accuracy of the election is suddenly a problem."), global warming and more.
Schneier says there is cause for optimism.
"I'm not a pessimist — even though I have all the information that I just shared with you — because in general the system works, the system does tend to converge on reality," he says. Society has a history of managing new risks, getting used to new a technology and normalising it, he says. But it takes time.
"I tend to be short-term pessimistic and long-term optimistic."
Schneier's most recent book is Beyond Fear: Thinking Sensibly about Security in an Uncertain World.