Tuesday, December 29, 2009

Security Theater Entertains, But Does It Make Us Safer?

Full quote here of the article by By Bruce Schneier, in a Special to CNN

Editor's note: Bruce Schneier is an author and technologist who specializes in security. His books include "Applied Cryptography," "Beyond Fear" and "Schneier on Security" and his other writing can be seen at http://www.schneier.com/

(CNN) -- Last week's attempted terror attack on an airplane heading from Amsterdam to Detroit has given rise to a bunch of familiar questions.

How did the explosives get past security screening? What steps could be taken to avert similar attacks? Why wasn't there an air marshal on the flight? And, predictably, government officials have rushed to institute new safety measures to close holes in the system exposed by the incident.

Reviewing what happened is important, but a lot of the discussion is off-base, a reflection of the fundamentally wrong conception most people have of terrorism and how to combat it.

Terrorism is rare, far rarer than many people think. It's rare because very few people want to commit acts of terrorism, and executing a terrorist plot is much harder than television makes it appear.

The best defenses against terrorism are largely invisible: investigation, intelligence, and emergency response. But even these are less effective at keeping us safe than our social and political policies, both at home and abroad. However, our elected leaders don't think this way: They are far more likely to implement security theater against movie-plot threats.

A "movie-plot threat" is an overly specific attack scenario. Whether it's terrorists with crop dusters, terrorists contaminating the milk supply, or terrorists attacking the Olympics, specific stories affect our emotions more intensely than mere data does.

Stories are what we fear. It's not just hypothetical stories -- terrorists flying planes into buildings, terrorists with explosives strapped to their legs or with bombs in their shoes, and terrorists with guns and bombs waging a co-ordinated attack against a city are even scarier movie-plot threats because they actually happened.

"Security theater" refers to security measures that make people feel more secure without doing anything to actually improve their security. An example: the photo ID checks that have sprung up in office buildings. No one has ever explained why verifying that someone has a photo ID provides any actual security, but it looks like security to have a uniformed guard-for-hire looking at ID cards.

Airport-security examples include the National Guard troops stationed at U.S. airports in the months after 9/11 -- their guns had no bullets. The U.S. color-coded system of threat levels, the pervasive harassment of photographers, and the metal detectors that are increasingly common in hotels and office buildings since the Mumbai terrorist attacks, are additional examples.

To be sure, reasonable arguments can be made that some terrorist targets are more attractive than others: airplanes because a small bomb can result in the death of everyone aboard, monuments because of their national significance, national events because of television coverage, and transportation because of the numbers of people who commute daily.

But there are literally millions of potential targets in any large country -- there are 5 million commercial buildings alone in the United States -- and hundreds of potential terrorist tactics. It's impossible to defend every place against everything, and it's impossible to predict which tactic and target terrorists will try next.

Security is both a feeling and a reality. The propensity for security theater comes from the interplay between the public and its leaders.

When people are scared, they need something done that will make them feel safe, even if it doesn't truly make them safer. Politicians naturally want to do something in response to crisis, even if that something doesn't make any sense.

Often, this "something" is directly related to the details of a recent event. We confiscate liquids, screen shoes, and ban box cutters on airplanes. We tell people they can't use an airplane restroom in the last 90 minutes of an international flight. But it's not the target and tactics of the last attack that are important, but the next attack. These measures are only effective if we happen to guess what the next terrorists are planning.

If we spend billions defending our rail systems, and the terrorists bomb a shopping mall instead, we've wasted our money. If we concentrate airport security on screening shoes and confiscating liquids, and the terrorists hide explosives in their brassieres and use solids, we've wasted our money. Terrorists don't care what they blow up and it shouldn't be our goal merely to force the terrorists to make a minor change in their tactics or targets.

Our current response to terrorism is a form of "magical thinking." It relies on the idea that we can somehow make ourselves safer by protecting against what the terrorists happened to do last time.

Unfortunately for politicians, the security measures that work are largely invisible. Such measures include enhancing the intelligence-gathering abilities of the secret services, hiring cultural experts and Arabic translators, building bridges with Islamic communities both nationally and internationally, funding police capabilities -- both investigative arms to prevent terrorist attacks, and emergency communications systems for after attacks occur -- and arresting terrorist plotters without media fanfare.

They do not include expansive new police or spying laws. Our police don't need any new laws to deal with terrorism; rather, they need apolitical funding.

The arrest of the "liquid bombers" in London is an example: They were caught through old-fashioned intelligence and police work. Their choice of target (airplanes) and tactic (liquid explosives) didn't matter; they would have been arrested regardless.

But even as we do all of this we cannot neglect the feeling of security, because it's how we collectively overcome the psychological damage that terrorism causes. It's not security theater we need, it's direct appeals to our feelings. The best way to help people feel secure is by acting secure around them. Instead of reacting to terrorism with fear, we -- and our leaders -- need to react with indomitability, the kind of strength shown by President Franklin D. Roosevelt and Prime Minister Winston Churchill during World War II.

By not overreacting, by not responding to movie-plot threats, and by not becoming defensive, we demonstrate the resilience of our society, in our laws, our culture, our freedoms. There is a difference between indomitability and arrogant "bring 'em on" rhetoric. There's a difference between accepting the inherent risk that comes with a free and open society, and hyping the threats.

We should treat terrorists like common criminals and give them all the benefits of true and open justice -- not merely because it demonstrates our indomitability, but because it makes us all safer.

Once a society starts circumventing its own laws, the risks to its future stability are much greater than terrorism.

Despite fearful rhetoric to the contrary, terrorism is not a transcendent threat. A terrorist attack cannot possibly destroy a country's way of life; it's only our reaction to that attack that can do that kind of damage. The more we undermine our own laws, the more we convert our buildings into fortresses, the more we reduce the freedoms and liberties at the foundation of our societies, the more we're doing the terrorists' job for them.

Today, we can project indomitability by rolling back all the fear-based post-9/11 security measures. Our leaders have lost credibility; getting it back requires a decrease in hyperbole. Ditch the invasive mass surveillance systems and new police state-like powers. Return airport security to pre-9/11 levels. Remove swagger from our foreign policies. Show the world that our legal system is up to the challenge of terrorism. Stop telling people to report all suspicious activity; it does little but make us suspicious of each other, increasing both fear and helplessness.

Counterterrorism is also hard, especially when we're psychologically prone to muck it up. Since 9/11, we've embarked on strategies of defending specific targets against specific tactics, overreacting to every terrorist video, stoking fear, demonizing ethnic groups, and treating the terrorists as if they were legitimate military opponents who could actually destroy a country or a way of life -- all of this plays into the hands of terrorists.

We'd do much better by leveraging the inherent strengths of our modern democracies and the natural advantages we have over the terrorists: our adaptability and survivability, our international network of laws and law enforcement, and the freedoms and liberties that make our society so enviable.

The way we live is open enough to make terrorists rare; we are observant enough to prevent most of the terrorist plots that exist, and indomitable enough to survive the even fewer terrorist plots that actually succeed. We don't need to pretend otherwise.

The opinions expressed in this commentary are solely those of Bruce Schneier. An earlier version of this essay appeared in New Internationalist magazine.



Find this article at:
http://www.cnn.com/2009/OPINION/12/29/schneier.air.travel.security.theater/index.html

Fighting Corruption with Public Diplomacy

The subject of corruption has been much in the news, not to mention in conversations in Washington lately. Everyone is condemning Afghan corruption with righteous indignation.

Here the inside-the-Beltway crowd apparently believe that if some important American such as President Obama or Secretary Clinton would just tell the Afghans to stop the corruption, that will do it. After all, it's just political will power, right? Obama could throw a tantrum with Karzai, Karzai would in turn throw a tantrum in Kabul, and the Afghans would change everything right away. Corruption would end.

No probably not.

But, there are things we can do. Most Foreign Service Officers know that anti-corruption is a long-term task. The pros know that you use public diplomacy programs to change outcomes more often than you use old fashioned political appeals, too. Fighting corruption requires education, not simply political arm twisting. It is a matter of changing perceptions and norms, not convincing a few individuals to decree a change in deep-seated behaviors.

Years ago when I was Ambassador in Latvia, anti-corruption was a major focus. The country was riven by cliques, and the main purpose of political parties seemed to be the enabling of more corruption. We knew that for Latvia to become a successful member of NATO and the European Union, the corrupt practices had to be gotten under control. Maybe not expunged completely, but certainly gotten down to the Italian or Greek level at least.

My predecessors in Riga (and most other East European democracies) had been working on the corruption issue since 1989 or 1991, long before I arrived. And, while each of us might think there was some progress from time to time, surely it was a slow business. Ending corruption in a nation essentially means changing people's expectations, changing their minds about right vs wrong, establishing new standards in a society.

So, how do you fight corruption, especially if you are a foreigner? There are, I believe, with three tools: definition, measurement and demonstration. That is, you need to (a) define what is corruption (in the host nation person's mind, not our American viewpoint), (b) identify and measure corruption (often by encouraging transparency) and (c) penalize the corrupt and reward the honest people in every way you can.

What is corruption? People in different cultures will have distinct ideas of what constitutes corruption. In a society where civil servants are obviously underpaid, it may be acceptable to the majority that they get a little "bakshish" for doing their jobs. Maybe it is okay to "tip" a low-level official for fast service, but it is not okay to win an auction for an entire forest or oil rights with bribes. You have to start with what the people in the country think is corrupt, not what we Americans might think is corrupt behavior.

You can aim to change that perception, but you had better not assume that your definition is their definition.

It may also be necessary to address some structural problems. In East Europe, we often argued for increasing the salaries of policemen, prosecutors and judges in order to remove much of the temptation to solicit under the table payments.

Having understood the definition of corruption, the majority of a successful American embassy's effort goes into finding ways to measure the corruption and identify it. At the most basic level, the Americans may try to establish and support public interest groups that will fight corruption. Perhaps there is a need to provide training in investigative journalism and related skills like forensic accounting to the media, to prosecutors and judges. We learned in Latvia that the judges, long used to taking political orders during communist times, had little experience in evaluating evidence, especially in complicated financial cases. We did a lot of judicial training and paid attention to the courts' ability to manage document-intensive cases. Maybe an academic journal will become a forum for discussions on the nature and impact of corruption.

Better than attempting to jawbone the leadership on the corruption issue in public fora, an embassy can signal its support for the ethical administrators at public events, can mention their accomplishments in media interviews, and can find opportunities to stand beside them (and behind them when necessary). On more than one occasion, as ambassador, I reminded key politicians that the American government admired certain officials and their accomplishments. Not too subtly, I also noted that Washington would judge the political leaders by the way they stood behind these key corruption fighters. Such mention did not go unnoticed.

And of course, there is the negative side. We made sure it was noticed that certain politicians were never invited to embassy events, never were guests of the ambassador, and never had a "grip and grin" with senior U.S. government visitors. In a couple of cases, we even let it be known that should certain individuals apply for a U.S. visa, they most likely would be turned down.

In the end, however, whatever path the embassy takes, much of the diplomat's role is going to be educational, with dollops of encouragement and reward. Twisting arms and public denunciations may feel satisfying, but they produce limited results. Moreover, too much criticism inevitably puts the Americans in a proconsul or "preachy" mode vis a vis host nation leaders. That is one that is rarely popular for long, and tends to undermine our objecive.

In a practical sense, what an embassy can do is limited. We can support those who want to do the right things, help to educate people (journalists need investigative reporting tools and training, judges need education and training, etc.), and continually honor and illuminate the success stories. The Riga AmCham and your statement of Good Corporate Citizenship are, in my view, success stories that merit the embassy's clear support.

Saturday, December 26, 2009

A New Weather Forecasting Site

This, the first day after Christmas, has been a most dismal, grey day. Low clouds, fog, rain, and dark clouds seemed to dampen the mood. If there was one reason to rejoice, it was the warm winds melted a lot of the snow that fell a week ago.

It is hard to believe that tomorrow should be clear and sunny...a great day for flying down to southern West Virginia.

One good thing to come of this day was my discovery of a new website with weather forecasts from the National Weather Service. This one will be a great help when trying to plan some cross country flying over a period of several days. It already proved useful for tomorrow's expedition.

http://www.weather.gov/forecasts/graphical/sectors/conusWeek.php#tabs