[Infowarrior] - Schneier: Security and Privacy Aren't Opposites

[Richard Forno]

What Our Top Spy Doesn't Get: Security and Privacy Aren't Opposites
Bruce Schneier 
http://www.wired.com/politics/security/commentary/securitymatters/2008/01/se
curitymatters_0124?currentPage=all

If there's a debate that sums up post-9/11 politics, it's security versus
privacy. Which is more important? How much privacy are you willing to give
up for security? Can we even afford privacy in this age of insecurity?
Security versus privacy: It's the battle of the century, or at least its
first decade.

In a Jan. 21 New Yorker article, Director of National Intelligence Michael
McConnell discusses a proposed plan to monitor all -- that's right, all --
internet communications for security purposes, an idea so extreme that the
word "Orwellian" feels too mild.

The article (not online) contains this passage:

In order for cyberspace to be policed, internet activity will have to be
closely monitored. Ed Giorgio, who is working with McConnell on the plan,
said that would mean giving the government the authority to examine the
content of any e-mail, file transfer or Web search. "Google has records that
could help in a cyber-investigation," he said. Giorgio warned me, "We have a
saying in this business: 'Privacy and security are a zero-sum game.'"

I'm sure they have that saying in their business. And it's precisely why,
when people in their business are in charge of government, it becomes a
police state. If privacy and security really were a zero-sum game, we would
have seen mass immigration into the former East Germany and modern-day
China. While it's true that police states like those have less street crime,
no one argues that their citizens are fundamentally more secure.

We've been told we have to trade off security and privacy so often -- in
debates on security versus privacy, writing contests, polls, reasoned essays
and political rhetoric -- that most of us don't even question the
fundamental dichotomy.

But it's a false one.

Security and privacy are not opposite ends of a seesaw; you don't have to
accept less of one to get more of the other. Think of a door lock, a burglar
alarm and a tall fence. Think of guns, anti-counterfeiting measures on
currency and that dumb liquid ban at airports. Security affects privacy only
when it's based on identity, and there are limitations to that sort of
approach.

Since 9/11, two -- or maybe three -- things have potentially improved
airline security: reinforcing the cockpit doors, passengers realizing they
have to fight back and -- possibly -- sky marshals. Everything else -- all
the security measures that affect privacy -- is just security theater and a
waste of effort.

By the same token, many of the anti-privacy "security" measures we're seeing
-- national ID cards, warrantless eavesdropping, massive data mining and so
on -- do little to improve, and in some cases harm, security. And government
claims of their success are either wrong, or against fake threats.

The debate isn't security versus privacy. It's liberty versus control.

You can see it in comments by government officials: "Privacy no longer can
mean anonymity," says Donald Kerr, principal deputy director of national
intelligence. "Instead, it should mean that government and businesses
properly safeguard people's private communications and financial
information." Did you catch that? You're expected to give up control of your
privacy to others, who -- presumably -- get to decide how much of it you
deserve. That's what loss of liberty looks like.

It should be no surprise that people choose security over privacy: 51 to 29
percent in a recent poll. Even if you don't subscribe to Maslow's hierarchy
of needs, it's obvious that security is more important. Security is vital to
survival, not just of people but of every living thing. Privacy is unique to
humans, but it's a social need. It's vital to personal dignity, to family
life, to society -- to what makes us uniquely human -- but not to survival.

If you set up the false dichotomy, of course people will choose security
over privacy -- especially if you scare them first. But it's still a false
dichotomy. There is no security without privacy. And liberty requires both
security and privacy. The famous quote attributed to Benjamin Franklin
reads: "Those who would give up essential liberty to purchase a little
temporary safety, deserve neither liberty nor safety." It's also true that
those who would give up privacy for security are likely to end up with
neither.

---

Bruce Schneier is CTO of BT Counterpane and author of Beyond Fear: Thinking
Sensibly About Security in an Uncertain World. You can read more of his
writings on his website.