[Infowarrior] - Schneier: Is aviation security mostly for show?

[Richard Forno]

Is aviation security mostly for show?
By Bruce Schneier, Special to CNN

http://www.cnn.com/2009/OPINION/12/29/schneier.air.travel.security.theater/index.html

Editor's note: Bruce Schneier is an author and technologist who  
specializes in security. His books include "Applied Cryptography,"  
"Beyond Fear" and "Schneier on Security" and his other writing can be  
seen at http://www.schneier.com/
(CNN) -- Last week's attempted terror attack on an airplane heading  
from Amsterdam to Detroit has given rise to a bunch of familiar  
questions.

How did the explosives get past security screening? What steps could  
be taken to avert similar attacks? Why wasn't there an air marshal on  
the flight? And, predictably, government officials have rushed to  
institute new safety measures to close holes in the system exposed by  
the incident.

Reviewing what happened is important, but a lot of the discussion is  
off-base, a reflection of the fundamentally wrong conception most  
people have of terrorism and how to combat it.

Terrorism is rare, far rarer than many people think. It's rare because  
very few people want to commit acts of terrorism, and executing a  
terrorist plot is much harder than television makes it appear.

The best defenses against terrorism are largely invisible:  
investigation, intelligence, and emergency response. But even these  
are less effective at keeping us safe than our social and political  
policies, both at home and abroad. However, our elected leaders don't  
think this way: They are far more likely to implement security theater  
against movie-plot threats.

A "movie-plot threat" is an overly specific attack scenario. Whether  
it's terrorists with crop dusters, terrorists contaminating the milk  
supply, or terrorists attacking the Olympics, specific stories affect  
our emotions more intensely than mere data does.

Stories are what we fear. It's not just hypothetical stories --  
terrorists flying planes into buildings, terrorists with explosives  
strapped to their legs or with bombs in their shoes, and terrorists  
with guns and bombs waging a co-ordinated attack against a city are  
even scarier movie-plot threats because they actually happened.

"Security theater" refers to security measures that make people feel  
more secure without doing anything to actually improve their security.  
An example: the photo ID checks that have sprung up in office  
buildings. No one has ever explained why verifying that someone has a  
photo ID provides any actual security, but it looks like security to  
have a uniformed guard-for-hire looking at ID cards.

Airport-security examples include the National Guard troops stationed  
at U.S. airports in the months after 9/11 -- their guns had no  
bullets. The U.S. color-coded system of threat levels, the pervasive  
harassment of photographers, and the metal detectors that are  
increasingly common in hotels and office buildings since the Mumbai  
terrorist attacks, are additional examples.

To be sure, reasonable arguments can be made that some terrorist  
targets are more attractive than others: airplanes because a small  
bomb can result in the death of everyone aboard, monuments because of  
their national significance, national events because of television  
coverage, and transportation because of the numbers of people who  
commute daily.

But there are literally millions of potential targets in any large  
country -- there are 5 million commercial buildings alone in the  
United States -- and hundreds of potential terrorist tactics. It's  
impossible to defend every place against everything, and it's  
impossible to predict which tactic and target terrorists will try next.

Security is both a feeling and a reality. The propensity for security  
theater comes from the interplay between the public and its leaders.

When people are scared, they need something done that will make them  
feel safe, even if it doesn't truly make them safer. Politicians  
naturally want to do something in response to crisis, even if that  
something doesn't make any sense.

Often, this "something" is directly related to the details of a recent  
event. We confiscate liquids, screen shoes, and ban box cutters on  
airplanes. We tell people they can't use an airplane restroom in the  
last 90 minutes of an international flight. But it's not the target  
and tactics of the last attack that are important, but the next  
attack. These measures are only effective if we happen to guess what  
the next terrorists are planning.

If we spend billions defending our rail systems, and the terrorists  
bomb a shopping mall instead, we've wasted our money. If we  
concentrate airport security on screening shoes and confiscating  
liquids, and the terrorists hide explosives in their brassieres and  
use solids, we've wasted our money. Terrorists don't care what they  
blow up and it shouldn't be our goal merely to force the terrorists to  
make a minor change in their tactics or targets.

Our current response to terrorism is a form of "magical thinking." It  
relies on the idea that we can somehow make ourselves safer by  
protecting against what the terrorists happened to do last time.

Unfortunately for politicians, the security measures that work are  
largely invisible. Such measures include enhancing the intelligence- 
gathering abilities of the secret services, hiring cultural experts  
and Arabic translators, building bridges with Islamic communities both  
nationally and internationally, funding police capabilities -- both  
investigative arms to prevent terrorist attacks, and emergency  
communications systems for after attacks occur -- and arresting  
terrorist plotters without media fanfare.

They do not include expansive new police or spying laws. Our police  
don't need any new laws to deal with terrorism; rather, they need  
apolitical funding.

The arrest of the "liquid bombers" in London is an example: They were  
caught through old-fashioned intelligence and police work. Their  
choice of target (airplanes) and tactic (liquid explosives) didn't  
matter; they would have been arrested regardless.

But even as we do all of this we cannot neglect the feeling of  
security, because it's how we collectively overcome the psychological  
damage that terrorism causes. It's not security theater we need, it's  
direct appeals to our feelings. The best way to help people feel  
secure is by acting secure around them. Instead of reacting to  
terrorism with fear, we -- and our leaders -- need to react with  
indomitability, the kind of strength shown by President Franklin D.  
Roosevelt and Prime Minister Winston Churchill during World War II.

By not overreacting, by not responding to movie-plot threats, and by  
not becoming defensive, we demonstrate the resilience of our society,  
in our laws, our culture, our freedoms. There is a difference between  
indomitability and arrogant "bring 'em on" rhetoric. There's a  
difference between accepting the inherent risk that comes with a free  
and open society, and hyping the threats.

We should treat terrorists like common criminals and give them all the  
benefits of true and open justice -- not merely because it  
demonstrates our indomitability, but because it makes us all safer.

Once a society starts circumventing its own laws, the risks to its  
future stability are much greater than terrorism.

Despite fearful rhetoric to the contrary, terrorism is not a  
transcendent threat. A terrorist attack cannot possibly destroy a  
country's way of life; it's only our reaction to that attack that can  
do that kind of damage. The more we undermine our own laws, the more  
we convert our buildings into fortresses, the more we reduce the  
freedoms and liberties at the foundation of our societies, the more  
we're doing the terrorists' job for them.

Today, we can project indomitability by rolling back all the fear- 
based post-9/11 security measures. Our leaders have lost credibility;  
getting it back requires a decrease in hyperbole. Ditch the invasive  
mass surveillance systems and new police state-like powers. Return  
airport security to pre-9/11 levels. Remove swagger from our foreign  
policies. Show the world that our legal system is up to the challenge  
of terrorism. Stop telling people to report all suspicious activity;  
it does little but make us suspicious of each other, increasing both  
fear and helplessness.

Counterterrorism is also hard, especially when we're psychologically  
prone to muck it up. Since 9/11, we've embarked on strategies of  
defending specific targets against specific tactics, overreacting to  
every terrorist video, stoking fear, demonizing ethnic groups, and  
treating the terrorists as if they were legitimate military opponents  
who could actually destroy a country or a way of life -- all of this  
plays into the hands of terrorists.

We'd do much better by leveraging the inherent strengths of our modern  
democracies and the natural advantages we have over the terrorists:  
our adaptability and survivability, our international network of laws  
and law enforcement, and the freedoms and liberties that make our  
society so enviable.

The way we live is open enough to make terrorists rare; we are  
observant enough to prevent most of the terrorist plots that exist,  
and indomitable enough to survive the even fewer terrorist plots that  
actually succeed. We don't need to pretend otherwise.

The opinions expressed in this commentary are solely those of Bruce  
Schneier. An earlier version of this essay appeared in New  
Internationalist magazine.




Find this article at:
http://www.cnn.com/2009/OPINION/12/29/schneier.air.travel.security.theater/index.html