Bruce Schneier: Layers of Security

Bruce Schneier Bruce Schneier, the well-known American cryptographer and security specialist, gives an interview to Radio New Zealand’s Bryan Crump during his visit to the country, discussing real-world security issues and whether anti-terror measures done by the authorities worldwide are as effective as expected.

(Bryan Crump): – Bruce Schneier is a security specialist who seems to be trying to talk himself out of a job. His point is a lot of what we do to protect ourselves against terrorism is pointless. The best weapons against terror are, in his opinion, good intelligence and refusing to be terrorized. Bruce is based in the United States of America, was in New Zealand for a conference on identity and identity theft. Recently I spoke to him while he was here and began by asking what attracted him to this seemingly dry topic of airport X-rays baggage checks and the like.

(Bruce Schneier): – The security actually isn’t at all about attackers and defenders, police and criminals, good guys and bad guys, you know, it’s going to be the ultimate kid topic, I don’t think it’s dry at all. I’ve always been interested in security, I’ve been interested in mathematical security, cryptography, and then computer and network security, then security technology, and then how people keep things secure and how people break security. And I think it’s a mentality: you wake up in the morning, you look around to you figure out how you’re going to hack a system. I remember as a kid, I was going to a voting booth and thinking: “How could I cheat here?” It’s a way of thinking, and I think it’s really interesting.

– In other words, you’ve always looked at it from outside to some extent, rather than from the inside keeping things out, you have always been curious how the outside gets in.

– Well, they’re both the same. You cannot work as a defender unless you understand an attacker, so it’s not inside vs. outside, it’s taking a system and breaking the rules, and that’s the way to think of it. And whether you’re trying to stop someone from doing it, or you do it yourself, you still have to understand how the system works and how you can break the rules.

– People talk about the post-September 11th, 2001 security changes, but I remember that the first big changes in airport security were after the Lockerbie bombing in the late 80s, that’s when I remember they started to, you know, run those things over your clothes, which used to squeak most things. I remember those in the early 90s, and that was post-Lockerbie.

Airport security measures being continuously tightened

Airport security measures being continuously tightened

– Well, those were the metal detectors. It’s got to depend on your country. In the United States it was the 1970s that we started having hijackings, before that there was no airport security. In many countries even after that there wasn’t any airport security, because, you know, think of New Zealand, where are you going to hijack a plane to, most planes don’t have the range to go anywhere, so it wasn’t considered a risk, Hawaii was like that. And then changes happen slowly. In the United States after Lockerbie we got photo ID checks, they matched your ID to your ticket, we didn’t have that before then. And so, changes happened after different events depending on the country. September 11th was a big change in the United States, not for the better, but it eventually made airport security more annoying, and then the United States government pushed those changes to Europe and elsewhere.

– Tell me now, when traveling in the States – you left Detroit the other day – what are the standard security checks now you have to go through?

– Going through the airport is much like you do here, unfortunately I haven’t left New Zealand, I’ve just arrived, I don’t know the checks here. You are going to go through a metal detector, and there’s going to be an X-ray machine for your luggage. There’s also a photo ID check, where your name is checked against your ticket, and the stuff in the background there: the United States maintains no-fly lists, and secondary screening lists; if you are on one of those lists, you’ll be either denied boarding, or checked further. You have to take your computer out of your bag, that’s checked separately, and that was actually standard in Europe even before 9/11, it moved to the United States, there’s regulations on liquids, so you can’t take a lot of those, you can’t take a wine bottle in, you can only take very small bottles of liquids. And there are other little rules like that…

– You can’t take sharp things in, those old nail clippers – I couldn’t bring them for years. Is that changed?

– Nail clippers sort of came and went, and it wasn’t the nail clipper itself, it was the pointy thing, the nail file, and occasionally they would break them off and give it back to you.

– They were never that nice to me…

– Now there’s no problem, I bring my nail clipper on and there’s no worries.

– Are there still air marshals in the States?

Air marshals program as TSA’s response to maintaining civil aviation security

Air marshals program as TSA’s response to maintaining civil aviation security

– There are air marshals, but how many there are is unknown. So we know there’s an air marshal program, but if you think about it, an air marshal program is a deterrent effect even if there are no actual air marshals, there could be just one, or ten, or a hundred – we don’t know, we don’t know what planes they’re on. The airlines don’t like them because they take up first-class seats and don’t generate any revenue.

– Because they are not allowed to drink, are they?

– Also they don’t pay for their seats, more importantly. And I think they’re supposed to dress in suits, I don’t know the rules. The other thing is you have to take off your shoes. That depends, in the United States you still take off your shoes, in Europe most of the time you don’t.

– I know in the United Kingdom you do, because family members were trying to get from London to France the other day, they had a baby with them, the baby had to take the booties off.

– Now, you know, when I left London last week I didn’t, it seems particularly variable.

– Yes, obviously.

– Yes, it’ll depend on the kind of shoes sometimes, whether you have a very thick heel versus a pair of sneakers. So the rules are sort of in flux, we now have a Trusted Traveler Program in the United States…

– What does that mean?

Trusted Traveler program enables passing airport security procedures hassle-free

Trusted Traveler program enables passing airport security procedures hassle-free

– So if you’re on it, which means you go through some background screening – I think it’s only available for frequent fliers right now and American citizens – then you go through a special lane where you don’t have to take your shoes off, and your liquids out of your suitcase, and your computer out of your case, and you don’t have to take your coat off and your hat off. You can go through very quickly, actually it’s very pleasant, it’s like security was 15 years ago.

– Are you a Trusted Traveler?

– I seem to be.

– How much does that cost: all the security, all that’s put in, just, say, since September 11th, 2001?

– Well, we know the budget of TSA in the United States is $10 billion a year, it’s about 10 years…

– Sorry, TSA stands for…?

– Oh, the Transportation Security Administration is basically airport security in the U.S. Their budget’s $10 billion a year, $100 billion in 10 years is what airport security has cost the United States. Now, I don’t know, UK, Europe, Australia, New Zealand, Japan – I mean, you can add this up, and it gets even more, this is actually very expensive. A lot of arguments are now made that it’s not worth it, which, I think, is about time. In the early days after September 11th people were scared, and they were willing to do almost anything, now people are looking at some of the stuff and saying: “Hey, wait! Is this really a good idea?”

Read next: Layers of Security 2: The World after 9/11

Like This Article? Let Others Know!
Related Articles:

Leave a comment:

Your email address will not be published. Required fields are marked *

Comment via Facebook: