Category Archives: History

The Economics of Security

That’s the title of Schneier’s upcoming RSA presentation, and yet his analysis of the Post Office shooting in California (titled “Security Problems with Controlled Access Systems“) lacks even a basic foundation in economics:

This is a failure of both technology and procedure. The gate was configured to allow multiple vehicles to enter on only one person’s authorization — that’s a technology failure. And people are programmed to be polite — to hold the door for others.

Many of the commentators picked this up right away and pointed out that it would be far too costly to upgrade the physical access controls at all post offices, since they are easy to defeat. Fine, but defeat by what/whom? The risk calculation is unbearably lopsided if all we do is debate how vulnerable we could be, as opposed to including what we need to protect ourselves from.

risk = asset x vulnerability x threat
threat = frequency x severity

Bruce does suggest that frequency should be taken into consideration when he notes “There is a common myth that workplace homicides are prevalent in the United States Postal Service”. But he still concludes rather misleadingly that basic gate and access card controls “failed” to prevent a motivated and armed assailant with insider knowledge from bypassing them. Moreover, he doesn’t address anything related to how the frequency might be determined going forward (or what countermeasures might have mitigated the threat, looking back).

Thus, I posted two comments to try and help balance out the discussion by touching on more of the economic considerations:

In a typical risk calculation, you have to factor in the threat as well as the vulnerabilities. If you don’t want to decrease the vulnerabilities (e.g. due to capital expense and inconvenience) then you should consider countermeasures for the threats. The article mentions the woman had been put on medical leave a couple years prior to the shooting and had tangled with law-enforcement already. Seems like there are some opportunities for improvement, regarding how her condition/situation was handled or at least monitored, that would give a far better return on investment than making a post office into a fortress.

It appears to me not just a failure of physical security (making the workers vulnerable), but of a health-care system (increasing the likelihood and severity of threats).

Posted by: Davi Ottenheimer at February 4, 2006 01:22 AM

It will be interesting to see if anyone makes the connection of the threat to Ronald Reagan’s program to reduce state (and eventually federal) spending on mental health treatment. Here’s how he described it in his Dec 7, 1973 article in the National Review:

“California has pioneered the concept of treating the mentally ill with an expanded system of community mental health programs. When we started, the budget for community treatment was $18 million. This year it is more than $140 million and California’s shift from the ‘warehousing of the mentally ill’ in large state mental institutions has become a model for the nation.”

Unfortunately, it turns out that while this appears to have reduced spending is has also led to a significant decrease in security and safety:

“When then-governor Ronald Reagan closed state mental institutions in the 1960s, policy-makers anticipated that a network of community-based programs would develop to care for the mentally ill. But only a smattering of those facilities have materialized during the last three decades. In this county only 30 of these privately-run facilities provide 24-hour care to the mently disabled, leaving thousands with mental-health needs to fend for themselves. At the same time, new laws made it tougher to commit someone to the existing and meager state hospital system. California currently runs only five state mental hospitals, one of which is in Vacaville state prison. Of the 3,664 patients in state mental hospitals, the vast majority, 2,723, were placed there for criminal activity. Fewer than 1,000 Californians are held in state mental hospitals for solely medical reasons. For those who need 24-hour care but are not outwardly violent and have no police record, there are few institutions with openings, leaving patients in the care of families and communities often under-equipped to deal with them.”

Had the communities generated the programs, things might have been different. But it was a gamble and the risk of this policy appears to not only have been seriously understated but the savings up front seem to have transferred to far higher costs later on…

Posted by: Davi Ottenheimer at February 4, 2006 01:42 AM

I really enjoy Bruce’s blog, and the comments, but sometimes it feels like the market isn’t working since encryption is being ignored by the real cryptographers at the exact time when most of us need the most help with it. Instead, the market seems to be inciting him (as well as other specialists) to branch out into polisci, philosophy and economics…even a friend of mine who pioneered the use of ATM encryption is spending his time consulting on organizational risk. Strange, especially since I get more and more requests to help design and deploy identity and key management systems.

Bush brings home recession

The Financial Times has had some interesting articles recently about the challenges America is facing under the Bush Administration. They have a certain way of putting things in perspective:

President George W. Bush likes to say that his job is to confront big problems, not leave them to those who follow. As he prepares to deliver the State of the Union address he has been forced to tackle the issues bequeathed him by the man who has occupied the White House for the past five years: himself.

And when they reach a conclusion, they don’t hold back. Here is their assessment of the Bush administration’s economic policies:

There is only one end to this scenario: higher interest rates. A vigilant Federal Reserve Board will have to boost rates to suppress demand, just as during the Johnson administration. The pressure for higher rates will be even greater given the forthcoming retirement of Alan Greenspan as Fed chairman. His replacement will need to convince financial markets that the Board remains determined to keep inflation in check. The consequences will be a slowdown or worse.

As the rebuilding effort slows, high interest rates and high gasoline prices may pull the economy into recession. Like President Johnson, President Bush took a chance and lost.

So the next question might be how the Defense Department can rephrase the term “lost” into something more palatable. The “Information Operations Roadmap” mission suggests that they are actively spreading propaganda abroad and even at home:

Perhaps the most startling aspect of the roadmap is its acknowledgement that information put out as part of the military’s psychological operations, or Psyops, is finding its way onto the computer and television screens of ordinary Americans.

Or maybe the question should be why the US federal government now represents a giant funnel of money to rather specialized interests. The Economist, aside from making fun of Senator Grassley for the Iowa rainforest boondoggle, hints at the real problem:

Lobbyists are not the disease, merely the symptom. Their numbers (in Washington) have doubled in the past five years, to 35,000, because federal spending has grown larger and more wasteful. Earmarks have proliferated under the Republicans, from 1,439 in 1995 to 13,997 last year.

Voltaire Day

There should be one if there isn’t already. And unless someone objects, today seems like as good a day as any to celebrate the brilliance of his words, most of which I find useful in meetings about risk:

    “No snowflake in an avalanche ever feels responsible.”

    “Doubt is uncomfortable, certainty is ridiculous.”

    “Judge a man by his questions rather than by his answers”

    “The more I read, the more I meditate; and the more I acquire, the more I am enabled to affirm that I know nothing”

    “It is forbidden to kill; therefore all murderers are punished unless they kill in large numbers and to the sound of trumpets” (a softer variation is that some think it’s ok to write buggy code if you write so much of it that your pride and profit keep it going in spite of inefficiency and harm)

    and finally, with regard to today’s news that the FTC has fined ChoicePoint $15 million…

    “Every man is guilty of all the good he didn’t do.”

Here’s to Voltaire and to his role in the age of Enlightenment!

He was a poet’s poet:

Understand idleness better. It is either folly or wisdom; it is virtue in wealth and vice in poverty. In the winter of our life, we can enjoy in peace the fruits which in its spring our industry planted. Courtiers of glory, writers or warriors, slumber is permitted you, but only upon laurels.

Perhaps Rousseau Day will be next?


Himawari LightI think this is brilliant (pun intended). It reminds me of the concept of armored spaces that protect the inhabitants while retaining visual/light capabilities, but this adds in a component of also powering itself. Plain glass windows have been ok, but they clearly have drawbacks (ok, sometimes the puns just jump out). In this case the UV is blocked by walls, while a solar panel collects energy and glass fibers distribute the light. So, fiberlight (plus video) should provide a radical reduction in risks while maintaining many benefits from windows.

Wonder what Milton would have said about this fine use of talent to produce technology that might protect those who speak out in favor of a republic and against the supreme executive (e.g. he feared he “lost his light” because of writings like “the Tenure of Kings and Magistrates” and his support of Cromwell)…

When I Consider How My Light Is Spent
by John Milton (1608-1674)

    When I consider how my light is spent
         Ere half my days in this dark world and wide,
         And that one talent which is death to hide
         Lodged with me useless, though my soul more bent
    To serve therewith my Maker, and present
         My true account, lest he returning chide,
         "Doth God exact day-labour, light denied?"
         I fondly ask. But Patience, to prevent
    That murmur, soon replies: "God doth not need
         Either man's work or his own gifts: who best
         Bear his mild yoke, they serve him best. His state
    Is kingly; thousands at his bidding speed
         And post o'er land and ocean without rest:
         They also serve who only stand and wait."

Pirates and Terrorists

US Warship tracks Somali Pirates Recent events in the waters off the Somali coast are probably a sign of things to come. Pirates there have been a serious problem for many years (although historically dwarfed by the waters near Indonesia or even Nigeria), and the modern Navy has tended to only intervene and respond to civilian vessels after a mayday. This means that the Pirates are essentially taking the opportunity to attack highly vulnerable and ill-prepared victims.

The main difference between pirates and terrorists seems to be that the latter is motivated by some political mission, whereas the former are just hoping to increase their wealth by force (motivated by greed). When we heard about the cruise ship that was hit with an a RPG, but managed to repel the attackers with a loud noise, we were led to believe there were just pirates afoot (and not internationally funded criminal syndicates with a political agenda).

While that’s likely, one has to wonder at what (economic) point does the market for pirates give way to the politics of terrorists? Al Qaeda, of course, has been rumored to be discussing the use of vessels, including large fuel tankers, at sea in the same fashion as they had used airplanes on 9/11. Makes sense that they would discuss any vehicle under the sun given the nature of suicide bombing and the need to rapidly and discreetly “insert” themselves into a civilian zone.

Relative spatial density of reported pirate incidents in the Gulf of Aden for 2008
Therefore, if the threat of pirates increases far enough and ships remain vulnerable, eventually terrorists will make the glaringly obvious connection. The question then becomes whether countermeasures will be able to detect and prevent sufficient numbers of attacks to catch all those that might be linked to terror motives, and whether the root cause should/can be addressed rather than the symptoms.

I picked up a morsel of news several months ago that SEALs were actively training to rescue a large ship that had been commandeered in the Indian Ocean. The shipping company decided to pay a ransom (e.g. pirate motives were satisfied) rather than have the US military take it back by force. It’s hard to say more without the full details but it seems lucky to me that all those attackers wanted was money. My guess is the Navy was thinking the same thing, and the Seals were probably extremely disappointed in having their mission cancelled, so it’s no surprise to now hear in the mainstream press that US warships have started engaging the threat more and more proactively. The AP report regarding the latest Somali case notes that:

The Churchill is part of a multinational task force patrolling the western Indian Ocean and Horn of Africa region to thwart terrorist activity and other lawlessness during the U.S.-led war in Iraq

“Thwart terrorist activity and other lawlessness” is exactly what I am talking about. Does this mean the US Navy is now set to enforce the law in International waters? And do they need to mention multinational forces and the Iraq war in order to justify enforcing the law? The article also mentions “The Navy said it captured the dhow in response to a report from the International Maritime Bureau in Kuala Lumpur on Friday…” but it remains to be seen why this pirate ship in particular was of interest to the US Navy and why this is making mainstream news.

Beyond the threats of lawlessness, we still must face the general issue of vulnerability of ships. Although I’ve seen some improvements, I have to say that things like electrified fences have serious draw-backs. Aside from falling into one yourself, it is a single control point and rather prone to failure (electricity is not plentiful or reliable at sea) as well as somewhat easy to work around (attackers might just move on to the next vessel, but if they are everywhere what would stop them from just developing insulation/shorting equipment?). While naval engineering has made great strides in making boats more seaworthy, this has not translated into innovation in private boating anti-piracy measures. When you think of the boating industry in general, do consumers want to spend money on teak fittings, extra shipping capacity, or surveillance cameras and ammunition? Thus, I think the best answer today actually is a reduction in threats, which means that (multi)national forces will have to find ways to cooperatively police the International waterways before the path of the pirates is joined by terrorists. I hate to say it, but it reminds me of the “great Naval powers”…what would Admiral Nelson do?

Attacks by country

2019: Updated to add UNOSAT maps to replace deprecated links

Security Slogans: Ctrl-Alt-Del when you leave your seat

Few of us are probably lucky enough to invent something as contagious as a Security-Tubby or a Barney character. Instead, we are stuck with the task of creating “fun” posters with slogans.

One of my more successful ones so far has been based on the saying “Ctrl-Alt-Del when you leave your seat”.

People tell me that no matter how rediculous they might find security slogans at first, eventually this one grows on them and they can’t help but sing it aloud when they leave the office. You know you have won over your users when they start to beg for more effective ways to comply with the “Ctrl-Alt-Del song”.

I usually give them a tip like the following:

Although a screen lock button is already provided in most X distros, including Linux, Windows folks are usually in need of a shortcut. They’re simple to create with the following command:

%windir%\system32\rundll32.exe user32.dll,LockWorkStation

Then change the icon to something that looks like a “lock”. The orange key seems most popular among XP users (consistency helps the helpdesk) and can be found in the following library:


Lock Workstation Icon

Just put the button wherever convenient (desktop, taskbar, start, etc.) Although the setup is easily scripted and deployed over the network, sometimes it is best to hand it out to all your users like a present during the holiday season — “Security wishes you a safe and secure holiday. We hope you enjoy this new button.”

And believe it or not, people who start using this button will still say “hey, I did the Ctrl-Alt-Del thing, go check my screen”, even though they no longer are touching the keyboard when they step away. Ah, the power of security slogans.

loose lipsUnfortunately not all slogans are as catchy. Messages from security easily get lost in the sea of information users have to process every day and most of the other material they hear is so polished that phrases like “don’t get hooked by phishers” tend to blend right into the wallpaper. Thus, I believe the world of security would be far better off if more wordsmiths and poets were employed to craft our message, perhaps even at the state or federal level. Nothing too fancy would be necessary as the slogans that always seem to do best are the simple ones — “loose lips might sink ships”.

America and the Con

While I was reading about the history of the Hart-Rudman national security commission (sometimes also known as Hart-Gingrich or the Hart-Rudman-Gingrich), I ran into an interesting Weekly Standard article (Issue 35, May 29, 2000) by Tom Donnelley. Donnelly was deputy executive director of the Project for the New American Century at the time. This is the same organization that has tried to make a case for the President’s search for WMD in Iraq as late as April 2005, so bear with me. (Note: for a more realistic conservative’s view of the WMD debate, check out the book “State of War: The Secret History of the CIA and the Bush Administration”)

Donnelly called his article in 2000 “Newt Gingrich’s Last Boondoggle” and he gave a fascinating look at the beliefs of the group that ultimately pressured the President into invading Iraq. Note that this article was published before Bush took the reigns of the country by an order of a conservative federal Supreme Court, so the reasoning expressed in the article illustrates why/how Bush could have began his term buoyed by the lofty dream of absolute US hegemony.

For example, Donnelly very harshly criticizes Hart and Rudman for arguing “that American strategy must ‘compose a balance’ between the goals of freedom and stability.” Donnelly suggests that trying to strike such a balance in the world would be meaningless as the concepts of right and wrong can be easily judged by America and the resulting policy would be one of struggle against evil, not some kind of compromise:

But in a world where so many nations remain ruled by dictators, liberty and stability are often at odds. How, for example, is the United States to “compose a balance”? between liberty and stability in China? If stability reigns, so will the Chinese Communists. If America works to advance freedom in China, there will almost certainly be turmoil.

Make no mistake about it. That is a policy of destabilization meant to allow control of a country’s future by whomever is strong and big enough to fill the vacuum. It is the same means-justify-the-end argument used throughout the Cold War, coupled with the idea that it is far better to err on the side of right-wing economics than go for something undefined in the middle that might be susceptible to the left. Donnelley was arguing that the Cold War did not really end; it just changed a little and there was an adversary with a different flag. Thus his reasoning was probably that the US would be foolish to miss their opportunity to take a seat at the head of the table and assert themselves again as a moral authority through some kind of deontological ethics. He then indicates that no compromise or collaboration with other countries is necessary when you have the kind of superiority demonstrated by the success in cold war conflicts:

The report disavows the habits of leadership, power, and principle that unexpectedly won the Cold War. Alas for Hart and Rudman, these strategic habits may be hard to break—and since they made America into history’s “sole superpower,”? some will wonder why they need breaking.”

It is almost as though if you have been right once, you will be right again no matter what the situation. However, while the US might have “won” a superpower conflict when the primary adversary stood down, that does not translate directly into unquestionable control of the remaining geopolitical affairs. This is the crux of the mistake made by think-tanks like Project for the New American Century. The situation was not like one of the Rocky movies where a heroic fighter beats the odds is left standing in a ring over the dispirited opposition. Quite the contrary, while one particular risk became lessened other high-risk security issues became more critical; threats and vulnerabilities changed so the overall risk equation shifted but still needed to be heeded. Even Tom Clancy’s writing was tapping into this philosophy by the late 1990s (Rainbow Six, Rogue Spear), which reflected that the military establishment itself could see engagements ahead would require a more indigenous, sophisticated and delicately balanced response than that of giant missle defense systems and Big Red One rolling over and occupying vast expanses of foreign territory. Goodbye John Wayne, hello Mr. Bond (or Alpha team), you might say.

The risk algorithms of national security and international relations were clearly evolving in a way that many, including Hart-Rudman, could see. So, by the summer of 2001, intelligence and anti-terrorism experts were literally yelling into the ears of the Bush Administration that Hart-Rudman’s recommendation of “a finer calculus of benefits and burdens” really would be necessary. Richard Clarke’s “roll back” presentation suggested a strategy for the US to strike right at the heart of al Qaeda training camps and put the terrorist group on warning in February 2001. Yet the Bush Administration walked away from the table announcing they were going to handle things the old-fashioned way, on their own timeline and without interference.

It really boiled down to the desire for a new policy founded on a concept of shared balance and co-existence versus the old policy of total elimination. Nuance versus hubris. Many suggest that the elimination policy group was bolstered by the events during the Reagan administration that led to the unexpected change in the policy of the USSR. But this “proof” of the policy had more to do with timing and admission of failure rather than the success of any direct assault or overwhelmingly powerful US strategy. Some could say that the US outspent the Soviets, but even that was hard to prove. It was like the countries were drag-racing and the US won because the other car ran out of gas or had a mechanical failure, but the Reagan administration walked away believing they were the better driver. Thus an elimination policy group formed and believed that unilateral leadership based on superior moral ground (like Kant’s categorical imperative) had won a war during their watch. Moreover, they believed that this success needed to be further capitalized upon or lost forever. Some were so caught up in this dream-like state that they were offended by any suggestion of uncertainty about the state of US supremecy. Lynne Cheney, wife of Dick Cheney, found the reality of geopolitical issues so threatening that she simply resigned from the commission in protest:

Cheney was unhappy with the suggestion that American power was bound to decline: “Emerging powers will increasingly constrain U.S. options regionally and limit its strategic influence. As a result, we will remain limited in our ability to impose our will. . . .”?

The irony is almost too thick to avoid. The ex-Regan administration member Cheney resigned because she could not deal with reality. The only alternative, impose her view on those who recognized the new security risks ahead, must have been unsuccessful and so she quit the team. It is only logical that she and her husband from that point onward were planning to deep-six the recommendations of the final report and knew what to do when it was handed to the Bush Administration in 2001. Incidentally, during the 9/11 events she was reported to have turned down the offical debreifing from the anti-terror task force so she could hear the reports from CNN.

At the end of the day it was an uncompromisingly myopic stance of the Bush Administration coupled with the inability to process information about the real and present dangers to the country that arguably precipitated the ease with which al Qaeda staged their attack on 9/11 — Osama’s minions did not fit the image of what the Bush Administration, and the Cheney couple in particular, were willing or able to accept as a credible threat. They therefore not only fumbled the job of understanding risk, but they ignored and actively distanced themselves from the voices that tried to raise alarm before disaster struck. Like a heavy-weight fighter brushing off idea that bar-room punches of a welter-weight were of any concern, the Bush Administration didn’t understand that the inauspicious new adversaries not only had motive, but the means to do serious and lasting damage.

In conclusion, and unfortunately for the US, a series of ill-conceived security decisions by the Bush Administration were made based on a tired and romantic view of a world that probably never really existed. Six years later the world is left to hope that the Bush Administration has started to realize, as Gorbachev once did, that the value concept of a giant conventional superpower could be long past its shelf date. The idea of imposing unilateral will by generating endless turmoil abroad today does in fact exhaust a powerful nation, even America, and can actually end up eroding the base of power and undermining relationships. It was easy to see how this policy would lead to a quagmire of undesireable and taxing battles on multiple fronts where success would come only by lowering expectations. Do the American leaders today have the strength to admit the mistake and swallow their pride? Unlikley. And so the real danger now is that leaders, facing the exhaustion of their nation, may forgoe the high road of true democracy by becoming accountable and instead choose the path of desperation — quick fixes intended to create the illusion of success at any cost, without regard for the true damage they may cause to their country and its freedoms.

Why Christmas is a holiday

Because congress adopted a federal holiday on June 26, 1870. Simple.

Why, you ask?

Well, it had an inauspicious beginning in the country. It was so controversial (decadent) in the 1700s that it was actively banned by Puritains, including those who left England to settle the early American states. Perhaps more importantly it was shunned by the Founding Fathers since it was considerd an English tradition and irrelevant to the observance of religion. Alas, Digital History suggests by the early 1800s Christmas in America had become just another famously drunken, lewd and riotous event, rivaling the decadence of old King Charles’ England:

But despite the Puritans’ best efforts, Christmas in America became an excuse for dangerous hell raising. At Christmastime, men drank rum, fired muskets wildly, and costumed themselves in animal pelts or women’s clothes – crossing species and gender. In New York, Philadelphia, Baltimore, and other cities, they formed Callithumpian parades, which involved beating on the kettles, blowing on penny trumpets and tin horns, and setting off firecrackers.

Sounds like a blast, no? Well, the fun obviously never lasts forever and so things eventually came to a head when, according to the History Channel, the effects of Christmas coupled with a rise in poverty and class conflict of the early 19th Century gave concern to those who were in power:

In 1828, the New York city council instituted the city’s first police force in response to a Christmas riot. This catalyzed certain members of the upper classes to begin to change the way Christmas was celebrated in America.

The new message was that people should stay home, sit by a fire, and drink and eat themselves senseless instead of partying outside with others. And so, out of the political discord of 150 years ago we can today say thank you to the federal government for inventing a national tradition and opening the door for America’s two great factions, corporations and religions, to fight over control of the “real” meaning of this holiday.

Nast's Santa
Thanks should also go to Thomas Nast, arguably the father of modern American political illustration, for creating the modern American image of Santa Claus during the Civil War…it might be worth noting that Santa was always pro-Union and anti-slavery.

Oh, and why December 25th? Apparently Pope Julius I wanted something to compete with the popularity of the festival “Saturnalia”, and probably found it most convenient to just rebrand the pagan holiday with a new name. Merry Saturnalia had a bad ring to it, I guess (especially since the word implied an “inversion of order” instead of something Christ-like).

Personally, I think the holiday should be celebrated on June 26th before someone starts another winter riot over the latest must-have expression of modern faith, like an XBox.

Historians rate the US presidents

I’ve been writing too many comments again on Schneier’s blog lately, so I thought I’d post a few interesting things here instead. This article from the History News Network caught my attention with some interesting insights into the risks from various Presidents and how they stack up from a historian’s point-of-view:

The George W. Bush presidency is the worst since:
In terms of economic damage, Reagan.
In terms of imperialism, T Roosevelt.
In terms of dishonesty in government, Nixon.
In terms of affable incompetence, Harding.
In terms of corruption, Grant.
In terms of general lassitude and cluelessness, Coolidge.
In terms of personal dishonesty, Clinton.
In terms of religious arrogance, Wilson.

And then there are the oft-cited Bush quotes that give another perspective on how some might use his own words to conclude he may be worse than so many of his predecessors:

“You don’t get everything you want. A dictatorship would be a lot easier.”
— From Paul Begala’s “Is Our Children Learning?”, Governing Magazine July, 1998

“If this were a dictatorship, it would be a heck of a lot easier, just so long as I’m the dictator.”
—, December 18, 2000

“A dictatorship would be a heck of a lot easier, there’s no question about it.”
— Business Week, July 30, 2001

Judge upholds intelligence in schools, strikes down school board liars

The BBC reports that a Judge in Pennsylvania has questioned the integrity of ID proponents and struck down their attempt to inject creationism into science curriculums at school:

Judge Jones said he had determined that ID was not science and “cannot uncouple itself from its creationist, and thus religious, antecedents”.

Citizens had been “poorly served” by members of the school board who voted for the ID policy, he said.

“It is ironic that several of these individuals, who so staunchly and proudly touted their religious convictions in public, would time and again lie to cover their tracks and disguise the real purpose behind the ID policy,” he said.

“We find that the secular purposes claimed by the board amount to a pretext for the board’s real purpose, which was to promote religion in the public school classroom.”

Religious extremists misrepresenting their true objectives? Impossible. My favorite comment from the BBC peanut gallery is from someone who claims to be from the US:

U.S. school students are falling behind their peers in developed countries in science and mathematics. Therefore, U.S. schools need to intelligently redesign their science curriculums not teach intelligent design as science.

Well said!