Diamondeye wrote:
My reaction whenever anyone ever mentions him? That's very interesting, because I've never even heard of him before, and I don't recall anyone mentioning him around here at all.
Diamondeye wrote:
For the moment I'll choose to assume you're confusing me with someone else, or otherwise are simply misremembering. I'm sure you wouldn't just make up a history of me flipping out about I guy I can't recall ever discussing before.
I apologize. Apparently this is the case. I would have
sworn you were involved in some big stink about him in the last thread about the TSA where he was mentioned; I thought it was either the backscatter thread or the one about NJ resisting the TSA. But apparently I just dreamed that, or something. I honestly can't explain why I thought that was the case, because I'm not finding anything like that, even by some other poster.
Diamondeye wrote:
Furthermore, you all seem to be ignoring two important aspects of the definition of
security theater":
<stuff>
Well, "security theater" definitely isn't a rigorously defined term, so I'm not sure you can really call that an aspect of its definition. But that's a mostly irrelevant aside. What you've quoted was based on an editorial by Peter Glaskowsky, based on a lecture by Schneier, based on
The Psychology of Security, an essay that he wrote a few years ago. I actually more or less agree with what Glaskowsky is saying, but the wiki blurb is not a very good reflection of what either Glaskowsky or Schneier were trying to say to about the possible merits of security theater. To add my own emphasis, this is the issue with the wiki summary:
Quote:
While it may seem that security theater must always cause loss, it may actually be beneficial, at least in a localised situation. This is because perception of security is sometimes more important than security itself.[7] If the potential victims of an attack feel more protected and safer as a result of the measures, then they may carry on activities they would have otherwise avoided. In addition, if the security measures in place appear effective, potential attackers may be dissuaded from proceeding or may direct their attention to a target perceived as less secure. Unsophisticated adversaries in particular may be frightened by superficial impressions of security (such as seeing multiple people in uniform or observing cameras) and not even attempt to find weaknesses or determine effect.
Nothing the summary is saying is
wrong, it just fails to explain exactly what those "localised situations" "may" "sometimes" be. And in the case of the long sentence I've underlined, completely omits any mention of context, as though encouraging people not to avoid activities is just universally beneficially. That's not a nitpick -- the issue of context is a large and essential elemental of the essay.
To be more specific, what Schneier was trying to say (and Glaskowsky was "seconding"), is that there are many situations where people are actually quite secure but
feel that they are not. Defining exactly what is meant by being "actually secure" is a little tricky, but mathematically you can look at it simply as the product of risk (probability of harm) and the cost/magnitude of that harm. An example that Schneier gave in the lecture that Glaskowsky attended was the "Tylenol crisis" in 1982. Not to make light of 7 people being murdered, but people developed an irrational fear of OTC medication as a result. And by that, I mean a change in their behavior that was far out of proportion to the actual security (as defined above) of the situation.
In these kinds of situations (and only in those situations), a bit of
inexpensive security theater is theoretically beneficial. The wiki summary does a poor job of conveying that context.
Secondly, there is a less contextual argument to make regarding security theater: that it might be psychologically deterring (under any circumstances) to the low-hanging fruit. And, therefore, it might have a slightly larger effect on real security than a direct analysis would suggest. Fair enough. However, such as this may be the case (that depends on the specifics), it's important to appreciate that this argument is only saying that security theater would be more effective than nothing at all, not that it would be more effective than real security. And it's equally important to understand what the argument
isn't saying. It's not saying that security theater is necessarily even
worthwhile over nothing at all -- just that it might provide more real security.
Diamondeye wrote:
It seems that [security theater's] ... pejorative use is simply a way to discount both its deterrent and actual effects based on nothing more than an unstated implication that this somehow makes it worthless.
Diamondeye wrote:
and despite [Mr. Schneier's] unflattering comments on the TSA, their sometimes absurd behavior regarding specific threats does not mean they provide no security whatsoever.
It may not have been communicated very well, but I don't think this is really what anyone here is intending to say. And I'm quite sure it's not what Schneier thinks, either. One of his recurrent themes is trade-offs: that every increase in real security has an associated real cost. You can't get something for nothing, as they say. "Cost", in this context is deliberately vague. It may a direct economic cost of implementing the measures that increase real security, cost in terms of lost freedom, cost in terms of lost convenience, etc. Whether something is worthless or worthwhile is simply a question of whether you think the trade-off is a good one.
So you're quite right that being security theater doesn't automatically make something worthless. If we value whatever little effect it might have on real security more than we value what we gave up to obtain it, then it has worth at least in a literal sense. But as Schneier emphasizes in the essay, the core problem is that humans are really bad at making modern day security trade-offs. Or to be more accurate, we're really good at understanding costs -- which is half of the trade-off equation, and one of the two key components of security (cost of failure) -- but horrendously bad at estimating odds.
Schneier wrote:
Why is it that, when food poisoning kills 5,000 people every year and 9/11 terrorists killed 2,973 people in one non-repeated incident, we are spending tens of billions of dollars per year (not even counting the wars in Iraq and Afghanistan) on terrorism defense while the entire budget for the Food and Drug Administration in 2007 is only $1.9 billion?
[...]
Most of the time, when the perception of security doesn't match the reality of security, it's because the perception of the risk doesn't match the reality of the risk. We worry about the wrong things: paying too much attention to minor risks and not enough attention to major ones. We don't correctly assess the magnitude of different risks. A lot of this can be chalked up to bad information or bad mathematics, but there are some general pathologies that come up over and over again.
In Beyond Fear, I listed five:
- People exaggerate spectacular but rare risks and downplay common risks.
- People have trouble estimating risks for anything not exactly like their normal situation.
- Personified risks are perceived to be greater than anonymous risks.
- People underestimate risks they willingly take and overestimate risks in situations they can't control.
- Last, people overestimate risks that are being talked about and remain an object of public scrutiny.1
Here's my point: I think that for the most part, the specific Gladers that are criticizing TSA procedures for being "security theater" are familiar with all this. The criticism isn't intended to be: "This is security theater, and therefore bad, and we should just get rid of it entirely". Rather...
I think it's a pretty universally accepted truth that the cost of the TSA procedures (i.e., the procedural changes since 9/11) is high. That's cost in dollars, time, convenience, freedoms, dignity, etc. There might be (even considerable) disagreement about the individual components or how much we value them, but I don't think very many people would disagree that the sum of all of them is considerably large. There's nothing necessarily wrong with that. It's a good trade-off if these changes produce an equivalently large increase in our real security. But if not -- if the changes are an example of security theater -- then this a poor trade-off indeed. When people criticize the procedures for being "security theater", this is what they're trying to point out, not that security theater is automatically bad.
Diamondeye wrote:
If you want to argue that A) this is the effect of the TSA and B) it is not worth the money, then by all means do so. At 1.2 billion a year that is likely a defensible position.
In other words, basically this. It's not just that it's theater, but that it's theater with a very high cost of admission. It may not be "worthless", but it's not worthwhile. We're caught up in exactly the kind of psychological trap that Schneier was describing above: spectacular, abnormal, uncontrollable risks that receive huge amounts of attention. And it's making us accept increasingly stupid counter-measures because we believe that we're getting more out of them than we really are.