Crypto-Gram 0509

Bruce Schneier's latest Crypto-gram is available, packed with his usual common sense about security, like Movie-Plot Threats

"Sometimes it seems like the people in charge of homeland security spend too much time watching action movies. They defend against specific movie plots instead of against the broad threats of terrorism...

One problem is that our nation's leaders are giving us what we want. Party affiliation notwithstanding, appearing tough on terrorism is important. Voting for missile defense makes for better campaigning than increasing intelligence funding. Elected officials want to do something visible, even if it turns out to be ineffective.

The other problem is that many security decisions are made at too low a level. The decision to turn off cell phones in some tunnels was made by those in charge of the tunnels. Even if terrorists then bomb a different tunnel elsewhere in the country, that person did his job.

And anyone in charge of security knows that he'll be judged in hindsight. If the next terrorist attack targets a chemical plant, we'll demand to know why more wasn't done to protect chemical plants. If it targets schoolchildren, we'll demand to know why that threat was ignored. We won't accept "we didn't know the target" as an answer. Defending particular targets protects reputations and careers.

We need to defend against the broad threat of terrorism, not against specific movie plots. Security is most effective when it doesn't make arbitrary assumptions about the next terrorist act. We need to spend more money on intelligence and investigation: identifying the terrorists themselves, cutting off their funding, and stopping them regardless of what their plans are. We need to spend more money on emergency response: lessening the impact of a terrorist attack, regardless of what it is. And we need to face the geopolitical consequences of our foreign policy and how it helps or hinders terrorism.

These vague things are less visible, and don't make for good political grandstanding. But they will make us safer. Throwing money at this year's movie plot threat won't."