[00:00.190 --> 00:12.870]  I went to Home Depot to pick up some kind of something, and there were literally pallets of duct tape by the front door with people, looks on their faces like the world was coming to an end.
[00:14.430 --> 00:18.110]  Our next panel is security, liberties, and trade-offs in the war on terrorism.
[00:18.530 --> 00:20.530]  Maybe you can talk about the duct tape conspiracy.
[00:22.850 --> 00:25.390]  This is security expert Bruce Schneier.
[00:26.830 --> 00:29.190]  He's an author of Beyond Fear, Cryptogram.
[00:29.510 --> 00:31.170]  It's a newsletter in Secrets and Lies.
[00:31.690 --> 00:32.410]  Take it away.
[00:41.140 --> 00:42.140]  Thanks for having me back.
[00:43.100 --> 00:47.520]  I was at the first HOPE when you were at some, I don't know, weird-ass armory-type building.
[00:49.020 --> 00:51.220]  It's nice to be back after a bunch of years.
[00:51.720 --> 00:55.520]  I guess, I feel like I'm here to explain the world.
[00:57.420 --> 01:00.300]  We live in what I call the silly security season.
[01:00.520 --> 01:05.480]  There's a lot of stuff that's going on that fundamentally makes no sense.
[01:05.620 --> 01:10.880]  And as a security guy, you can wander around and you wonder, you know, what's going on here?
[01:11.720 --> 01:14.860]  And what I want to talk about is what's going on here.
[01:15.240 --> 01:19.660]  Because to me, when something doesn't make sense, it means we just don't understand it properly.
[01:19.660 --> 01:26.100]  And if we can make that make sense, we can figure out what's going on and figure out how to do it right.
[01:26.340 --> 01:27.760]  Because there's a whole lot of doing it wrong.
[01:28.780 --> 01:34.140]  And this is work that I just developed in my latest book, Beyond Fear.
[01:34.140 --> 01:39.080]  A lot of stuff in this talk that's beyond that because the book came out, you know, about several months ago.
[01:39.440 --> 01:41.160]  Some of the stuff I've written about in Cryptogram.
[01:41.420 --> 01:44.600]  And some of the stuff I will be writing about it in the months to come.
[01:47.040 --> 01:53.600]  So, I guess the two-sentence takeaway for this talk is security is always a trade-off.
[01:53.780 --> 01:55.600]  There's no such thing as absolute security.
[01:56.220 --> 01:58.700]  This is actually really obvious.
[01:59.240 --> 02:00.600]  We all know this.
[02:00.740 --> 02:06.660]  It doesn't seem to get to our national policy level, but it's something that we all know.
[02:07.500 --> 02:10.000]  That you really can get as much security as you want.
[02:10.260 --> 02:12.240]  It depends what you're willing to give up to get it.
[02:13.260 --> 02:21.380]  You know, an easy example is, in the months after 9-11, a reporter asked me in an interview, how can we prevent this from ever happening again?
[02:21.940 --> 02:23.100]  And I said, well, that's easy.
[02:23.120 --> 02:24.100]  Just grab all the aircraft.
[02:26.040 --> 02:32.500]  Now, that makes... it's a solution that works, although, you know, it makes no sense.
[02:32.500 --> 02:34.360]  The trade-off isn't worth it.
[02:34.760 --> 02:40.220]  But if you think about it, in the hours and days after 9-11, that's exactly what the U.S.
[02:40.280 --> 02:40.460]  did.
[02:41.020 --> 02:46.140]  We had no idea the magnitude of the attacks, where they were coming from, what they entailed.
[02:46.400 --> 02:50.980]  So, grounding all the aircraft was a perfectly reasonable security trade-off.
[02:51.320 --> 02:53.100]  Even though, day-to-day, it's not.
[02:54.200 --> 02:58.120]  So, you have to keep remembering that, that security is always a trade-off.
[02:59.040 --> 03:01.380]  It's what you get versus what you give up.
[03:01.680 --> 03:07.220]  And the metaphor I like to use is that you are, all of you, security consumers.
[03:08.380 --> 03:13.440]  And the question to ask is not, will this thing make us more secure?
[03:13.880 --> 03:17.320]  The question to ask is, is this thing worth it?
[03:17.840 --> 03:21.140]  Is the security you're getting worth what you're giving up?
[03:23.340 --> 03:26.660]  As a security consumer, are you getting a good deal?
[03:27.240 --> 03:29.360]  Is it a good use of your security dollar?
[03:29.580 --> 03:33.960]  We're spending, what, a couple hundred billion dollars fighting terrorism in this country?
[03:34.160 --> 03:38.300]  Are we actually getting a couple hundred billion dollars worth of terrorism protection?
[03:38.760 --> 03:40.740]  If we're not, we're being roped.
[03:42.680 --> 03:44.540]  If we are, well, that's a good thing.
[03:46.180 --> 03:48.860]  I'll give you an easy example of this, a bulletproof vest.
[03:49.760 --> 03:50.160]  Right?
[03:50.160 --> 03:51.200]  Bulletproof vests work.
[03:51.520 --> 03:54.240]  But, you know, my guess is that no one in the audience is wearing them.
[03:54.860 --> 03:55.180]  Right?
[03:55.180 --> 03:56.860]  It's not because they're not effective.
[03:57.040 --> 03:59.320]  It's because it's not worth the trade-off.
[03:59.640 --> 04:00.040]  Right?
[04:00.040 --> 04:03.000]  The trade-off in money, the trade-off in fashion sense, convenience.
[04:03.460 --> 04:05.840]  Whatever it is you're giving up to wear a bulletproof vest.
[04:07.360 --> 04:14.440]  We decide that living in the U.S., you know, walking around New York City, it's not worth the trade-off.
[04:14.620 --> 04:15.760]  Even though they're effective.
[04:17.620 --> 04:21.560]  Now, as a security consumer, you make this decision every day.
[04:22.240 --> 04:22.640]  Right?
[04:22.720 --> 04:24.800]  When you decide whether to lock your car.
[04:26.020 --> 04:29.980]  If you're staying at the hotel and you decide whether to double lock the door or put the chain on.
[04:30.660 --> 04:32.320]  You made a security trade-off.
[04:32.320 --> 04:36.280]  Is the inconvenience, as minor as it is, worth the security you're getting?
[04:36.620 --> 04:38.400]  Some of you did, some of you didn't.
[04:39.540 --> 04:39.880]  Right?
[04:39.880 --> 04:41.020]  There's no right answer.
[04:41.180 --> 04:42.040]  Another important moral.
[04:42.860 --> 04:43.340]  Right?
[04:43.340 --> 04:45.260]  A lot of these trade-offs are subjective.
[04:45.700 --> 04:45.760]  Right?
[04:45.780 --> 04:46.920]  Money's pretty objective.
[04:46.920 --> 04:53.460]  When you get into things like civil rights and privacy and convenience and time, they're a lot more subjective.
[04:54.680 --> 04:57.840]  So, when you think of cost, think of it very broadly defined.
[04:58.380 --> 05:01.140]  And I believe most of this is common sense.
[05:02.320 --> 05:08.140]  And actually, even more importantly, it's common sense for life.
[05:08.400 --> 05:09.000]  Right?
[05:09.020 --> 05:12.280]  People have a natural intuition about these trade-offs.
[05:12.560 --> 05:13.840]  It's part of being alive.
[05:14.220 --> 05:20.460]  And every creature on this planet has this natural intuition about trade-offs.
[05:20.760 --> 05:21.120]  Right?
[05:21.180 --> 05:22.780]  So it depends how big your brain is.
[05:22.780 --> 05:26.460]  But everybody makes these security trade-offs.
[05:26.560 --> 05:29.040]  When you think of a rabbit, a rabbit sitting in a field eating grass.
[05:29.280 --> 05:30.460]  And he sees a fox.
[05:31.640 --> 05:33.780]  Now he's going to make a security trade-off.
[05:34.560 --> 05:36.160]  Should he stay or should he flee?
[05:37.300 --> 05:40.920]  And the rabbits that are good at that tend to reproduce.
[05:40.920 --> 05:46.700]  And the rabbits that are bad at that tend to either get eaten or starve.
[05:48.140 --> 05:57.540]  So as a highly successful species on the planet, we humans have a good intuition about trade-offs.
[05:59.520 --> 06:01.280]  And I think that's 100% true.
[06:01.960 --> 06:06.220]  I also think that people are hopelessly miserable at making these trade-offs.
[06:07.320 --> 06:11.580]  And there's an interesting paradox there, which it's worth poking at to resolve.
[06:12.440 --> 06:20.260]  In my latest book, Secrets Beyond Fear, I developed a five-step process for making these security trade-offs.
[06:20.260 --> 06:27.640]  The point of it, and I'm sort of not going to give it here because it's a little bit too detailed in this talk, is to make the intuition explicit.
[06:28.100 --> 06:37.380]  One of my complaints, especially things on the national stage, is there isn't a lot of coherent discussion of whether something's a good security trade-off.
[06:38.380 --> 06:45.380]  You know, whether it's airport security procedures or invading Iraq or, you know, finger-printing foreigners coming into the country.
[06:45.600 --> 06:49.060]  You don't see a lot of, is this a good trade-off types of discussions.
[06:50.260 --> 07:01.340]  So the point of taking an intuitive process and stretching it out over five steps, is to make different parties able to discuss where the differences are.
[07:02.120 --> 07:04.200]  Because I don't believe there are single right answers.
[07:04.620 --> 07:06.800]  But I do believe there have to be points for discussion.
[07:07.340 --> 07:10.580]  And the goal is, of course, to have a rational discussion instead of an emotional one.
[07:11.140 --> 07:12.740]  Which I think would help our country a lot.
[07:15.740 --> 07:19.260]  So, I said this before, security trade-offs are subjective.
[07:19.700 --> 07:21.120]  And it's important to know this.
[07:22.280 --> 07:22.680]  Right?
[07:22.720 --> 07:24.680]  There's no single answer to, is it worth it?
[07:24.840 --> 07:26.960]  An easy example is a home burglar arms system.
[07:27.420 --> 07:27.800]  Right?
[07:27.820 --> 07:29.420]  Some of you have one and some of you don't.
[07:30.060 --> 07:31.460]  No one's right or wrong.
[07:31.800 --> 07:32.900]  It'll depend on a bunch of things.
[07:32.920 --> 07:33.120]  Right?
[07:33.140 --> 07:34.160]  What neighborhood you live in.
[07:34.620 --> 07:36.400]  Whether you live alone or have a family.
[07:36.640 --> 07:38.620]  How much expensive stuff do you have?
[07:40.020 --> 07:44.900]  Are you willing to be inconvenienced by having to turn on and off the alarm every day?
[07:46.140 --> 07:48.360]  How risky you perceive your neighborhood to be?
[07:48.820 --> 07:51.200]  How willing you are to live with that risk?
[07:51.440 --> 07:54.100]  And some of us live in risky neighborhoods and don't even worry about it.
[07:54.780 --> 07:57.840]  Other of us are scared to live even in good neighborhoods.
[07:59.300 --> 08:01.500]  And so there's that subjectivity.
[08:03.180 --> 08:08.820]  And there are also, I think, some, I don't know, hard-wired subjectivities.
[08:08.940 --> 08:13.060]  These hard-wired discontinuities between actual risk and perceived risk.
[08:14.160 --> 08:19.060]  And, you know, I'm trying to peel apart why we're so bad at making these trade-offs.
[08:20.960 --> 08:22.460]  I list six of them in the book.
[08:22.560 --> 08:23.520]  I'm not going to do them here.
[08:23.940 --> 08:37.180]  But I think there are things that serve us well as a, you know, as a species living, you know, in the jungle, on the plains, in the savanna, that don't serve us well in a technological urban community.
[08:38.500 --> 08:42.080]  And they have to do with the strange versus the familiar.
[08:42.960 --> 08:45.000]  Things we control versus things we don't control.
[08:45.000 --> 08:49.880]  I mean, things that evolutionary served us well, but don't really serve us well in society.
[08:50.120 --> 08:54.340]  There are actually two important differences I want to focus on here.
[08:57.940 --> 08:59.460]  Oh, there it is.
[09:01.220 --> 09:05.480]  That I think really make it hard for people to make good security trade-offs.
[09:05.620 --> 09:07.100]  They're technology and the media.
[09:07.780 --> 09:11.680]  And I think what they do is they change our input.
[09:12.420 --> 09:16.020]  People make security trade-offs based on what they perceive.
[09:16.460 --> 09:17.540]  Fire is hot.
[09:18.800 --> 09:20.360]  Speeding cars are dangerous.
[09:21.820 --> 09:24.220]  We know that based on our sensory input.
[09:24.900 --> 09:36.120]  And what the media does, very interesting, is the media exaggerates the spectacular and rare and downplays the commonplace and pedestrian.
[09:36.120 --> 09:39.960]  So, I often tell people, if it's in the news, don't worry about it.
[09:40.220 --> 09:43.540]  By definition, if it's in the news, it almost never happens.
[09:44.740 --> 09:47.760]  But when something is not in the news, then you worry about it.
[09:48.540 --> 09:51.400]  Which is why people are afraid to fly and not afraid to drive.
[09:52.700 --> 10:01.160]  Which is why people are afraid of random strangers sneaking into their house and kidnapping their children, and not afraid of relatives and friends.
[10:02.000 --> 10:04.000]  People don't get where the risks are.
[10:05.220 --> 10:09.260]  Because the media exacerbates things that almost never happen.
[10:09.460 --> 10:11.280]  So we think they're going to happen all the time.
[10:11.780 --> 10:17.960]  A lot of our response to terrorism, I think, is a direct result of the media endlessly playing that event.
[10:20.020 --> 10:22.940]  You know, eight times as many people died in car crashes that year.
[10:23.260 --> 10:24.080]  Nobody cared.
[10:24.540 --> 10:26.260]  And the year after, and the year before.
[10:26.260 --> 10:29.840]  The singular rare event gets all the attention and all the money.
[10:30.120 --> 10:34.060]  The pedestrian events, the domestic violence, doesn't get anything.
[10:35.900 --> 10:37.600]  Technology is another problem.
[10:37.880 --> 10:41.240]  And, you know, we're all computer geeks, so we see it there.
[10:42.060 --> 10:44.880]  Think of your favorite friend who doesn't get security.
[10:45.220 --> 10:46.940]  I always use my mother as an example.
[10:47.380 --> 10:51.900]  The main problem is technology obscures how things work.
[10:54.540 --> 10:58.940]  And it's very hard to make trade-offs on an opaque system, as you understand.
[10:59.900 --> 11:06.340]  This is why people have been afraid to type their credit card numbers on an SSL connection.
[11:06.820 --> 11:10.720]  But not afraid to give their credit card to a minimum wage 7-11 clerk.
[11:12.600 --> 11:14.960]  It's because the computer is strange.
[11:15.660 --> 11:19.260]  That's why cyber-terrorism is getting all this airplay.
[11:20.060 --> 11:23.960]  That's why hacking is perceived as this horrible crime.
[11:24.180 --> 11:24.780]  And it's interesting.
[11:24.920 --> 11:27.320]  It reminds me of cattle rustling in the Old West.
[11:28.260 --> 11:34.440]  It was so strange and so potentially distabling of society that the punishment succeeded the crimes.
[11:35.140 --> 11:36.740]  And you're seeing the same thing here.
[11:37.480 --> 11:41.500]  With the added problem is that what hackers do isn't understood.
[11:41.540 --> 11:43.220]  So it must be dangerous.
[11:45.100 --> 11:47.880]  But you see that with weapons of mass destruction.
[11:47.880 --> 11:52.880]  You see that with, again, risks of flying versus risks of driving.
[11:53.280 --> 11:55.340]  The technology obscures how things work.
[11:55.340 --> 11:57.320]  So people can't make good trade-offs.
[12:01.250 --> 12:03.330]  There are also differences in evaluating costs.
[12:04.110 --> 12:06.050]  We see this a lot on the national stage.
[12:06.790 --> 12:14.530]  You know, we all know that in our society, near-term costs are much more important than long-term costs.
[12:15.190 --> 12:17.630]  Even if you do the math, the net present value is the same.
[12:19.230 --> 12:22.850]  And we always like to push costs onto future years, future generations.
[12:24.830 --> 12:26.690]  Non-monetary costs are valued differently.
[12:26.830 --> 12:29.790]  In the months after 9-11, people were saying, take my privacy, please.
[12:29.970 --> 12:30.670]  Just make me safe.
[12:31.550 --> 12:40.250]  And it's only been the past few months that Americans' concerns for privacy and civil liberties have returned to their pre-9-11 values.
[12:40.950 --> 12:46.790]  There was a temporary bump where we just valued our privacy much less.
[12:51.680 --> 12:54.040]  And there are differences in whose shoulders are costs.
[12:55.300 --> 12:56.320]  This is important.
[12:56.720 --> 12:59.820]  And this is a point I'm going to come back to really strong later.
[13:00.700 --> 13:02.860]  External costs are easier to accept.
[13:03.580 --> 13:06.880]  If you don't have to pay for it, you're more likely to do it.
[13:07.060 --> 13:11.500]  If someone gives you a home alarm system, you're more likely to install it.
[13:12.920 --> 13:17.580]  If the airlines get to say, you all show photo IDs, we'll just check them.
[13:18.500 --> 13:18.980]  Right?
[13:19.200 --> 13:20.240]  They're happy with it.
[13:20.380 --> 13:21.360]  It's not their cost.
[13:21.620 --> 13:25.380]  If they had to issue their own IDs, suddenly it's different.
[13:28.040 --> 13:29.460]  Alright, so what's worth it?
[13:29.980 --> 13:37.800]  In general rules, stuff is worth it if it's commensurate with the threat, if it doesn't cost too much, and if it doesn't force us to make too many trade-offs.
[13:38.760 --> 13:40.920]  You can wander around the world and you see...
[13:41.660 --> 13:43.020]  Terrorism is always a good example.
[13:43.480 --> 13:44.920]  These are sort of things that are worth it.
[13:45.660 --> 13:49.200]  You know, airport security checkpoints, to a degree, are worth it.
[13:50.140 --> 13:52.800]  Some guards at high-profile targets are worth it.
[13:53.480 --> 13:54.890]  Well-trained immigration officers.
[13:56.460 --> 13:56.920]  Right?
[13:57.140 --> 13:59.180]  Smart guards who are doing intelligent things.
[14:00.780 --> 14:05.220]  Rolling up terrorist networks, interdicting funding, emergency response.
[14:05.520 --> 14:06.960]  That kind of stuff tends to be worth it.
[14:07.180 --> 14:09.040]  And I can give a talk as why.
[14:09.340 --> 14:10.180]  What isn't worth it?
[14:10.620 --> 14:14.740]  Things that tend not to be worth it are the stuff that costs a lot and doesn't do much.
[14:14.980 --> 14:15.260]  Right?
[14:15.480 --> 14:22.460]  National ID cards, government secrecy, anything, any broad programs or surveillance.
[14:23.480 --> 14:26.260]  You sort of do the analysis and they're not worth it.
[14:27.220 --> 14:28.660]  Color-coded alert systems.
[14:29.280 --> 14:36.300]  Everybody notice yesterday's warning that the terrorists are going to strike but we're not going to raise the threat level.
[14:36.720 --> 14:39.000]  I mean, this is all the question for reality.
[14:42.540 --> 14:43.920]  Airline passenger screening.
[14:44.280 --> 14:48.900]  And in my book, I give lots of analysis of why this stuff isn't worth it.
[14:48.900 --> 14:56.860]  But the question I want to answer here is, or at least ask and try to answer is, if so much of this stuff isn't worth it, why do we have it?
[14:58.020 --> 15:02.100]  Is it that the people in power have it completely wrong?
[15:02.700 --> 15:04.300]  Or is there something else that's going on?
[15:04.900 --> 15:06.780]  I maintain there's something else going on.
[15:07.860 --> 15:09.960]  And I try and want to explain what it is.
[15:12.680 --> 15:20.180]  Most of the time, in sort of all aspects of life, security decisions are made for non-security reasons.
[15:21.180 --> 15:25.600]  And as a security professional, it took me a good decade to get used to it.
[15:25.640 --> 15:27.540]  To figure this out and get used to it.
[15:27.680 --> 15:28.980]  Because it's annoying as hell.
[15:30.900 --> 15:38.140]  I mean, people decide whether to do security things for reasons I have nothing to do with security.
[15:38.140 --> 15:40.080]  So I'll give today's example.
[15:40.300 --> 15:44.180]  Before I came here, I was visiting a major, major bank.
[15:46.660 --> 15:51.200]  As a visitor, before I had to go in, I had to put my bag through an x-ray machine.
[15:51.420 --> 15:52.100]  And it was interesting.
[15:52.200 --> 15:57.340]  There was a guard behind a screen looking at the results of the x-ray machine.
[15:57.460 --> 16:01.400]  And people were in line putting their bag on this x-ray machine walking through.
[16:03.140 --> 16:04.860]  Now, I didn't go through a metal detector.
[16:05.800 --> 16:07.020]  So sort of problem one.
[16:07.420 --> 16:08.920]  Problem two is just fascinating.
[16:09.140 --> 16:10.780]  No one was actually watching the people.
[16:11.100 --> 16:12.660]  So I stood in line with my bag.
[16:12.840 --> 16:14.560]  And I actually just never put it on the machine.
[16:15.680 --> 16:16.800]  And no one ever noticed.
[16:16.820 --> 16:17.720]  I walked right through.
[16:19.100 --> 16:24.800]  And when I got up to the person I was speaking with, which was the vice president of security for this major bank, I told him this story.
[16:24.800 --> 16:36.500]  And he said, you know, we got a five million dollar insurance reduction for having that x-ray machine and a bunch of dogs that sniff around this week.
[16:37.960 --> 16:38.480]  Okay?
[16:39.820 --> 16:43.540]  So, now, I came in saying, look, your security is stupid.
[16:43.800 --> 16:46.220]  I came out saying, wow, your security is a profit center.
[16:54.390 --> 16:58.590]  Very often, security is just part of a larger decision.
[17:00.170 --> 17:05.370]  You know, invading Iraq was a foreign policy decision sold as a security decision.
[17:05.670 --> 17:07.650]  You could argue whether it's good or bad.
[17:07.910 --> 17:09.670]  It was a foreign policy decision.
[17:11.550 --> 17:12.070]  Right?
[17:12.230 --> 17:13.570]  You know, security in retail stores.
[17:13.750 --> 17:17.350]  In department stores, most shoplifting occurs in dressing rooms.
[17:17.850 --> 17:20.990]  So you can reduce your shoplifting by putting cameras in dressing rooms.
[17:21.890 --> 17:22.410]  Right?
[17:22.470 --> 17:23.770]  A store would never do it.
[17:23.970 --> 17:25.870]  Even though it's a good security idea.
[17:27.810 --> 17:32.010]  And to me, this explains a lot of what I call security theater.
[17:32.490 --> 17:32.930]  Sorry.
[17:33.210 --> 17:36.510]  Which was things like the x-ray machine in that bank.
[17:36.890 --> 17:38.570]  Or the National Guard troops.
[17:39.190 --> 17:41.610]  Who were in airports in the months after 9-11.
[17:41.950 --> 17:42.590]  Really interesting.
[17:42.730 --> 17:45.010]  They actually didn't have bullets in their guns.
[17:46.750 --> 17:49.070]  And, you know, why?
[17:49.390 --> 17:49.570]  Right?
[17:49.670 --> 17:51.970]  The reason was, people were afraid to fly.
[17:52.550 --> 17:56.190]  You know, guys in uniform with guns made people feel better.
[17:56.550 --> 17:57.370]  It helped the economy.
[17:58.450 --> 17:59.890]  Nothing to do with security.
[18:01.530 --> 18:02.410]  You know what I mean?
[18:02.690 --> 18:05.110]  The ID checks everywhere are kind of the same thing.
[18:05.670 --> 18:07.210]  It's not really about security.
[18:07.570 --> 18:08.810]  It's a larger decision.
[18:08.810 --> 18:11.390]  The trade-offs are bigger than security.
[18:12.490 --> 18:13.730]  And it's important to know that.
[18:15.490 --> 18:17.290]  There's also a notion of agenda.
[18:17.730 --> 18:20.250]  And this is something that we all need to understand.
[18:20.490 --> 18:22.770]  When looking at security trade-offs and decisions.
[18:22.950 --> 18:23.910]  Especially larger ones.
[18:24.570 --> 18:25.870]  So let me walk you through this.
[18:26.810 --> 18:29.670]  Security decisions affect multiple parties.
[18:29.670 --> 18:31.370]  I call them players in my book.
[18:31.630 --> 18:32.750]  From game theory.
[18:33.390 --> 18:36.350]  If you study economics, they're stakeholders.
[18:37.370 --> 18:40.610]  So any security decision affects multiple players.
[18:41.210 --> 18:43.430]  Each player has his own agenda.
[18:43.670 --> 18:45.270]  Remember, the trade-offs are subjective.
[18:46.530 --> 18:51.210]  So each one of these players will make the trade-off decision from their unique perspective.
[18:52.250 --> 18:53.770]  Now, it's not right or wrong.
[18:54.010 --> 18:56.090]  But it's their own unique perspective.
[18:56.840 --> 19:03.430]  And the player who gets to make the security decision will make the one that is worth it to him.
[19:05.550 --> 19:07.110]  A great example...
[19:07.110 --> 19:10.010]  My favorite one is the debate about arming airplane pilots.
[19:10.330 --> 19:16.110]  If you read the debate when it was big in the newspapers, the players tended to line up behind their agendas.
[19:16.470 --> 19:18.410]  The pilots said, you know, we want to carry a gun.
[19:18.530 --> 19:19.530]  It protects us.
[19:19.530 --> 19:27.110]  The flight attendants are saying, no, we don't want the guy with the gun on the other side of the locked door and us on this side with the terrorists.
[19:27.250 --> 19:27.710]  That's bad.
[19:27.930 --> 19:29.010]  They were against it.
[19:30.030 --> 19:31.730]  The government had its agenda.
[19:31.890 --> 19:33.270]  The airlines had its agenda.
[19:33.530 --> 19:35.610]  The passengers' unions had their agenda.
[19:37.390 --> 19:43.150]  And so what you had is a decision, which supposedly you can make rationally.
[19:43.150 --> 19:44.230]  Is it a good trade-off?
[19:44.410 --> 19:51.430]  But because there are multiple players, each one making their own rational trade-off, you end up with different answers.
[19:54.560 --> 19:55.080]  Right?
[19:55.140 --> 19:56.120]  A home alarm system.
[19:56.300 --> 19:56.920]  Let's try this.
[19:57.940 --> 20:02.400]  Actually, whether you get a home alarm system depends on who you are.
[20:02.620 --> 20:02.960]  Right?
[20:03.060 --> 20:09.540]  If you are a homeowner, you put an alarm and the burglar goes next door, that's a win.
[20:11.340 --> 20:15.340]  If you are the local police force, that is a complete waste of money.
[20:17.180 --> 20:21.380]  So depending on who pays for the system, you get a different answer.
[20:22.000 --> 20:22.520]  Right?
[20:22.580 --> 20:30.160]  If you secure all of your airports and the terrorists move to shopping malls, you haven't... you've wasted your money.
[20:30.460 --> 20:33.740]  But if you're an airline, you think, great, it's not our problem.
[20:34.000 --> 20:35.420]  The shopping malls get blamed.
[20:37.100 --> 20:37.640]  Right?
[20:37.680 --> 20:42.360]  So, how you make the money these trade-offs depends on your agenda.
[20:43.620 --> 20:51.400]  This, to me, explains very much why we are seeing so much increased police power in these months... in these years after 9-11.
[20:53.000 --> 20:57.380]  That, nationally, the agenda of the police is more and more being adopted.
[20:58.220 --> 20:59.560]  Now, if you are the police...
[21:00.600 --> 21:02.860]  I mean, think about it from your perspective as the police.
[21:03.240 --> 21:06.440]  You believe you are right, you are honest, you are honorable.
[21:06.440 --> 21:09.820]  So, if you get more powers, you will do better.
[21:10.540 --> 21:13.540]  So, you pass a law making sure everybody keeps their hands and can see them.
[21:13.880 --> 21:14.320]  Right?
[21:14.660 --> 21:17.040]  And as the police, that's a good idea.
[21:18.320 --> 21:22.580]  But the problem is, you have to step away from the police to look at the trade-offs.
[21:22.580 --> 21:30.040]  That draconian police powers may protect us from terrorism, but it makes the police themselves more dangerous.
[21:30.480 --> 21:34.160]  And that trade-off can't be made by the police.
[21:35.080 --> 21:41.360]  And for the same reason you don't put someone in charge of their own budget corporation, you don't put the police in charge of their own powers.
[21:41.580 --> 21:43.540]  They can't make the trade-offs.
[21:44.140 --> 21:47.480]  Because their agenda is different from the national agenda.
[21:47.820 --> 21:50.980]  Which has to balance civil liberties and police power.
[21:51.220 --> 21:52.820]  The police don't have to balance that.
[21:52.940 --> 21:54.460]  And they shouldn't have to balance that.
[21:55.020 --> 21:57.240]  That's the job of the people above them.
[21:59.660 --> 22:02.430]  So, all this leads to the notion of negotiation.
[22:03.080 --> 22:05.200]  Well, it's a tricepone thing, but...
[22:05.200 --> 22:10.460]  All of these security decisions come down to a negotiation between players.
[22:11.460 --> 22:22.660]  Now, when you eventually decide, as a country, what to do with arming airplane pilots, you will listen to everybody's agenda, and you will come to some agreement.
[22:22.940 --> 22:25.300]  And that agreement requires a negotiation.
[22:26.360 --> 22:29.160]  And we will need to understand these negotiations.
[22:29.220 --> 22:37.260]  Because the power you have in negotiation determines how well your agenda is being met.
[22:39.660 --> 22:40.300]  Right?
[22:40.480 --> 22:45.920]  You know, if you have no power in negotiation, what you want doesn't matter.
[22:46.240 --> 22:53.620]  If you are head of a family, and you want to put in a burglar arms system, what your child says won't carry that much weight.
[22:53.620 --> 22:56.160]  They don't have that much power in negotiation.
[22:56.460 --> 22:58.580]  They are forced to do what you want.
[22:59.000 --> 23:00.500]  You are the parent, and they are the child.
[23:02.680 --> 23:03.160]  Right?
[23:03.300 --> 23:04.540]  That happens in a lot of government.
[23:04.680 --> 23:09.340]  A lot of things are being foisted on us without the proper negotiation.
[23:10.420 --> 23:14.440]  The PATRIOT Act passed without a single hearing, and no one read it.
[23:15.580 --> 23:19.800]  So there is an example of an agenda being pushed through without negotiation.
[23:20.900 --> 23:23.380]  And depending on who you are, you have different levels of power.
[23:23.880 --> 23:24.340]  Right?
[23:24.560 --> 23:31.920]  Governments, industries, companies, civil organizations, people, like voters, consumers, citizens.
[23:33.380 --> 23:35.580]  And there are some good examples of this.
[23:37.080 --> 23:40.480]  In the months of 9-11, we banned a bunch of things on aircraft.
[23:41.720 --> 23:53.000]  And, you know, I wondered for a while why, when we were banning things like knitting needles and corkscrews, we never banned matches of lighters, actual combustibles.
[23:54.480 --> 23:59.080]  I actually said this for a couple of years before Michael Moore was moving, he stole my thunder.
[24:00.020 --> 24:02.160]  The cigarette lobby got to Congress.
[24:02.600 --> 24:08.580]  The government wanted to ban laptops, because you can hide a lot of stuff in a laptop.
[24:09.020 --> 24:14.760]  The airlines said, no, we will lose our business travelers, our high-revenue customers.
[24:14.760 --> 24:16.180]  Don't do that.
[24:16.940 --> 24:17.400]  Right?
[24:17.520 --> 24:24.840]  So, the agenda of the business travelers made themselves powerful as consumers and affected the security trade-off.
[24:28.340 --> 24:28.980]  Right?
[24:29.080 --> 24:33.380]  Think about... another good example is bank verification of checks.
[24:34.720 --> 24:39.880]  Banks tend not to verify signatures on checks in amounts under, like, $10,000, $20,000.
[24:40.160 --> 24:41.380]  I mean, some very high number.
[24:42.560 --> 24:50.540]  Because, from the bank's perspective, if the customer doesn't notice the fraud, there is no fraud.
[24:51.300 --> 24:52.700]  What does the customer care?
[24:52.800 --> 24:53.500]  What does the bank care?
[24:54.860 --> 25:02.020]  So, the bank forces the customers to look at the checks if they want that security.
[25:02.620 --> 25:09.680]  Now, sort of from a utilitarian, you know, greatest security for least cost, that's probably a very inefficient way of doing it.
[25:10.580 --> 25:14.560]  That, you know, with some thought, you can automate this process pretty well.
[25:15.300 --> 25:19.480]  And have an automatic system for check verification that banks could do.
[25:19.640 --> 25:24.040]  But the bank's agenda doesn't make that happen.
[25:24.360 --> 25:25.380]  The bank doesn't care.
[25:25.380 --> 25:31.460]  They're happy to let the consumer do it because it doesn't affect the bank.
[25:31.760 --> 25:34.340]  Now, compare that with bounce checks.
[25:34.640 --> 25:37.040]  If you bounce check, the bank's out the money.
[25:38.760 --> 25:44.440]  So, the bank puts in check, puts in procedures to deal with that.
[25:45.220 --> 25:47.740]  Because it's their problem, and they need to solve it.
[25:49.080 --> 25:50.740]  Think of photo IDs on airlines.
[25:50.940 --> 25:52.480]  I mean, this is actually a really interesting one.
[25:53.220 --> 26:00.460]  Here's an example of a security measure sold to the public as terrorism prevention, which actually the airlines embraced.
[26:01.080 --> 26:07.280]  Over the decades, there have been all sorts of security measures that the government's wanted to impose on the airlines.
[26:07.440 --> 26:09.320]  And the airlines have fought every one.
[26:09.600 --> 26:12.600]  I mean, they fought reinforcing the cockpit door for 20 years.
[26:13.860 --> 26:16.840]  The only one they didn't fight is the ID check.
[26:17.140 --> 26:20.780]  The reason is, it solved an airline security problem.
[26:20.780 --> 26:24.080]  The reselling of non-refundable tickets.
[26:25.460 --> 26:36.400]  They had a revenue problem that people were reselling tickets that they solved using a photo ID check, but got to pretend that the government made them do it for terrorism.
[26:37.660 --> 26:40.560]  An interesting example of agendas dovetailing.
[26:42.200 --> 26:43.740]  So here's the basic problem.
[26:44.820 --> 26:50.980]  You have, we have, almost no control over most of the security in our life.
[26:53.240 --> 26:55.620]  Security tends to just happen to us.
[26:55.780 --> 27:04.840]  It doesn't mean we're completely powerless to affect our own security, but it means we have to figure out how to fight properly.
[27:04.840 --> 27:09.620]  And the proper way to fight is to get more power in negotiations.
[27:09.940 --> 27:11.660]  And to understand when to negotiate.
[27:12.740 --> 27:13.260]  Right?
[27:13.360 --> 27:17.460]  Walking through airline security is the wrong time to negotiate.
[27:18.260 --> 27:19.000]  Right?
[27:19.100 --> 27:23.920]  As anyone who's commented on security while being searched knows.
[27:25.980 --> 27:26.720]  Right?
[27:26.780 --> 27:28.100]  There's a power imbalance.
[27:29.920 --> 27:33.900]  And this is, it's a problem in our society in many aspects, but it affects us in security.
[27:34.700 --> 27:40.120]  When you're walking through airline security, the person who's searching you is not your equal in negotiation.
[27:40.200 --> 27:43.160]  He's effectively a, a cog in a machine.
[27:43.540 --> 27:45.400]  He has no power to negotiate.
[27:46.440 --> 27:48.620]  And for most of airline security, we can't negotiate.
[27:48.760 --> 27:48.800]  Right?
[27:48.860 --> 27:49.660]  There isn't a marketplace.
[27:49.900 --> 27:53.340]  You can't fly, oh, I don't know, more secure airlines.
[27:53.340 --> 27:54.840]  We do background checks on everybody.
[27:54.840 --> 27:56.580]  Or less secure airlines.
[27:56.740 --> 27:57.780]  We get you there with less hassle.
[27:58.220 --> 27:58.540]  Right?
[27:58.620 --> 28:01.240]  There isn't a marketplace in airline security.
[28:01.880 --> 28:03.780]  Like, right, like there is in computer security.
[28:05.540 --> 28:08.240]  So we are sort of forced to get what we get.
[28:09.580 --> 28:12.680]  And if we want to negotiate, we can't do it when we're in line.
[28:17.400 --> 28:23.040]  Not, previous trip to New York, I went into a hotel that I've been going to pretty regularly.
[28:23.280 --> 28:24.880]  And the first time I was asked for a photo ID.
[28:25.580 --> 28:26.360]  I said no.
[28:27.480 --> 28:29.260]  The person said, well, I'm not going to check you in.
[28:30.220 --> 28:31.240]  This is interesting, right?
[28:31.900 --> 28:32.980]  It's 1130 at night.
[28:33.540 --> 28:37.180]  The person behind the counter actually couldn't care less if I'm checked in or not.
[28:37.980 --> 28:39.800]  Now, he's making his salary regardless.
[28:42.760 --> 28:44.140]  You know, I want to negotiate.
[28:44.140 --> 28:46.840]  I want to say, look, I'm giving you my money.
[28:47.160 --> 28:50.860]  If you want me to stay here, I want, you know, you're not going to see my photo ID.
[28:51.420 --> 28:53.100]  But there was no one for me to negotiate with.
[28:55.260 --> 28:55.620]  Right?
[28:55.720 --> 28:57.180]  I actually went to another hotel.
[28:57.180 --> 29:00.280]  Well, you can imagine lots of people saying, look, it's late, it's New York.
[29:00.380 --> 29:01.280]  I can't find another hotel.
[29:02.080 --> 29:02.600]  Right?
[29:02.620 --> 29:04.000]  Now I know to call ahead about this.
[29:06.620 --> 29:09.580]  But you always have those negotiation problems.
[29:10.000 --> 29:16.220]  The best way to affect your security is to change the environment.
[29:16.480 --> 29:21.240]  To change the system under which people negotiate.
[29:22.140 --> 29:24.260]  To change the agendas of the players.
[29:25.100 --> 29:27.180]  There are a bunch of ways to accomplish this.
[29:27.380 --> 29:31.940]  I use the four groupings that Larry Lessig used in his book, Code.
[29:32.100 --> 29:34.480]  Although I use them slightly differently and I apply them differently.
[29:34.940 --> 29:39.580]  I sort of think of security decisions as having four knobs.
[29:40.060 --> 29:41.720]  And there are knobs I can turn.
[29:42.880 --> 29:45.000]  There's a government intervention knob.
[29:45.980 --> 29:48.340]  Laws, regulations, torts.
[29:50.740 --> 29:57.200]  If you want to improve security, you make it a law that something has to be done.
[29:57.220 --> 29:59.080]  Or you make it a law that something can't be done.
[29:59.380 --> 30:03.000]  You're going to change the agendas of the players by making something illegal.
[30:03.820 --> 30:07.120]  It is illegal for you to mine your front lawn in our country.
[30:07.380 --> 30:09.420]  So you're less likely to do it.
[30:10.660 --> 30:16.640]  The trade-off you're going to make, whether you want to put landmines on your lawn, will be different if you think you might go to jail.
[30:17.020 --> 30:17.780]  If you do it.
[30:19.260 --> 30:21.360]  You can do that with torts.
[30:21.640 --> 30:23.200]  You see that a lot in environmentalism.
[30:23.540 --> 30:27.420]  The perfectly reasonable trade-off is, you know, we're a chemical plant.
[30:27.500 --> 30:28.120]  We pollute the river.
[30:28.260 --> 30:29.040]  People downstream die.
[30:29.300 --> 30:30.300]  We don't live downstream.
[30:30.300 --> 30:30.780]  Who cares?
[30:31.840 --> 30:32.640]  Reasonable trade-off.
[30:32.640 --> 30:38.820]  If the people downstream can sue you, suddenly you have a financial incentive not to pollute the river.
[30:40.920 --> 30:42.060]  If there were...
[30:42.060 --> 30:45.840]  To me, this is the best way to improve operating system security.
[30:47.040 --> 30:53.000]  If there were major class action suits against Microsoft for bad security, they would improve it.
[30:53.200 --> 30:54.340]  Microsoft's not a charity.
[30:54.480 --> 30:55.440]  They're a smart company.
[30:55.820 --> 31:00.220]  And as long as it's cheaper to be insecure than secure, they'll be insecure.
[31:01.160 --> 31:07.260]  And if you want it to be cheaper to be secure, one of the ways to do that is through liabilities.
[31:08.640 --> 31:14.660]  So, when you think of these knobs, the knob you want to turn often depends on your circumstance and your politics.
[31:15.160 --> 31:18.420]  In a lot of ways they're equal, but they have different repercussions.
[31:18.680 --> 31:20.240]  So there's the government intervention knob.
[31:20.960 --> 31:22.620]  There's the market forces knob.
[31:23.200 --> 31:27.300]  I think Linux is a more to improve Windows security than anything else we've ever done.
[31:27.680 --> 31:29.340]  By being competition.
[31:33.760 --> 31:36.360]  And maybe you can see that in...
[31:36.360 --> 31:38.480]  What are some other examples of market forces?
[31:39.680 --> 31:42.700]  There was one, an environmentalist example is dolphin-safe tuna.
[31:43.200 --> 31:50.400]  People started buying it, so tuna fishermen started catching tuna online instead of by net.
[31:50.400 --> 31:55.680]  There's an example of no government intervention, but the market forces changing the agenda of the player.
[31:59.690 --> 32:01.470]  Computer security is a good example.
[32:01.750 --> 32:09.970]  If we all, as consumers, demanded that we're not going to show photo IDs at hotels, hotels would stop doing it.
[32:10.250 --> 32:10.890]  They would.
[32:11.870 --> 32:16.390]  Just like consumers said, you know, if you don't let us bring our laptops on an airplane, we're just not going to fly.
[32:18.350 --> 32:19.830]  So market forces are a knob.
[32:20.290 --> 32:21.130]  Technology is a knob.
[32:21.750 --> 32:26.050]  As things become cheaper and more expensive, they're more or less likely to be done.
[32:26.250 --> 32:30.390]  When burglar alarms became wireless, their sales increased dramatically.
[32:31.050 --> 32:35.190]  It was a much less barrier to entry to put an alarm system in your house.
[32:35.190 --> 32:38.310]  The trade-offs became a lot less because of the technological advance.
[32:40.670 --> 32:42.410]  You see that in computer security also.
[32:43.650 --> 32:47.210]  As we're able to do things, we're more likely to want to do them.
[32:49.290 --> 32:51.950]  The last change is social norms.
[32:52.570 --> 32:55.170]  This is, I think, the most important one, the most subtle one.
[32:55.830 --> 33:00.750]  In Japan, nobody buys bicycle locks because in Japan nobody steals bicycles.
[33:01.790 --> 33:04.330]  Bicycles aren't more theft-proof in Japan.
[33:04.690 --> 33:06.650]  The social norms are different.
[33:09.150 --> 33:12.530]  You know, this is sort of what we're getting at when we try to get into education.
[33:13.130 --> 33:14.490]  In computer security.
[33:14.930 --> 33:17.870]  Convince people not to open strange attachments.
[33:18.430 --> 33:20.790]  Not to click on strange URLs.
[33:22.030 --> 33:29.710]  That if we can change the social norms, we can make ourselves more secure, irrespective of anything else.
[33:30.750 --> 33:31.550]  It does work.
[33:31.770 --> 33:32.950]  I mean, it's a good solution.
[33:33.090 --> 33:34.010]  It's just a long-term solution.
[33:37.470 --> 33:49.110]  So, in the end, when I think about security problems and the knobs and solutions, one of my goals as a security technologist is to align interests with capabilities.
[33:50.890 --> 33:54.890]  So, I like to think of security in a very utilitarian point of view.
[33:54.890 --> 33:59.130]  How do I get the most security overall for the least cost overall?
[33:59.870 --> 34:00.170]  Right?
[34:00.270 --> 34:01.510]  Looking over all the players.
[34:01.870 --> 34:10.490]  And one of the ways to do that is to make the person who can best affect security be in charge of security.
[34:10.690 --> 34:14.950]  The goal of a security system is to manage risks as effectively as possible.
[34:15.530 --> 34:22.850]  And to do that, you need to figure out an acceptable level of risk and what you're willing to pay to get there.
[34:23.690 --> 34:29.670]  And have the player who is in the best position to spend that money be accountable for it.
[34:29.990 --> 34:30.410]  Right?
[34:30.490 --> 34:36.590]  A good security system is one where the security requirements are aligned with the agendas of the players.
[34:37.530 --> 34:38.150]  Right?
[34:38.830 --> 34:43.230]  Airlines like the photo ID requirement because it matches their agenda.
[34:44.370 --> 34:46.750]  There are lots of other examples of this.
[34:47.410 --> 34:48.550]  ATM machines.
[34:50.010 --> 34:51.410]  In the U.S.
[34:51.950 --> 34:55.830]  Here's an example of agendas determined by the legal system.
[34:56.030 --> 35:04.710]  In the U.S., when there was a case of ATM fraud, the bank had to prove the customer guilty or the bank ate it.
[35:05.770 --> 35:07.710]  In the U.K., it was the opposite.
[35:08.030 --> 35:14.070]  If there was an instance of fraud, the customer had to prove his innocence or the customer ate it.
[35:14.830 --> 35:20.690]  Which meant, in the U.S., ATM security improved while in the U.K., it didn't.
[35:21.130 --> 35:30.830]  Because the banks, who are the only party who can improve ATM security, had no incentive to do so in the U.K., whereas they did in the U.S.
[35:33.050 --> 35:34.190]  That's the difference.
[35:35.670 --> 35:37.830]  They think of sort of airport screeners.
[35:39.210 --> 35:39.930]  You know what I mean?
[35:39.970 --> 35:48.690]  Love or hate the TSA, but the point of making those people government employees is that they were no longer contractors for the airlines.
[35:48.990 --> 35:57.530]  They no longer shared the airlines agenda of getting people through quickly and now share the government agenda of screening people properly.
[35:58.150 --> 35:58.670]  Right?
[35:58.830 --> 36:01.610]  You know, it may or may not work, but that's the basic idea.
[36:04.810 --> 36:10.030]  Another way to see... actually, this is my favorite ever security countermeasure, because it really illustrates this.
[36:11.090 --> 36:12.350]  A lot of people have seen this.
[36:12.430 --> 36:20.690]  When you go into some stores, convenience stores, often low-end retail stores, there's a sign on the cash register that says, you're purchase free if you don't get a receipt.
[36:21.870 --> 36:23.510]  That is a security countermeasure.
[36:23.670 --> 36:25.330]  It's a brilliant security countermeasure.
[36:25.650 --> 36:27.750]  And it's worth taking some time to explain.
[36:29.930 --> 36:34.150]  As an employer, one of the things you're worried about is employee theft.
[36:34.830 --> 36:42.990]  And over the years, over the past century or so, there have been any number of security measures designed to protect against employee theft.
[36:43.510 --> 36:47.950]  The first one was a cash register with a bell.
[36:48.150 --> 36:49.690]  And the bell would ring whenever it opened.
[36:49.850 --> 36:50.570]  That's all it did.
[36:51.370 --> 36:55.830]  And that was a mechanism to alert the store owner that an employee has opened the cash register.
[36:58.970 --> 37:01.110]  Another innovation was the register tape.
[37:01.530 --> 37:03.590]  Register tape is an audit device.
[37:04.630 --> 37:07.530]  And again, the problem is employee theft.
[37:07.810 --> 37:14.230]  And the idea is, we're going to force the employee to record all transactions on the register.
[37:14.430 --> 37:15.490]  They appear in the register tape.
[37:15.730 --> 37:22.670]  At the end of the day, you look at the total on the tape, you look at the total on the cash drawer, and any difference the employee has to make up.
[37:23.510 --> 37:24.030]  Right?
[37:24.130 --> 37:24.650]  That works.
[37:25.090 --> 37:26.770]  That's a fine security countermeasure.
[37:26.970 --> 37:34.950]  But now, if you're sort of a conniving employee, now what you want to do is to get purchases off the register.
[37:35.570 --> 37:40.650]  If you can sell something and never ring it up on the register, you can pocket that money.
[37:41.710 --> 37:47.410]  So now the employer wants to ensure that all purchases go on the register.
[37:47.710 --> 37:48.890]  Alright, so how can he do this?
[37:49.730 --> 37:51.050]  He can stand and watch.
[37:51.330 --> 37:51.970]  That will work.
[37:52.930 --> 37:55.690]  But if he did that, why have the employee?
[37:55.870 --> 37:58.070]  One of the employees is he doesn't have to stand there.
[37:58.290 --> 38:01.630]  So what the employer is going to do is he's going to hire the customer.
[38:01.630 --> 38:04.750]  The customer is there at the point of transaction.
[38:04.970 --> 38:07.430]  But the customer's agenda is, I don't care.
[38:08.390 --> 38:10.410]  The customer doesn't care about employee theft.
[38:10.610 --> 38:12.570]  He just wants his item and wants to pay for it.
[38:13.270 --> 38:28.350]  By putting that sign in front of the register, the employer hires the customer as a security guard to watch the employee and make sure that the transaction goes on the register.
[38:29.850 --> 38:30.390]  Right?
[38:30.530 --> 38:32.550]  The sign... I mean, it's really cheap.
[38:33.370 --> 38:35.550]  You're hiring a security guard for basically nothing.
[38:36.310 --> 38:37.490]  And it does work.
[38:37.970 --> 38:39.890]  As a countermeasure, it does work.
[38:39.990 --> 38:41.630]  I mean, there's still employee theft.
[38:41.770 --> 38:42.950]  There are lots of other ways to steal.
[38:43.150 --> 38:45.690]  But against that particular theft, it works.
[38:46.330 --> 38:50.830]  We saw a very similar countermeasure in Italy.
[38:50.830 --> 38:53.850]  In Italy, tax evasion is sort of a national hobby.
[38:55.690 --> 39:02.810]  And the government wanted to make sure that retail stores properly declare what they're selling.
[39:03.410 --> 39:09.650]  So they could have passed a law saying, you know, retail stores must record things on the register.
[39:09.870 --> 39:12.970]  But the government knew that the retail stores would just cheat.
[39:13.170 --> 39:14.570]  So they passed a different law.
[39:14.670 --> 39:23.710]  They passed a law saying that any customer caught within 50 meters of a store with a purchase who doesn't have a receipt gets fined.
[39:24.870 --> 39:25.430]  Right?
[39:25.510 --> 39:26.330]  That's brilliant.
[39:26.690 --> 39:31.090]  Because now the customer is not going to leave the store without a receipt.
[39:32.070 --> 39:38.030]  And the merchant's going to listen to the customer far more quicker than to listen to the government.
[39:39.830 --> 39:48.850]  So you get what you want by making the person who is in the best position to mitigate the risk responsible for it.
[39:51.010 --> 39:59.550]  When you look at security, when you look at security disconnects, when you look at why firewall sucks so bad, you know, look for these sorts of things.
[39:59.550 --> 40:01.750]  Look for who's responsible.
[40:01.930 --> 40:03.010]  Look for their agenda.
[40:04.730 --> 40:06.930]  Which might be different than your agenda.
[40:09.150 --> 40:09.690]  Right?
[40:10.450 --> 40:11.250]  You saw the...
[40:11.250 --> 40:13.990]  Do you remember KAL007?
[40:14.230 --> 40:17.050]  It was a Korean Airlines plane that was shot down over Russia?
[40:17.970 --> 40:19.170]  In the Far East.
[40:19.670 --> 40:20.310]  When it...
[40:20.310 --> 40:22.410]  It's straight into Soviet airspace.
[40:22.790 --> 40:25.390]  The general in charge of security that night.
[40:25.810 --> 40:27.310]  What if the plane shot down?
[40:27.470 --> 40:33.730]  Because the previous general in charge of security when an airplane entered Soviet airspace was jailed.
[40:35.230 --> 40:39.070]  So the general is thinking, well, my agenda is, I'm going to save my butt.
[40:39.990 --> 40:44.070]  It might be different than the nation's agenda, different than the world's agenda.
[40:44.070 --> 40:46.690]  But that's the agenda of the person making the decision.
[40:50.390 --> 40:57.330]  And then also in the end, we have to realize that we must accept risk.
[40:57.510 --> 40:58.830]  That life itself is risk.
[40:59.010 --> 41:04.470]  And even with all the security countermeasures we can install, we can never reduce risk to zero.
[41:04.850 --> 41:10.350]  And more importantly, security countermeasures rapidly reach the point of diminishing returns.
[41:11.270 --> 41:15.130]  There's a level where it makes financial sense, where the trade-off's worth it.
[41:15.130 --> 41:19.530]  And above that, you pay too much and get too little back.
[41:19.950 --> 41:21.710]  And it tends not to be worth it.
[41:22.710 --> 41:29.250]  So we need to negotiate the best we can, to mitigate the risk the best we can, and accept the rest.
[41:31.410 --> 41:33.410]  And that's part of being alive.
[41:35.890 --> 41:38.890]  So a couple of concluding points, and I'll take questions with the mic there.
[41:39.130 --> 41:45.450]  As an individual, you have basically no power in many of the security decisions that affect your life.
[41:46.770 --> 41:55.050]  In line to check into a hotel, in line for airport security, you know, when someone asks for an ID using your credit card.
[41:55.530 --> 41:58.890]  You have no negotiating power as an individual.
[41:59.230 --> 42:02.070]  In aggregate, you have all the power.
[42:03.130 --> 42:06.210]  As consumers, as voters, as citizens.
[42:06.550 --> 42:08.310]  That's how we make change.
[42:09.110 --> 42:18.130]  And if you, we, don't like the secure decisions that are being made for us, we need to exercise that power.
[42:18.330 --> 42:21.610]  And it's our political and economic muscle, and it does actually work.
[42:25.150 --> 42:26.470]  So that's the basic talk.
[42:26.650 --> 42:27.770]  I'm happy to take questions.
[42:28.830 --> 42:32.710]  I have flyers sort of there and there for both my latest book and my newsletter.
[42:32.830 --> 42:34.130]  Who here gets a cryptogram?
[42:35.130 --> 42:36.330]  Oh wow, a lot of you.
[42:36.750 --> 42:39.290]  So, you know, turn to your neighbor and tell them to get it.
[42:39.890 --> 42:44.690]  If you hand me a business card, I'm happy to subscribe to you, or you grab a flyer and subscribe to my website.
[42:45.170 --> 42:46.550]  Its email comes up monthly.
[42:46.730 --> 42:48.130]  It hopefully will get through your spam trap.
[42:50.030 --> 42:51.670]  And who here has read beyond fear?
[42:52.830 --> 42:54.290]  All right, so less of you.
[42:54.550 --> 42:55.730]  That's my, that's my latest book.
[42:55.950 --> 42:58.570]  It's my first non-computer security book.
[42:58.690 --> 43:02.970]  It tries to look at a lot of things I talked about here, plus a lot more on how security works.
[43:03.090 --> 43:07.170]  Trying to peel apart the commonalities of security in all domains.
[43:09.010 --> 43:11.510]  So I have about 10 minutes before they're going to shoot me off the stage.
[43:12.230 --> 43:13.410]  I'm happy to take questions.
[43:13.670 --> 43:15.190]  If you go to the mic, I'll hear you.
[43:15.410 --> 43:17.630]  And that'll just make, and also they'll hear you.
[43:18.090 --> 43:19.670]  So that'll make life a little bit easier.
[43:31.040 --> 43:31.480]  Thanks.
[43:32.120 --> 43:37.380]  Um, what is your view on the perception of security as, as a value?
[43:37.580 --> 43:44.440]  So companies that are using 40-bit SSL keys, so that people see the little key down there, they think it's safe, and they feel better about it.
[43:44.540 --> 43:44.920]  Do you think?
[43:44.920 --> 43:46.000]  I mean, there's a lot of that.
[43:46.100 --> 43:47.280]  I call it security theater, right?
[43:47.420 --> 43:49.300]  I mean, and 40-bit SSL is a great example.
[43:49.480 --> 43:55.560]  I mean, my mother sees the green key in the bow lower left in the corner of her browser, and she says, I am magically secure.
[43:57.300 --> 43:58.660]  Without understanding the details.
[43:59.240 --> 44:01.460]  Uh, you know, in some cases that's okay.
[44:01.920 --> 44:02.320]  Right?
[44:02.360 --> 44:09.980]  In examples where people are over, are over fearful, you know, afraid to fly off 9-11, security theater makes sense.
[44:09.980 --> 44:12.000]  You have to remember that it's not security.
[44:12.200 --> 44:13.300]  That is, that's another reason.
[44:14.220 --> 44:22.780]  Uh, in, after the, uh, Tylenol poisonings, in, in the, uh, 80s, uh, we had, everybody now uses tamper-proof caps.
[44:22.980 --> 44:27.780]  Which, like, three minutes of thinking about it, will, you'll all figure out how to defeat tamper-proof caps.
[44:28.820 --> 44:30.800]  I mean, start with a syringe and work from there.
[44:31.560 --> 44:33.380]  But they make people feel better.
[44:33.520 --> 44:35.220]  They didn't solve the security problem.
[44:35.440 --> 44:37.300]  They solved the economic problem.
[44:37.700 --> 44:46.920]  So when you see things like security theater, like, you know, 40-bit SSL and, and the little, little green key, think about the problem that's actually being solved, or is the problem that is being solved.
[44:47.120 --> 44:49.520]  If there is a real problem, we need real security.
[44:49.700 --> 44:52.020]  If there isn't a real problem, security theater works just fine.
[44:53.640 --> 44:58.440]  But it's, again, it's paying attention to what the real agendas are of the different players.
[45:01.200 --> 45:08.720]  Bruce, can you give some more tips for, like you said, making the people that implement the security responsible for it?
[45:08.820 --> 45:12.980]  Thinking about corporate scenarios where there's, there's a lot of trade-offs.
[45:13.100 --> 45:14.060]  People are fighting for budget.
[45:14.520 --> 45:17.180]  There's lots of things that are done that don't make sense from a security perspective.
[45:17.540 --> 45:21.140]  Users are always trying to work around things that inconvenience them.
[45:21.400 --> 45:29.060]  How can you make security work for the users, the administrators, things that are, you know, useful, not just throwing money at a security problem?
[45:29.060 --> 45:29.820]  Yeah, it's interesting.
[45:30.000 --> 45:34.800]  You know, I actually think that a lot of corporate security isn't worth it.
[45:35.100 --> 45:39.280]  I mean, if it, if it was really a problem, the CEO would care.
[45:39.520 --> 45:44.740]  I mean, the way to make, to, the way to make, to fix the problem is make the CEO care.
[45:45.400 --> 45:52.180]  If there are worms and viruses and, and the IT staff runs around and loses sleep for a, a four or five days, the CEO doesn't care.
[45:52.360 --> 45:53.760]  That's not a problem to him.
[45:55.000 --> 46:01.760]  In the, I wrote an essay for this, the Payback Edition of Secrets of the Lives, my previous book, where I talk about this.
[46:02.160 --> 46:04.820]  And this is where I get into liabilities.
[46:05.000 --> 46:09.340]  If you want the CEO to care, make it affect his bottom line.
[46:10.120 --> 46:23.840]  If the CEO of, I don't know, random database company could get sued for a whole lot of money, if his customer's data was released to the public, he would fix it.
[46:24.220 --> 46:27.320]  Because he'd look at that and say, whoa, that's an enormous liability.
[46:27.580 --> 46:29.560]  How do I make that liability go away?
[46:29.760 --> 46:33.140]  Now, he might make it go away with insurance and not do anything.
[46:33.780 --> 46:36.260]  But the insurance company will make it do something.
[46:36.420 --> 46:39.420]  I mean, getting back to the financial company I visited this morning.
[46:40.600 --> 46:46.400]  So, if you're, if you're, if you want, you know, if we in the world believe computer security should be better, take an example.
[46:47.060 --> 46:47.440]  Right?
[46:47.460 --> 46:49.540]  The problem is, I believe, that no one cares.
[46:49.900 --> 46:50.280]  Right?
[46:50.300 --> 46:52.440]  Microsoft doesn't care, because they're selling their stuff.
[46:53.300 --> 46:56.240]  The companies installing the products don't really care, because it's your data.
[46:56.800 --> 46:58.480]  You need to make them care.
[46:58.960 --> 47:00.700]  You can make them care with regulation.
[47:01.520 --> 47:01.860]  Right?
[47:01.860 --> 47:03.900]  Microsoft, by law, now must do X.
[47:04.000 --> 47:04.780]  That's probably a mistake.
[47:06.280 --> 47:08.420]  You can make them care through the market.
[47:08.680 --> 47:08.780]  Right?
[47:08.800 --> 47:11.360]  We're not going to buy the stuff unless you make it secure.
[47:11.720 --> 47:13.080]  That hasn't worked very well.
[47:13.740 --> 47:16.320]  I think that liability is the way to make that work.
[47:18.060 --> 47:18.800]  Things like that.
[47:18.980 --> 47:20.700]  If we all could sue Microsoft.
[47:20.880 --> 47:25.800]  I mean, if it was cheaper for Microsoft to make it secure than insecure, they would do it.
[47:26.580 --> 47:27.980]  They're a smart company.
[47:27.980 --> 47:32.180]  And I like to believe that we are ingenious people.
[47:33.120 --> 47:37.900]  That Americans, that humans are really good at coming up with solutions to real problems.
[47:38.160 --> 47:40.220]  The problem is, it's not a real problem yet.
[47:41.240 --> 47:42.880]  Nobody owns the problem.
[47:43.860 --> 47:47.480]  Which is why you have the government, you know, doing things like asking nicely.
[47:48.300 --> 47:50.240]  You know, please make security better.
[47:50.240 --> 47:57.220]  Now, why doesn't my mother's ISP offer her an ISP connection behind a firewall?
[47:57.380 --> 47:58.540]  There's no earthly reason.
[47:59.000 --> 48:02.340]  The ISP is the best person to make my mother's connection secure.
[48:03.160 --> 48:04.920]  They don't because they don't have to.
[48:05.260 --> 48:06.860]  There's no market for it.
[48:07.840 --> 48:10.900]  And my mother's not going to sue the ISP if there's a problem.
[48:11.080 --> 48:12.120]  There's no regulation.
[48:12.420 --> 48:14.840]  Any one of those three ways would make it happen.
[48:14.840 --> 48:16.140]  And it would be better for all of us.
[48:17.360 --> 48:17.760]  Yes?
[48:18.400 --> 48:23.560]  As security consumers, the wrong time to negotiate is when you're in the line of the airport or what have you.
[48:24.180 --> 48:30.040]  How do we make our agenda more influential on the people that are making decisions?
[48:30.240 --> 48:33.100]  I know there's no right answer, but what are your thoughts on what's happening?
[48:33.100 --> 48:37.500]  My thoughts, especially in security, is to vote, to agitate.
[48:38.320 --> 48:39.940]  I mean, there are battles we've won.
[48:40.860 --> 48:42.100]  You know, TIA died.
[48:43.200 --> 48:48.100]  I mean, there are 199 other data mining programs unclassified in the federal government alone.
[48:48.300 --> 48:49.660]  But TIA died.
[48:50.820 --> 48:53.080]  The TIPS program died.
[48:54.040 --> 48:55.520]  We've had some victories.
[48:55.900 --> 48:58.400]  CAPS II is having serious problems.
[48:58.400 --> 49:07.020]  And this is all us, as civil liberties groups, through EFF, through EPIC, through ACLU, that have fought.
[49:07.200 --> 49:10.320]  So, you know, lend your voice to organizations.
[49:10.400 --> 49:14.240]  It's the same thing if you're in favor of national healthcare or against national healthcare.
[49:14.520 --> 49:19.440]  You know, you find an organization that's fighting for it and lend your voice to that organization.
[49:20.320 --> 49:21.740]  So, it's getting involved.
[49:22.100 --> 49:23.840]  We need to get involved.
[49:24.180 --> 49:27.120]  Security is now too important to let it just happen to us.
[49:27.120 --> 49:28.460]  We need to get involved in the process.
[49:28.720 --> 49:36.700]  And that's getting involved in organizing, in voting, in aggregating your voice.
[49:37.680 --> 49:39.920]  You know, it could be simple as a consumer movement.
[49:40.440 --> 49:41.620]  Consumer movements work too.
[49:42.560 --> 49:43.080]  Yes?
[49:43.760 --> 49:47.560]  Bruce, I've got a question about security and terrorism in the U.S.
[49:47.560 --> 49:57.180]  Can you point to another country in the world that's done a good job with the security of the citizens without substantially curtailing civil liberties?
[49:58.380 --> 50:01.800]  You know, I think Europe's done better than the U.S.
[50:02.020 --> 50:04.180]  They have a much more realistic view on terrorism.
[50:05.140 --> 50:06.420]  Stuff done in England.
[50:07.120 --> 50:08.620]  Stuff done in France.
[50:10.540 --> 50:13.740]  A lot of that stuff I like better than the stuff that's...
[50:13.740 --> 50:14.260]  Can you give me examples?
[50:14.440 --> 50:15.760]  I'm just curious if you have some examples.
[50:15.980 --> 50:17.440]  No, I don't have anything off the top of my head.
[50:19.300 --> 50:20.940]  Interesting photo experiment.
[50:21.520 --> 50:21.940]  It...
[50:22.680 --> 50:28.260]  I spent a whole chapter in my book, the latest book on terrorism, because it's really a complicated topic and it's not what people think it is.
[50:28.620 --> 50:32.740]  Terrorism is not a crime against property or against people.
[50:32.880 --> 50:34.140]  It's a crime against the psyche.
[50:35.200 --> 50:37.420]  I mean, terrorism is...
[50:37.870 --> 50:42.780]  The target of terrorism is the mind of all of you, of everybody, of all of us.
[50:43.440 --> 50:49.320]  And if you could, imagine a world where 9-11 was not reported.
[50:50.560 --> 50:52.120]  You would just never hit the newspaper.
[50:53.520 --> 50:55.280]  That would be... it would be ineffective.
[50:55.540 --> 50:56.480]  It wouldn't have worked.
[50:57.020 --> 50:59.180]  That will never happen in our free society.
[50:59.420 --> 51:00.520]  And that's probably a good thing.
[51:01.100 --> 51:01.740]  But...
[51:01.740 --> 51:06.860]  By not reporting terrorism, it loses its effectiveness.
[51:06.860 --> 51:09.860]  In the UK, during...
[51:10.660 --> 51:17.760]  I think in the 70s, when a lot of the Irish terrorism was much more rampant, the news stopped reporting mob threats.
[51:20.220 --> 51:21.780]  And they became less effective.
[51:22.360 --> 51:23.500]  It's really interesting.
[51:25.180 --> 51:28.940]  You know, I mean, I think that Europe does much better airlines in security than the U.S. does.
[51:29.360 --> 51:32.320]  I mean, they don't care if you take your laptop out of your bag.
[51:32.320 --> 51:33.160]  They know better.
[51:33.920 --> 51:35.440]  But they have smart guards.
[51:35.760 --> 51:38.300]  I remember 10 years ago in Italy, in the airports, there were...
[51:38.300 --> 51:41.020]  There were guards with guns walking around looking at people.
[51:41.300 --> 51:51.140]  I actually believe, very strongly, and I make the case in my book, that replacing a smart guard with a dumb guard who follows a process makes us less safe.
[51:51.680 --> 51:55.780]  We used to have smart guards in building lobbies, watching what's going on.
[51:55.940 --> 51:58.100]  Now we have dumb guards who check IDs.
[51:59.320 --> 52:01.740]  We are all less safe because of that.
[52:01.960 --> 52:12.900]  I believe you can rip out all of airline security, replace them with guards walking around the airports looking for suspicious things, trained, and we'd all be safe.
[52:13.340 --> 52:16.740]  Now you're not going to see that because, again, remember the agenda.
[52:16.980 --> 52:20.420]  A lot of the security measures we're seeing have a CYA agenda.
[52:20.420 --> 52:22.720]  The whole point of this color-coded alert.
[52:22.920 --> 52:26.740]  So the administration could say, Well, we told you it was code yellow, what did you expect?
[52:27.480 --> 52:29.140]  And that's the point of it.
[52:31.840 --> 52:33.020]  I forget your question.
[52:35.500 --> 52:37.400]  I just asked if you could point to another country.
[52:37.640 --> 52:38.900]  I mean, where should we live at this point?
[52:41.620 --> 52:43.540]  I'm still living here.
[52:44.620 --> 52:46.260]  Actually, I don't think it's irredeemable.
[52:46.560 --> 52:48.260]  I don't think we've lost.
[52:48.800 --> 52:50.060]  I mean, things have gotten bad.
[52:50.960 --> 52:52.340]  And things are pretty ugly.
[52:52.700 --> 52:57.320]  You know, we're having a notion that a police state makes us safer.
[52:57.760 --> 53:00.320]  People tend to be very short-sighted.
[53:01.000 --> 53:02.020]  We don't have long memories.
[53:02.540 --> 53:11.260]  The controls we put in place in the 60s and 70s to prevent police abuses we're now taking away because we think they hamper terrorism abuses.
[53:11.980 --> 53:13.560]  That, to me, makes no sense.
[53:14.300 --> 53:15.560]  I don't think all is lost.
[53:15.660 --> 53:17.420]  I'm not moving yet.
[53:18.620 --> 53:20.820]  So I think living here is a good place to be.
[53:21.480 --> 53:22.320]  You know, I'm not...
[53:23.900 --> 53:25.260]  Wait until the next election before you leave.
[53:26.000 --> 53:27.060]  This one's too important.
[53:28.360 --> 53:31.400]  No, you all should move to Ohio and vote there.
[53:38.820 --> 53:39.780]  So I have to go.
[53:39.980 --> 53:40.680]  Thank you very much.
[53:40.840 --> 53:42.680]  I will be here to take questions offline.
[53:42.900 --> 53:45.960]  Again, I have bookend newsletter flyers there and there in the back.
[53:46.260 --> 53:47.780]  And enjoy your weekend.
[53:47.940 --> 53:48.480]  Thanks for listening.
[53:57.240 --> 53:58.020]  That's a good one.