32 comments

[ 4.4 ms ] story [ 105 ms ] thread
I think it is worth reviewing the "Schneier Doctrine" as I understand it:

Principles

* Security is a trade off between safety and freedom / cost

* Prevention is not always the most cost effective trade-off. Emergency response is often better.

* Stories make a huge difference in how humans perceive threats around us - and can therefore make a difference in correcting the perceived threat model to match the actual threat model.

Doctrine (not sure he has ever voiced these...)

* Define National Security quantatively (less than 1,000 expected deaths, or loss of less than 1% GDP its not national security). If someone slaps a National Security Letter on you today, its laughable, if personally threatening. If they slap a NSL on you when that means they seriously think a 1,000 people could die if you do not comply its not laughable.

* Massively increase spend on post-event support (ambulance, decontamination).

* Run public security "games" where teams of experts kill as many of us as possible using only items found in CostCo. (Trying to reframe the perceived threat model to meet the actual threat model). Simon Cowell could present it.

Note that 1% GDP of US is 0.1 trillion USD
OK, doesn't that just show how few things are threats to "national security"?

Or maybe it shows that most "threats" to "national security" are just hokum and hooey.

Also to compare: the bailout apparently totaled around 30 trillion USD at the end of 2011, two orders of magnitude more.

And the cost of Katrina was less than 1% of GDP (80 billion < 150 billion)

http://www.accuweather.com/en/weather-news/top-5-most-expens...

Do you find something as big as Katrina "not something worth of National Security?"

I am certainly surprised the "national security" button was not pressed during the bailout. The thought of a few years in Gitmo would have helped various CEOs consider carefully the meaning of fiducary duty.

However whereever you place the cut-off, we can find a example that will look silly. I am not arguing that a specific number of dollars is or is not an national emergency. I am simply arguing that at a certain point things look so bad we as a society want to say "You, you get carte blanche, do whatever, kill whomever, just fix it. We will review it all in 6 months".

This takes us away from can we trust the security services and into the security services as a national emergency response team.

What the NSA, CIA etc have done and are capable of, is in some respects utterly awesome. When they throw around that kind of capability and weight it should be respected, not feared or ridiculed.

At the moment we hear sirens and think "cops hurrying to the doughnut shop" not "fire engines rushing to save lives"

Maybe I am romanticising the role of the security services, but if they are not there for emergencies, then what are they there for?

I'm afraid that you are romanticising the role of the CIA and NSA etc. The CIA has become something like "The President's Private Army". I don't know what the NSA has become, but neither appears to "be there" in emergencies.
NSL's need to be seriously restricted. First off, they shouldn't be used for drug-related cases and "other" type of situations. They should be used for "imminent national security threat" sort of thing.

Second, all NSL's should be declassified after 6-12 months. Then we can see if the NSL was indeed used properly, or it if was abused.

Then again, why are NSL's given without a warrant in the first place? Would there be such a big difference in reponse time if they had to go through a judge first? I'm very uncomfortable with all these new laws trying to bypass the judicial process to "make things faster". Making things faster should not really be the point.

You're basically correct about his principles, but I feel like your post makes it sound like Schneier's just trying to save money and doesn't care about the actual lives involved.

I think an important point is that it is literally impossible to prevent all crime. Not only is it impossible, but as you try harder and harder to prevent it, you get diminishing returns and an increase in false positives (which we also want to avoid). So yeah, there has to be a tradeoff. If you can't ever get the number of deaths down to zero, then you have to decide, how low is close enough and how much are you willing to sacrifice to get there?

Right now, we're sacrificing a crap ton, and it's really not clear that it's gaining us all that much.

I beleive Schneier does care and was not intending to come across as belittling such things. Despite the Chuck Norris meme I am sure he is as human as the rest of us :-)

Its just we do live in a world where somehow we must efficiently allocate resources. In the UK we use a term QALY (Quality years of life) which is used to decide between which operations should go ahead (likelihood of success x expected number of qualifty years) - so a 80 year old looking for kidney dialysis is lower down the list than a youth looking for a common hip replacement. The US does it simply on income.

We should I feel have a debate on these things - why is it cars can kill thousands but a cancer drug cannot kill one or two. These trade offs get made in odd ways - and while I doubt we shall ever have politicians campaigning on the slogan "vote for me, only a tiny percentage of you will die because of it" its an important discussion.

I would suggest also a poll taken in the security / check-in lines at JFK:

  Would you support allowing one major terrorist outrage 
  a year if it would reduce queueing at airports by 

  a) 1 hour, 
  b) 2 hours 
  c) eliminate queues completely?
:-)
I love the last point, but there really is an argument to be made for keeping the unwashed masses ignorant of the best ways to harm people.
Is there? It seems to me that the majority of people are not murderers and have no intention of doing each other harm. People have plenty of obvious ways to harm each other at their disposal, but few people actually do so (and this is in a country with the highest violent murder rate of any developed nation).

To put it another way, everyone knows that a knife can be a deadly weapon. Yet we all have at least a few knives in our kitchens, and we are not piling up dead bodies. Would it really matter if everyone knew that, in addition to knives, they could also use some other common household item?

It is also the case that we learn how to kill/seriously injure people from our TVs all the time. Even countries with much lower murder rates have such violent entertainment.

I know it's sort of orthogonal to the point Schneier is making, but to my mind, many of his suppositions relating to Syria are off. I don't think doing preventative strikes even if we knew Assad was about to gas hundreds of civilians were on the table. That logic--prevention--was used in Libya and it has rightly fallen out of favor with the Obama administration, mostly because Libya has proven to be a real shit-show. In any case, attacking before a crime is committed is a dangerous precedent to set on the world stage, a recipe for perpetual war.

The limits of intelligence are real, but the Syria example is not the best one to use to illustrate the point.

...mostly because Libya has proven to be a real shit-show.

Did rational people expect otherwise? Fool us once, shame on the military-industrial-media-lobbyist complex. Fool us seventeen times...

Agreed, it's just a recent example but not a particularly good one. One possibility he doesn't consider is that we knew these weapons were likely to be used soon, but didn't have the knowledge or capability to target them effectively. Another issue is that even if you don't reveal sources by making information public you can affect the opposition's behavior. Announcing that Assad was about to use chemical weapons might have prevented him from doing so, or conversely might have persuaded him to use them even more liberally before they get taken out by strikes.
On the topic of the agencies' own success criteria: Schneier theorizes that NSA measures "by amount of data collected". While he declines to speculate as to the CIA's criteria, he suggests that their surprise at the end of the Cold War was not to their credit.

I think this is a misunderstanding. Any agency of the federal government measures success first and foremost by the volume of federal resources it consumes, and by the swelling of that volume over time. This priority is seldom articulated, and it isn't as though the "real" mission is ignored, but the structure of the organization and the incentives to which its members are subject make it obvious. To take the example of the NSA, their commitment to copy all the data is really a commitment to maintain their size at a fixed ratio with a quantity that will grow indefinitely.

Some might say this is a failing of the system, but it's enough to just recognize it as a property of the system. If we want the federal government to do a job, it usually will, but its performance will have this grow-spending-always, mission-as-afterthought quality. That isn't too terrible when the job at hand is redistributing wealth among the citizens: at least there's a chance that the progressive and regressive impulses will cancel out. When the task is actively destructive to the nation and the world, however, the organization must be controlled in some manner. No such entity will limit itself.

We are equipped to curb the excesses of e.g. the Department of Agriculture. However, the "secret" agencies have gotten a free pass from public scrutiny for 75 years. The answer to the dilemma is to end the culture of secrecy. No action of the USA government should be concealed from its citizens. There will be trade-offs involved with switching to this policy. Certain operations will be difficult or impossible when they can't be hidden from view. Those operations are typically counter to the long-term interests of the American people anyway, and the sooner they are stopped the better.

The unsavory, if still limited, view we have now of the actions of these agencies, speaks not of a failing of those agencies, but of our failing to understand their basic nature, and govern them accordingly.

Highly incorrect. NSA success is measured through a reporting system that tracks which reports are cited in other reports, and which reports get used in briefs (and the relative level of brief). This mechanism is used to determine the relative importance (funding) of certain functions, and used to cull functions that are not ultimately reportable. The ultimate say-so in targeting comes from the administration, based on what information they're most interested in.
So there is a possible future in which the President, his advisers, and others in the executive branch throw out so many reports and briefs as "useless, not worth the paper to print" the stench of ineptitude so overwhelms the NSA brass that they spontaneously decide, themselves, to stop building in Utah and not collect all the data?

Yeah, right. Pull the other one. Next you'll tell me an incumbent chief of police has realized the folly of The Drug War.

> I don't know how the CIA measures its success, but it failed to predict the end of the Cold War.

The answer is obvious -- the end of the Cold war hinged on the end of the USSR, and the end of the USSR was not a matter of intelligence, but broad historical forces and chance. If the CIA had had perfect field data, it still wouldn't have predicted the end of the Cold War, because the Russians didn't see it coming either.

This wasn't an intelligence failure, because no one had the required intelligence.

Can we say that it would have been good to predict this event, in that we could have wound down our arms procurement a bit earlier? (Of course, that probably would have just shifted the schedule on our next "existential" threat, from a few thousand bearded goat enthusiasts, but let's ignore that...)

If "intelligence" can't predict things we'd like to predict, perhaps we need something besides "intelligence"? Maybe we could hire some historians?

> Can we say that it would have been good to predict this event, in that we could have wound down our arms procurement a bit earlier?

Yes, absolutely, very good, very desirable. But not possible. :)

> If "intelligence" can't predict things we'd like to predict, perhaps we need something besides "intelligence"?

Hold on -- intelligence is only meant to give an accurate picture of the present, not the future. For the future, policy analysts digest the intelligence and make a best estimate of what's coming up. But the situation in the Soviet Union was so volatile that they couldn't anticipate their own immediate future.

> Maybe we could hire some historians?

Historians have perfect hindsight, not foresight. Consider that the French responded to World War I, the "war to end all wars", by building the Maginot Line, which represented perfect hindsight. In the opening days of World War II, the Germans went around it.

But the situation in the Soviet Union was so volatile that they couldn't anticipate their own immediate future.

I've never seen any reason to believe that. This was a planned economy, and yet no one was looking at production and consumption numbers? That strains credulity. I'm not talking about predicting something a decade out. I'm talking about seeing the numbers drop year after year, and realizing that there is a limit.

It is my understanding that this sort of observation was what convinced Gorbachev to start the whole glasnost/perestroika thing in 1985-86. I mean, that action killed the USSR, so it wasn't undertaken lightly. The nomenklatura knew they were backed up to the precipice, however, and it was the best they could come up with.

> This was a planned economy, and yet no one was looking at production and consumption numbers?

It's important to understand about that "planned economy" is that it was guided by ideology, not facts. In practice, this meant anything that contradicted ideology was ignored or denied. In the later years that was a habit of mind, but in the 1930s, Uncle Joe purged anyone who doubted the ideology -- liquidated them. The survivors took that lesson to heart.

This is how a bogus biological theory (Lysenkoism, or inheritance of acquired traits) because the centerpiece of Soviet biology in Stalin's time -- he killed anyone who suggested that his pet belief was wrong. This undermined all of Soviet biology and science, and destroyed any chance to have an effective science-based agriculture program.

SO much for the planned economy. But my point is that, as more and more signs of collapse appeared, the older policy-makers went into profound denial. That's what made Gorbachev possible -- once in power, he was willing to consider alternatives to the party line.

Gorby took office in 1985. If the CIA had noticed that event and the significance you attribute to it, when it happened, they still would only have gotten passing marks. To get the gold star, they should have noticed years earlier. That they never noticed, is what leads one to wonder what the hell they were doing all those years.
> If the CIA had noticed that event and the significance you attribute to it, when it happened, they still would only have gotten passing marks.

With all respect, you're assuming too much in hindsight. What Gorbachev was to do might not have been apparent even to Gorbachev in 1985.

> That they never noticed, is what leads one to wonder what the hell they were doing all those years.

You're assuming that the events were predictable in advance, by anyone. Obviously if the Politburo had been able to anticipate what Gorbachev would do, they would have had him killed instead of appointing him premier. On the basis that he won the post, no one had even the crudest foresight. Certainly not the CIA.

Obviously if the Politburo had been able to anticipate what Gorbachev would do, they would have had him killed instead of appointing him premier.

If Gorbachev had known the results of his actions ahead of time, he might well have chosen differently. I certainly don't assume that he wanted to kill the USSR. I agree with you that none of the old conservative dudes would have done what Gorbachev did, but that was the reason they chose him rather than another old dude in the Brezhnev-Andropov-Chernenko line. Even the old dudes knew that the economy was failing, and had been for a decade. Therefore they chose their youngest member as Premier. When he made major changes as they had asked him, I'm sure they were uncomfortable, and they might not have anticipated those particular major changes, but they couldn't very well be surprised. If there had been a radically authoritarian hard-line Communist option that he felt stood a major chance of saving the USSR, Gorbachev might well have chosen that. In any case, please don't take Gorbachev's actual, unsuccessful attempt to save the USSR as proof that no one knew it needed saving.

Gorbachev's actions were not so unlike Deng Xiaoping's in a similar situation, although of course results differed. That events turned out so much better for the Chinese Communist Party might be because they got a slightly earlier start, because of differences between China and USSR, due to chance, due to something else, or (probably) a combination of all of these. We in the West hold a more nuanced view of Deng, because we had a chance to see what he did after he won.

I'll make this prediction: if the government of Iran ever starts genuinely reforming itself from within, it will be because they have judged Iran to be in a very precarious situation, from which their current policies are unable to extract them. If the result is a radical departure from the existing political structure, simpletons in the West will lionize whichever youngish cleric is most associated with the reforms. If instead they succeed in their intentions, and just make small necessary adjustments to Iranian society, we'll all ask ourselves "why couldn't Iran have had a Gorbachev?"

I agree, and would add that the mission of the CIA is to assess foreign threats to the U.S.

The end of the Soviet Union was not a threat to the U.S., thus predicting the exact date of its occurrence was not a priority.

The sudden end of the Soviet Union was a massive threat to the United States.

The Soviet Union was a regime that by the 1980s had amassed a stockpile of tens of thousands of nuclear weapons, which were stored and deployed across the vast interior of the USSR. The regime was the only guarantor of the security of those weapons. A breakdown of the regime would (and did) throw open the question of who now controlled those weapons. A new successor state? Individual breakaway republics? Factions within the army or internal security forces? Non-state actors? Random locals who happened to show up at a silo with a big enough mob behind them to claim them?

The USSR also had huge conventional forces stationed across Eastern Europe, Asia and Africa. If the authority these forces reported to were to suddenly break down, how would they respond? Would factions among them split and fight each other? Would a general use his tanks to set himself up as King of Poland? Would a revanchist politician rally the army to establish a military dictatorship?

With hindsight we know the answers to these questions, but at the time we did not. Which is why intelligence agencies exist -- to help answer them.

Thanks to quick thinking and quick action by both Americans and Russians (and Ukrainians, and Belarusians, and Kazakhs, etc.) in the years following the dissolution of the USSR, Soviet conventional and nuclear forces were (mostly) secured. (See http://www.washingtonpost.com/wp-dyn/content/story/2009/09/2... for an example of one story from that time.) But there were no guarantees at the time that things would turn out as well as they did. So the question of whether the USSR was breaking up should have been of urgent interest to the CIA, because a breakup that went bad could have had catastrophic consequences for the US and the world.

That's a great point and I did not think of it that way. Thanks.
> The end of the Soviet Union was not a threat to the U.S.

But it was. When the Soviet Union was at the height of its power, all it wanted was to stay in power (the mandate of any empire). But when the Soviet Union ended, that was a time of maximum danger -- a rogue general, or a political radical, might take control of the state, and use doomsday weapons that the old guard was too wise to consider using.

Believe me when I tell you, the Soviet Union under Brezhnev was quite stable, all appearances to the contrary, but a collapsing Soviet Union was extremely dangerous.

And since the collapse of the SU, we've been doing all in our power to keep nuclear materials out of the black market, something that wasn't a possibility during the height of Soviet power.

> thus predicting the exact date of its occurrence was not a priority.

On the contrary, for reasons given above.

Who assumes that what the intelligence report says now is actually based in fact and not in convenient fiction? The US poised to attack Syria -- having long supported the opposition -- and the stars needed to align to help that happen. For a released intelligence report to yield the very strongly desired results, among a collection of agencies with a long history of bending the truth (patriotic so long as it served the end goal), should be met with a hefty serving of skepticism.
Totally agree, Call me a cynic but Schneier doesn't mention the possibility that the administration knew they could have effectively prevented their use but they don't really care that much about chemical weapons or the people of Syria. In fact, they may have seen their use as a political opportunity to provide justification for furthering American interests in the middle-east.
Let me say first that I am a technologist and I do have generally speaking an optimistic view of the future where technology actually solves most of our problems. I believe in the concept of the singularity where super-intelligent AI makes human intelligence irrelevant. I have a completely different worldview from almost everyone reading this thread so what I am about to say will probably just be dismissed as "conspiracy theories" or something but I need to say it just in case some people may be able to get something out of it without dismissing it out of hand.

Its going to be difficult for anyone who routinely exposes themselves to mainstream news sources to see any of what I am about to say as being credible. Especially in the tech community where rose-colored glasses are almost ubiquitous.

He wonders why they didn't stop the Syria chemical weapons attack and the Boston one. The reason is that those were false flag attacks. The Syria attack was committed by US-backed rebels and then blamed on the regime in order to be used as propaganda to motivate the extension of the covert proxy war in Syria into an overt one involving the US forces directly.

The Boston attack was used to motivate gun control which is important for securing the state against dissident factions when the economic situation deteriorates dramatically as it is likely to at some point when a substantive challenge to the petrodollar status is mounted.

Back to the war in Syria, I urge everyone to take a look at some maps of the middle east and Africa and make an X in all of the countries where the US and allies or related countries have been involved in recent decades (centuries). You will see that this is a long term military campaign rather than a series of isolated wars. Also take a look at a list of countries by proven oil reserves. Also look up 'petrodollar'.

http://www.indymedia.org.uk/images/2007/01/359290.jpg

The Afghan War should be considered the Third Opium War as it was largely motivated by the Taliban wiping out the heroin cash crop belonging to the Anglo establishment and intelligence agencies. http://publicintelligence.net/wp-content/uploads/2012/11/Afg...

The purpose of the NSA is not to control terrorism. It is to keep tabs on potential enemies of the US, both domestic and foreign. All US citizens and foreigners are actually considered potential enemies of the state. The closest thing for people to understand is to compare it to the East German Stasi. This type of apparatus may seem unnecessary now while the US is fat, happy and sitting pretty, but like I mentioned, the petrodollar cannot continue forever, and the state knows that. Economic conditions will some day change very dramatically and lead to large-scale hunger, and at that time the previous removal of citizen's arms and vast surveillance network will make the state much more secure in the face of growing domestic dissent.

Of course since most people have a totally different world view and are constantly bombarded by propaganda on television, this will all just seem like nonsense to you.