Prev: Saving passwords on disk
Next: Call for papers: ISP-10, USA, July 2010
From: Mok-Kong Shen on 16 May 2010 03:45

Schneier has a very nice article "Worst-case Thinking" in the May
15 issue of his "CRYPTO-GRAM", containing, among others, an interesting
quote from a former US politician.

For newcomers to the group: The leading articles of "CRYPTO-GRAM" are
IMHO invariably very well written. To subscribe, visit:

http://www.schneier.com/crypto-gram.html

M. K. Shen
From: Quadibloc on 20 May 2010 02:00
Bruce Schneier has made a number of interesting points about security
in the post-9/11 world in CRYPTO-GRAM. As they're about security in
general, and not cryptography, I've been hesitant to comment on them
here, as it would be off-topic.

He has noted that the best and most cost-effective way to combat
terrorism is through intelligence. This is true, but intelligence is
very difficult to obtain about terrorist groups. Hence, if one is not
content with the low-hanging fruit, but wants greater security, less
efficient measures are also needed.

He has noted that many existing security measures are not really
effective against terrorists, who can attack new and different
targets. This is true, but dismissing them as "security theater"
misses a few facts. As some people are fond of reminding us for
political reasons, al-Qaeda is not the only source of terrorism;
remember the attack on the Albert Murrah building.

One thing that 9/11 has done is that it has suggested a potential way
to commit a highly destructive act. Such an event, by its nature,
inspires copycat attacks. Their sources could include:

- violent political radicals of all stripes and causes;

- homegrown sympathizers to the goals of al-Qaeda who do not have
access to their training or direction;

- just about anyone who is suicidal because his girlfriend left him.

Thus, closing the barn door after one horse has gone, and addressing
the plots of movies that people have watched... is not useless, but,
rather, is one legitimate component in a multi-pronged security
strategy.

And, if those charged with homeland security were doing their jobs
right, it would *not at all* be surprising that the _least_ effective
of the security measures they are taking are the ones that receive the
_most_ publicity. By its nature, intelligence collection about
terrorist plotters takes place quietly, until some of them are found
and need to be dealt with.

This is not to say that there are grounds for this level of optimism,
or that the TSA is not guilty of some obvious silliness. But it does
seem that some of what he criticizes would be dangerous to drop.

John Savard
From: Bryan on 20 May 2010 22:37
John Savard wrote:
[...]
> remember the attack on the Albert Murrah building.

Well enough to spot that "Albert" is wrong.


--
--Bryan
From: Quadibloc on 21 May 2010 18:33
On May 21, 7:02 am, Simon Johnson <simon.john...(a)gmail.com> wrote:

> We certainly should not be spending billions of dollars on it when
> thousands of people die from preventable heart diseases, lung cancers,
> strokes and car accidents.

That is a serious fallacy. Ignoring terrorism is dangerous in a way
that ignoring car accidents and heart disease is not. If we do
absolutely nothing further to reduce deaths from car accidents and
heart disease, this will not make car accidents or heart disease start
doubling in frequency every year - the causes of these problems cannot
react to our inaction and take advantage of it.

Terrorist acts, though, are carried out by _people_. People with
specific goals to intimidate us and affect our behavior. So they have
to be combatted very intensely, so that terrorism does not reap
rewards by making U.S. voters afraid to continue support for Israel,
for example, and so that the terrorists don't follow up their initial
successes with larger and larger attacks.

Car accidents are a static hazard - we can push them down by taking
action, or not, but they don't react either to our choices in that
regard or to our foreign policy.

John Savard
 | 
Pages: 1
Prev: Saving passwords on disk
Next: Call for papers: ISP-10, USA, July 2010