Security Theater

Security consultant, author, and expert Bruce Schneier had in essay on titled In Praise of Security Theater. A sample:

Security is both a reality and a feeling. The reality of security is mathematical, based on the probability of different risks and the effectiveness of different countermeasures . . . But security is also a feeling, based on individual psychological reactions to both the risks and the countermeasures. And the two things are different: You can be secure even though you don’t feel secure, and you can feel secure even though you’re not really secure.

The essay embodies Schneier’s typically clear-eyed analysis of security issues. It is worth reading in full, either at the link above or at Schneier’s blog.

5 Replies to “Security Theater”

  1. Maritza

    Hello I am so delighted I found your blog, I really found you by mistake,
    while I was browsing on Digg for something else, Regardless
    I am here now and would just like to say thank you for a marvelous post and a all round enjoyable blog (I also love the theme/design), I don’t have time to
    look over it all at the moment but I have saved it and also included your RSS feeds, so
    when I have time I will be back to read a great deal more, Please do keep up the great

  2. Kala

    Howdy! I know this is kind of off topic but I was wondering if you knew where I could locate a captcha plugin for
    my comment form? I’m using the same blog platform as yours and I’m having trouble finding one?
    Thanks a lot!

  3. student330

    The reality and feeling of security are both essential for the government and private corporations to employ. The government should be held responsible for effectively managing international relations and treaties so that the United States is secure, and as a further step, should employ some security theater to maintain public calm. In the face of an imminent catastrophe such as the Cuban Missile Crisis, it is often better for the government to use security theater than be open with the public. I am sure there are thousands of bone-chilling government cover ups that were probably kept under wraps for the good of the American people. For the most part, complete frankness should be employed by the government. But, when this frankness causes severe public unrest, more people could get hurt than necessary.

    Private companies have ethical concerns and should be frank with the consumer, but they also should be extra cautious and employ some security theater in order to minimize their own liabilities. With insurance premiums today and the risk of lawsuits, companies have no choice but to employ some security theater. In the case of tamper-resistant packaging and poisoning scares, the new packaging was an important step in easing the unrest of the consumer. In reality, any edible consumer good could have been just as easily poisoned as medication. Nonetheless, should consumers have stopped taking medication because of the small risk that it could have been poisoned? This fear was not practical enough to be addressed fully. It would not have been practical for all medicines to come in reinforced titanium canisters. Plus, the tamper proof packaging does have its benefits: children are less prone to open dangerous medication, and the packaging does make it difficult for individuals to add foreign ingredients to certain products without the use of needles or syringes. Of course, if someone really intended to poison medication, they could eventually employ the use of needles; but, this same person could poison milk, cereals, juices, and thousands of other products as well with much less effort.

    As mentioned in Mr. Schneier’s essay, RFID tags may not be worth the cost, but they may be worth the peace of mind that mothers and fathers feel when they know that their babies are in safe hands. If it is true that kidnapping rates have plummeted in hospitals, why should hospitals refrain from employing methods to convince parents not to worry? The hospitals are not lying by enforcing the use of the new technology, they are only improving the lives of worried parents. As long as hospitals truthfully employ security measures, the better it is for both parties. An even better measure would be to make the RFID tags optional and give parents the full facts about hospital kidnapping decline. If parents are still worried, they can opt for the RFID tags. If many parents do opt for the tags, it will be evident that they care about the feeling of security almost as much as they care for real security.

  4. rlromero

    I feel comfortable with security theater as long as its purpose is consistently effective. However, Schneier remarks that baby abductions are not common and that the use of RFID bracelets are more for keeping mothers relaxed when their newborn babies are beyond their supervision. Do mothers not worry about their babies being dropped if they feel confident that their babies will not be abducted? The RFID bracelets only cover one aspect of safety, and even then, I’m sure a hospital employee could easily abduct a baby (not the brightest idea, though).

    Also, I believe that simulating a secure environment wastes resources. Government should use these resources to develop foolproof systems instead of opting for immediate ways to ease people’s worries. Psychologically influencing the public with security theater can lead to psychological frustration (and lawsuits) when people discover what the “show” is all about. Based on feeling, I can say that I feel more secure in knowing I am safe because research has proved I am or because experienced professionals are running the show — not because it looks like I’m safe.

  5. mfrey12

    Schneier’s article was very thought-provoking. He seems to completely zero in on different people’s issues with security. Feeling secure and actually being secure are two very different concepts. The example with the bracelets put on infants is a great example of feeling secure and actually being secure. Nowadays, the threat of having an infant kidnapped out of a hospital is so small, yet precauti ons are still taken. It’s understandable as to why they do it—limit the liability of the hospital, make the new mother feel comfortable, etc.—but in reality, it’s not very necessary. I must admit though, sometimes I know feeling secure (to me) is all I need. As illogical as it may seem, this feeling of security that Schneier describes can be more powerful than actual security. I know that when I was flying to California a few months after 9/11, it made me feel a lot better to know there were soldiers in the airport…even though they would probably be unable to do anything in a real threat emerged. Sometimes people just need to see and feel like something is being done to ensure security. However, I do agree that people should try and match their true security with the feeling of being secure. Especially in the time we live in today, perhaps it’s more important to concentrate on actual security measures that are being instituted (though this may be hard) instead of dwelling on the façade of security…

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.