Bruce Schneier debates former TSA boss

As for the content of the debate: I've been following Schneier's commentary on airport security for at least a few months now. What he's saying is no surprise to me. He's preaching to a choir of which I am a fast and firm member. On the other hand, I'm actually amazed at the willingness of his opponent (Kip Hawley) to concede some points that I would have thought were held as unshakable dogma amongst the TSA-apologist set. To me, genuine progress was made in this debate. This was not a case of two people's arguing pre-fixed talking points in circles around each other. This felt more like a real discussion, with give and take.

Kudos to The Economist for hosting this debate, and for attempting to innovate on the printed-debate format. To date, it's a format that nobody's quite nailed. (Nor, for that matter, has The Economist here). But it's an interesting step forward.

From the guidelines:

"You can make up a new title if you want, but if you put gratuitous editorial spin on it, the editors may rewrite it."

The first paragraph of Hawley's opening statement is a complete non-sequitur and doesn't bode well for the rest of his arguments.

But both agree on a picture of airport security going forward that is much more pre-911.

So its the TSA guy trying to CYA and not be held accountable for the cost carried so far, but conceding it has to end.

Bruce's argument is like this: There are two kinds attackers, amateurs and pros. Amateurs are easily caught because they don't have the time or knowledge to properly plan an attack and the pros have the resources to work around any defenses the TSA has set up because the TSA cannot be proactive enough in its measures. Bruce argues that post-9/11 security measures are both superfluous and insufficient at the same time.

However, what if the amateurs and pros could work together? What if the pros developed attacks and published the directions? Amateurs could use those directions to their hearts content. In that sense, reactive security may not prevent al Qaeda from attempting new clever attacks, but it will prevent copycat attacks an the part of sympathizers (or folks with their own agendas) who have no overt connections to major terrorist networks. Organized criminal hacker organizations have been known to pull this very same stunt by releasing easy to use programs which make it possible for dilettantes to pull off attacks that they would otherwise be unable to do.

In fact, it's a little bit like computer security, where, every time a vulnerability is discovered, either by a security researcher, or through a successful zero-day exploit, a patch is developed to plug the hole and thousands of sysadmins apply the patch as soon as possible. In this way, we can't prove that say, Apache, has no vulnerabilities, but we can be sure that it has no known vulnerabilities and all the easy ones to find have been dealt with long ago.

So it seems to me, that by routinely 'plugging holes' so to speak by implementing reactive measures, the TSA is increasing the marginal cost of each attack for al Qaeda significantly, and this hypothetically, does increase security.

Of course, that doesn't detract from any of the other arguments against the TSA in it current incarnation, especially the obvious haphazardness of its measures, the occasional abusiveness of screeners, and its political essence. It does though, seem to make one of Bruce's arguments seem less strong.

And nothing will change though the Economist debate, or any other debate. Only declining profits for the arilines, spurred by declining passenger miles, will force change.

By then, TSA-esque processes will probably exist for every form of transport, including automobiles.

Isn't it stunning how long it takes for our elected representatives to even begin to decide to do the right thing?

Granted, there was an overreaction to security following 9/11. We understand that the TSA needed to figure out how to do the job the public expected. We gave them almost a decade.

Concerns started to really amp up at the end of 2010 when those scanners started to appear. Last year, when so many stories surfaced of children being trauma-searched, TSA employees misusing the near-naked images, and then the full-body grope pat-downs -- I fully expected some prompt hearings and action from our elected representatives.

What did we hear from the people who are supposed to be protecting the citizenry? Nothing.

Better late than never, I guess.

I would take the "secure" option because who is left taking the "non-secure" option? Terrorists.

If all the flights were "non-secure", just like every train ride, then we spread the terrorists out and my odds are better.

The end goal of terrorists is to fight a war or change government policy (through acts of violence). They may have a goal of terrorizing, and they may even enjoy causing harm and terror, but that is still a means to some other end, not an end in itself. The USA is targeted because of how it exercises its power in foreign policy. That does not imply that terrorism is deserved, just that actions have consequences and should be discussed in a more intelligent way rather than deceiving ourselves with over-simplistic notions.