Bruce Schneier, a cryptographer, computer security specialist and founder and chief technology officer of BT Counterpane, lives in Minneapolis. He spoke with Jonathan Gaw.
Q When a company or government entity has a security proposal, how should they evaluate that? What sort of principles should they be looking for to determine whether this is going to be an effective security solution?
A First, you have to understand that security is a tradeoff. Whether you give money, or time, or convenience, or civil liberties, or American servicemen's lives, you give something and you get some security in return. There's no such thing as absolute security: It's a continuum and it's a tradeoff.
The next question to ask is, is it worth it? You have to go through a security tradeoff, tease out what the risks are, how good the countermeasures are, what the costs are, and then decide "Is it worth it?"
Pulling it apart can take an emotional debate and make it more rational because it forces you to stop and think and not just jump to a conclusion because you know it's right, but figure out why it might be right.
Q A lot of security proposals make a tradeoff between security and privacy. Is it worth it?
A If security and privacy were opposites, we would have all run to the former East Germany because it was such a secure place to live. It doesn't work that way. The real debate is liberty vs. control. When people are afraid, they just want to feel better, and measures that don't do any good but make you feel better, people are going to support.
Q That's "security theater," your term for things that make us feel secure, but not actually secure. Are there times when security theater works?
