Security theater

Security theater consists of security countermeasures intended to provide the feeling of improved security while doing little or nothing to actually improve security. [cite book
last = Schneier
first = Bruce
authorlink = Bruce Schneier
title = Beyond Fear: Thinking Sensibly about Security in an Uncertain World
publisher = Copernicus Books
year = 2003
pages = p. 38
id = ISBN 0-387-02620-7 ] The term was coined by Bruce Schneier for his book "", but has gained currency in security circles, particularly for describing airport security measures. It is also used by some experts such as Edward Felten to describe the security measures imposed after the September 11, 2001 attacks. Security theater gains importance both by satisfying and exploiting the gap between perceived risk and actual risk.

Definition of security theater

Security theater has been defined as ostensible security measures which have little real influence on security whilst being publicly visible and designed to demonstrate to the lesser-informed that countermeasures have been considered. Security theater has been related to and has some similarities with superstition.

Disadvantages

Security theater has real monetary costs but does not necessarily provide tangible security benefits. Security theater typically involves restricting certain aspects of people's behaviour in very visible ways, that could involve potential restrictions of personal liberty and privacy, ranging from negligible (where bottled water can be purchased) to significant (prolonged screening of individuals to the point of harassment).

The direct costs of security theater may be lower than that of more elaborate security measures. However, it may divert portions of the budget for effective security measures without resulting in adequate, measurable gain in security. In many cases, intrusive security theater measures also create secondary negative effects whose real cost is hard to quantify and likely to dwarf the direct expenses.Fact|date=March 2007

Such ripple effects are often connected to fear; visible measures such as armed guards and highly intrusive security measures may lead people to believe that there must be a real risk associated with their activity. Other reasons for ripple effects may be that people are simply unwilling to undergo such intrusions as would be required for some activity by the security measures imposed on it.

An example for both issues is that after a recent increase in restrictions in air travel, many frequent air travellers have expressed that they will try to avoid flying in the future. Incongruously, car travel, which is often considered as the alternative, is in fact riskier than air travel. [cite journal |title=Executive Protection - Alternate travel issues |url= http://www.lubrinco.com/ejournal/ej200312.pdf |journal= ÆGIS e-journal |volume= 6 |issue= 12 |month= December | year= 2003 |pages= 5–6|format=PDF]

Security theater encourages people to make uninformed, counterproductive political decisions. The feeling of (and wish for) safety can actually increase the real risk.

The disruption, cost, and fear caused by security theater acts as positive feedback for those who wish to exploit it: even if they fail to take lives, they can cause large economic costs.

Security theater is a component of the culture of fear.source

Critics such as the American Civil Liberties Union have pointed out that the benefits of security theater are temporary and illusory since after such security measures inevitably fail, not only is the feeling of insecurity increased, but there is also loss of belief in the competence of those responsible for security.

Benefits

While it may seem that security theater must always cause loss, it may actually be beneficial, at least in a localised situation. This is because "perception" of security is sometimes more important than security itself. If the potential victims of an attack feel more protected and safer as a result of the measures, then they may carry on activities they would have otherwise avoided. In addition, if the security measures in place appear effective, potential attackers may be dissuaded from proceeding or may direct their attention to a target perceived as less secure.

Security theater may also be useful where a threat is perceived to be more likely than it really is; in these cases, it can bring the risk's perception in line with its reality. For example, a gated community might have weak enough security that the gates don't really reduce the risk of crime, but if it is in a low-crime area anyway the gates can help ensure that people feel as safe as they ought to.

Security theater has also proven itself effective in reducing shoplifting, particularly for businesses too small or otherwise unwilling to spend money on actual security measures. Examples of this include the use of mock surveillance cameras and empty camera housings; attachment of devices with blinking indicator lamps (and no other function) to high theft goods; and placing periodic make-believe security-related announcements on the store's public address system such as, "Inventory control...Please zoom cameras, focus and record zones 5, 8, and 9."

Examples

It is inherently difficult to give examples of security theater that are clear and uncontroversial, because once it is agreed "by all" that a measure is ineffective, the measure seldom has any noticeable influence on perceived risk. As such the following are examples of alleged security theater.

* The American government has introduced a screening system called Computer Assisted Passenger Prescreening System. This system relies on static screening of passenger profiles to choose which people should be searched. Systems of this nature have been mathematically demonstrated to "reduce" the effectiveness of searching below that of random searches since terrorists can test the system and use those who are searched least often for their operations. [cite paper
author = Chakrabarti, Samidh and Strauss, Aaron
title = Carnival Booth: An Algorithm for Defeating the Computer-Assisted Passenger Screening System
publisher = Massachusetts Institute of Technology
date = 2002-05-16
url = http://www.swiss.ai.mit.edu/6805/student-papers/spring02-papers/caps.htm
accessdate = 2006-09-06 ]
* With the aim of preventing individuals on a No Fly List from flying in commercial airliners, U.S. airports require all passengers to show valid picture ID (e.g. a passport or driver's license) along with their boarding pass before entering the boarding terminal. At this checkpoint, the name on the ID is matched to that on the boarding pass, but is not recorded. In order to be effective, this practice must assume that 1) the ticket was bought under the passenger's real name (at which point the name was recorded and checked against the No Fly List), 2) the boarding pass shown is real, and 3) the ID shown is real. However, the rise of print-at-home boarding passes, which can be easily forged, allows a potential attacker to buy a ticket under someone else's name, to go into the boarding terminal using real ID and a fake boarding pass, and then to fly on the ticket that has someone else's name on it. [ [http://www.boingboing.net/2005/02/07/slates_andy_bowers_o.html Slate's Andy Bowers on Airport Security loopholes - Boing Boing ] ] [ [http://www.schneier.com/crypto-gram-0308.html#6 Crypto-Gram: August 15, 2003 ] ] [ [http://slate.msn.com/id/2113157/fr/rss/ A dangerous loophole in airport security. - By Andy Bowers - Slate Magazine ] ] [ [http://www.boingboing.net/2006/11/01/fake_boarding_pass_g.html Fake Boarding Pass Generator mirror site - Boing Boing ] ] Additionally, recent investigations show that obviously-fake IDs can be used when claiming a boarding pass and entering the departures terminal. [http://www.kctv5.com/Global/story.asp?S=6511234] [ [http://www.boingboing.net/2007/05/15/flying_without_id_wo.html Flying without ID won't work? Try making your own ID. - Boing Boing ] ] (Another assumption that must be made in order to justify this system in the first place, let alone to conclude it is effective, is the assumption that the No Fly List is a reliable list of potential attackers, i.e. that a name is on the No Fly List if and only if that person is a probable attacker).
* Random searches on subway systems, such as those taking place on the New York City Subway system, have been criticized by the American Civil Liberties Union and others as security theater. They allege that since such searches are only at some stations and that people may decline such a search and simply leave that station, a terrorist could simply find a station where no searches were occurring and board there.Fact|date=February 2007
* The 1950s "duck and cover" drills in U.S. public schools – which suggested that ducking under a desk is a reasonable way to protect oneself from the nuclear detonation of an atomic bomb – are an example of security theater.

Avoidance

Many security expertsWho|date=March 2008 believe that avoiding security theater is a desirable goal. They claim that by training people in risk acceptance and by educating people in the real risk levels of the activities they are involved in, security theater and the waste associated with it could be made to go away.Fact|date=March 2008

An alternative and important approach would be for those in charge of security to attempt to the best of their ability to explain and be honest about security risks. This method may be considered difficult since those who are responsible for making decisions about risk may fear that their own words will be used against them, for example in lawsuits.Fact|date=March 2008

Usage

*New York Times; December 17, 2006; "Theater of the Absurd at the T.S.A. For theater on a grand scale, you can’t do better than the audience-participation dramas performed at airports, under the direction of the Transportation Security Administration. ... The T.S.A.’s profession of outrage is nothing but 'security theater,' Mr. Schneier said, using the phrase he coined in 2003 to describe some of the agency’s procedures."

*Associated Press; July 20, 2007; "Report: Plane Lighter Ban to Be Lifted. Airline passengers will be able to bring many types of cigarette lighters on board again starting next month after authorities found that a ban on the devices did little to make flying safer, a newspaper reported Friday. 'Taking lighters away is security theater,' Transportation Security Administration chief Kip Hawley told The (New York) Times in an interview."

ee also

* Airport security repercussions due to the September 11, 2001 attacks
* Culture of fear
* Christopher Soghoian

References

External links

* [http://www.schneier.com/crypto-gram.html Crypto-Gram, Bruce Schneier's newsletter]
* [http://stupidsecurity.com/ stupidsecurity.com a site highlighting inefficient security measures]
* [http://wondermark.com/d/220.html Webcomic about security theater]