Rossander’s Security Reader

Security Theater is a difficult topic for any security person to talk about. First what is it – Security Theater in my mind are those ‘security’ restrictions that don’t actually improve security. They’re put in place to make somebody feel better or to give the appearance of improved security regardless of their actual effect. They may be well-intentioned but they are generally poorly thought out.

For example, the early restrictions imposed at the airports which attempted to stop people from bringing “weapons” on the plane used a definition of ‘weapons’ that was so bad that all kinds of immaterial tools were confiscated. Yes, a 10″ screwdriver could conceivably be sharpened and used as a punch knife. You’d need a file and a half-hour or so unobserved to sharpen it – not things likely to happen in any concourse I know of but it’s theoretically possible.

The hypocrisy, though, is that they never banned pens or pencils. A number 2 pencil is already sharper than most knives and just as dangerous.

But even assuming the most liberal interpretation of ‘weapon’, what possible harm can an evildoer perpetrate with the miniature phillips head screwdrivers that many people carry to tighten the screws on their eyeglasses? There simply is no defensible argument for that restriction. Unless you think that no one will notice as the offender sits there for another half-hour and tried to take apart the plane?

The confiscations of those tools (which, while not perfectly safe, were as safe as other routine objects allowed through) represent an unjustified sacrifice of civil liberties. Security is important. But it is not the end desire of all life or of business. Security is about managing risks and balancing the risks against the benefits.

Security folks (including myself) often have a hard time with this concept. Our job – our whole purpose in life – is often focused on thinking about security, increasing security and reducing risks. We often don’t have the perspective to see the benefits or liberties that we’re infringing with our policies. And we certainly don’t have the incentives to look for those benefits.

This, unfortunately, is why security people should never be allowed to have the final say in the security policy. If you have your own business, have someone who is responsible for security. And listen to them carefully. But make sure that you have both sides of the argument – the benefits from security and the consequences of the policy. Remember that a risk-free environment is not possible. Good security is about balance.