The WSJ reported recently that the FBI, looking for fresh leads in the 1982 case of Tylenol poisonings, suspects Ted “Unabomber” Kaczynski and is trying to get hold of a sample of his DNA. Coincidentally I was just thinking about that case thanks to Bruce Schneier. In his recent TED talk he mentions that the Tylenol incident led to tamper-proof caps — a perfect example of what Schneier likes to call “security theater”:
As a homework assignment, think of 10 ways to get around it. I’ll give you one, a syringe.
So far this is typical Schneier. It’s a great point, but one I’ve heard him make many times before. In the next sentence, though, he breaks new ground:
But it made people feel better. It made their feeling of security more match the reality.
Bruce Schneier used to mock the theatrical dimension of security. Now it seems his thinking has evolved — and in a really interesting way. He’s alway viewed security in a relativistic way, and as a game of economic tradeoffs. Here he twists the lens to bring something else into focus: the relationship between how secure we feel and how secure we are.
We know that modern hominids evaluate risk poorly:
One way to think of it is that we’re highly optimized for risk decisions that are endemic to living in small family groups in the East African highlands in 100,000 B.C. — 2010 New York, not so much.
There are two ways our feelings about our security can disconnect from reality. We can have a false sense of security, as when we underestimate the risk of automobile travel. Or we can have a false sense of insecurity, as when we overestimate the risk of air travel.
What matters most, Schneier suggests, is that we align feelings and reality. And if security theater helps us do that, then it’s a perfectly good thing. The Tylenol episode represents the kind of risk that the media thrive on and magnify. People felt unsafe even though they were astronomically more likely to die in other ways. Tamper-proof caps may be a purely theatrical response, but that may still be useful.
Technologists too rarely display this kind of nuanced thinking; it’s refreshing to see it.
May 23, 2011 at 8:26 am
Thanks Jon, for this post and the pointer to (the great…) Bruce Schneier’s TED talk.
Clearly the “security theater” we endure at the airport is another application of the Tylenol principle, at a very expensive scale. But the US government hadn’t implemented highly visible changes, a large percentage of people likely would not have resumed travelling.
Indeed one can imagine the dialog at the airlines: damned if we do, damned if we don’t…but in this case, the “damned if we don’t” encompasses the economic consequences of not making people feel safer — even if (statistically) they aren’t.
May 23, 2011 at 8:59 am
But wouldn’t he say that we over-estimate the risk of air travel? So then wouldn’t that justify TSA theater? (I guess I’m going to have to check out the original…)
May 23, 2011 at 9:38 am
Maybe this suggests a useful metric for our TSA investment. If airport security theater makes us feel safer, thus aligning our feeling with the reality, then you could argue it has value.
My own feeling has been that nobody feels safer because of the airport theatrics. But…it’s something that could be tested!
May 23, 2011 at 10:47 am
Is a feeling of safety even the goal of TSA security fever? My sense of its introduction and evolution is that is was always intended to *increase* the level of fear.
For example, who would now remember that some guy hid explosives in his shoes, many years ago, if we did not ritually remove our shoes whenever we enter an airport?
I recall that visible changes — longer lines, increased “threat” levels, new restrictions — in the years 2001-2008 often occurred a few months in advance of US elections.
May 23, 2011 at 11:54 am
I believe there is an other aspect which is equally important. The price of the measure for feeling safer.
Where the tamper-proof cap is cheap to implement… the cost of the measures implemented to make flying appear safe, is so great it has a negative effect on making flying safer (e.g. the cost of the TSA/body scanners etc. is not used to make the FBI/CIA better).
May 23, 2011 at 1:11 pm
I think the only people who feel safer flying due to TSA theatrics are the people who never or rarely fly in the first place. At least that’s what the empirical evidence from talking with people at airports and other places has shown me.
Is making flying feel safer for people who never fly a laudable goal?
May 23, 2011 at 2:41 pm
[...] A new appreciation of security theater - The WSJ reported recently that the FBI, looking for fresh leads in the 1982 case of Tylenol poisonings, suspects Ted “Unabomber” Kaczynski and is trying to get hold of a sample of his DNA. Coincidentally I was just thinking about that case thanks to Bruce Schneier. [...]
May 23, 2011 at 2:59 pm
[...] I know Bruce Schneier was very hard on TSA’s changes in screening over time since they were first rushed into service. If Bruce’s attitude towards Security Theater can evolve, so can mine. The WSJ reported recently that the FBI, looking for fresh leads in the 1982 case of Tylenol poisonings, suspects Ted "Unabomber" Kaczynski and is trying to get hold of a sample of his DNA. Coincidentally I was just thinking about that case thanks to Bruce Schneier. In his recent TED talk he mentions that the Tylenol incident led to tamper-proof caps — a perfect example of what Schneier likes to call "security theater": As a homework assignment, … Read More [...]
May 24, 2011 at 1:32 pm
[...] Udell has a great post today on people’s expectactions about their security: In his recent TED talk he mentions that the Tylenol incident led to tamper-proof caps — a [...]
May 25, 2011 at 11:08 am
It is, indeed, nuanced thinking to recognize that tamper-proof caps enhance people’s SENSE of security and are valuable for that, even if they do not decrease the risk of getting poisoned in any meaningful way.
But while SOME people may engage in that kind of nuanced communication, most do not. So when the caps were added, people didn’t say “We’re adding these because it makes people feel safer.” They said “We’re adding these to reduce the threat of poisoning.”
And this was NOT a meaningless distinction. It took years before pharmacies went back to offering simple screw-on caps for those who request them. And during those years, there were millions of incidents in which the elderly, the infirm, and others who couldn’t manage to get the darn caps off found themselves unable to take their medicine. I would speculate that there were many times more deaths due to tamper-proof caps than deaths due to poisoning of pills.
It is not an isolated incident. Today, we pay security guards to throw away tens of thousands of water bottles and shampoo containers because it makes people FEEL better about airline security; surely we all realize that it does not actually reduce the risk of flying in any meaningful way. But the costs of such decisions are significant.
So I would say that the nuanced thinking is valuable as long as it is communicated in a nuanced way. But if the nuanced thinking is used as an excuse to implement policies that do not, in fact, improve outcomes and this fact is NOT communicated, then I feel it is harmful overall.
May 25, 2011 at 3:38 pm
I shouldn’t put any more words into Bruce’s mouth than I already have. But it seems to me he’s suggesting that alignment of feeling with reality — in either of the ways described — /is/ an improved outcome.
May 26, 2011 at 4:54 am
I need some term, above I used “improved outcomes”, to refer to “first order effects”–security that directly reduces the risk it addresses–as distinguished from “second order effects”–security that aligns people’s beliefs with the actual risk.
If you communicate honestly about what is a first-order and what is a second-order effect, then that is useful. But the concept is so nuanced that I fear it is MIScommunicated more often than not. And this leads to real problems like deaths among the elderly who can’t easily open a tamper-proof lid.
June 2, 2011 at 7:58 am
Interesting! I think people choose their own security and safety accordingly to their latent cognitive biases.
June 4, 2011 at 12:06 am
In my opinion, having all the security is a good thing, maybe it is not perfect but it helps a little. Nice post, I will share it on Facebook.