Schneier Always Undermines the Legitimate Liberal State

Here we go again with Bruce Schneier, the lapdog tech media's favourite security guru, who always rants about government surveillance as the worst thing first, then Google and Facebook surveillance as the next worse thing at a distant second, and implies we all need privacy lockdowns with "transparency for me and not for thee" -- and never has a solution to the evils that prompt the actions taken on the basis of "the surveillance state" in the first place.

China, Anonymous, the ambitious Paula Broadwell who brought down a respected general -- well, these are all problems we can think about some other day. They aren't really threats. We should only think about our privacy and the implications for the evil security state pursuing these threats for ourselves.

How can we opt out from the ubiquitous Schneier?

The problem with him is that he never concedes the more alarming situation for our rights, particularly to online freedom of association and freedom of expression, if we allow to rule the Chinese Communist Party, which is bent on undermining our nation, Anonymous anarchists who take down sites they don't like and dox people and harm their privacy, and selfish ambitious women who have extra-marital affairs and open up the head of the CIA to blackmail by hostile foreign intelligence agencies.

It's not like the security state that Schneier always thinks has to be undermined with his shenanigans and alarmists agitprop pieces is in fact the same thing as China, or anarchists or selfish vixens. It's in fact a liberal democratic state that ensures human rights for all, so that neither China, anarchists, or careerists can undermine good governance that ensures people's rights.

So there has to be a balance, and we don't get it from him, as at the end of the day, he has nothing to say about the problem for privacy that comes from the Chinese Communist Party or the anarchist Anonymous movement, which really is sinister in its desire to seize power or even the extrajudicial harassment that someone like Broadwell represents.

 

 

Comments

[Andrew]

You really are unhinged, here.

You're saying that because Schneier mentions Chinese hackers, an Anonymous member and the woman David Petreaus cheated on his wife with without denouncing them in your kinds of shrill tones, that his piece isn't balanced?

I think that if Schneier wanted to write about the larger problems posed by Chinese hackers or Anonymous, he could probably have done so with quite a bit of fluency. I'm not sure why you consider Paula Broadwell to be in the same sort of category, especially since the "security" technique her and Petraeus used to try and hide their affair was laughable at best.

I'm really not sure why you got it in your head to attack Bruce Schneier, a guy who to my knowledge hasn't defended Anonymous at all, has said almost nothing about WikiLeaks or Aaron Swartz or any of the other drums you like to beat.

It appears his only transgression was to stick to his own area of expertise, which is actual security, by writing about how those people managed to get themselves tracked. It looks as if he didn't start shouting about how evil the Chinese, Anonymous and Paula Broadwell are or how they are the bigger "security threat" because that's not what he writes about.

His piece is about being tracked on the Internet, not whether the people who got tracked are evil.

What's your problem?

[Catherine Fitzpatrick]

No, I'm just calling out the very obvious flaws in the Schneier religion, that's all.

I've always been utterly, totally unimpressed with Schneier, who isn't about anything except consulting fees for himself. He has no theory of real security, but spends all his times sneering at the solutions others devise as imperfect. Well, all security systems are imperfect; human nature is imperfect.

Schneier really lost any credibility when he said that examining passports before people boarded a plane, or ID checks in general, was pointless. This is insane. *This is what is insane, not me*.

Yeah, I get the literalism here, that checking a face and hearing someone claim they are who they claim won't work against a determined criminal who will have a perfectly faked passport and rehearsed line. But in fact...he will have to get through that acting effort and "pass" -- and the organic knowledge of facial expressions, behaviour patterns, etc. are something an organic human can detect as possibly a problem by doing an ID check. He will also eliminate people with no ID at all, or expired ID or inconsistencies, i.e. the inability to state their whole name as on the passport. And that's all okay to do. That's why what he said was *nuts*.

Chinese hackers are very much the issue in security, and Schneier doesn't have a world view that includes a reason why they shouldn't win. He's a technocratic pragmatist and probably shrugs and says, well, they're the superior civilization, who cares about freedoms, the elite like me will enjoy them anyway. Or something. That's just it. You never get anything from him but his willingness to sustain his own class of people as necessary elites.

Every single story I've read about Schneier has done the following, which is why I'm merciless about him:

o sneered at "security theater" as "unworkable" or "ineffective" -- he was particularly popular during the initial scare and hatred and vilification of the TSA by technocommunists and Ron Paul libertarians

o minimize certain things as trivial, i.e. he has never taken Anonymous seriously and just thinks they're kids with not particularly bright moves

o he doesn't have to say a word about Swartz to let me know that he thinks CFAA is overkill -- and the reason that's likely the case is because it would harm his own white-hat "explorations" if there really were "overkill"

o for Schneier, the problem is always the government, and not foreigners, or non-state actors, or even individuals with agendas. That's because it's an organized power that as a "progressive" he feels is the greatest evil in the world. I disagree.

His piece is about getting tracked on the Internet *mainly by the US government as the primary evil* and then as a distant second *services like Google and

But overall, our country faces many more attacks by the Chinese and Anonymous, and many more people with attacks by mean types with vendettas, than it does by the government. That's just the reality. The reality he distorts.

Let's see now....when was the last time the government intruded on anyone's privacy? Hmmm...let me think...there was Anonymous hacking the USSC and outing all of the Supreme Court judges...there was Matthew Keys, who admits he hung out with Anonymous...hmm...oh, yes, there's the fact that the FBI got into Paula Broadwell's gmail. Oh, quelle horreur.

But...she was trying to compromise *the head of the CIA* by using her proximity to him to threaten and harass another person she thought was a rival to her affections. That's not only morally wrong, it's a breach of security because it sets them both up for blackmail and harm by a foreign hostile intelligence. That's why you don't just say "Oh, this is about their private lives". When public officials have private lives that compromise their mission, that's ethically wrong and in this case and likely a crime, although it was handed by his dismissal and not by any prosecution.

And I'm supposed to worry about the sanctity of her email?! When she's banging the *head of the CIA* and using the power of his office and her illicit relationship to harass another civilians?! Hello?! Why *the fuck* is this okay? Yet many young people today think this is a story about her privacy. And Schneier should know better, if he is really a security guru, about the basic rules of tradecraft, but he isn't, he's a political activist using this field as a weapon to pursue his own political power.

What's *your* problem that you can't understand any of this?!

[Andrew]

What do you mean "he's a technocratic pragmatist who probably shrugs and says...?" You're putting words in his mouth about a subject that he hasn't opined on based on what, the fact that people you don't like see him as someone knowledgeable? I think he is, in fact, quite interested in freedom, which has been the focus of a few of his books.

If you'd bothered to read any of his work, not just articles he's quoted in, you'd see his POV on why ID checks are less than effective as airport security, is that checking drivers' licenses was a measure in place on 9/11 and all of the hijackers had valid documents. He's said this many times since 9/11 -- that checking IDs isn't going to prevent another 9/11 because it didn't prevent 9/11 in the first place because, as I said, the hijackers had valid drivers licenses, in their own names.

What he calls "security theater" is the practice of spending vast sums on reactive, rather than proactive techniques, ie removing shoes after a guy tried to blow up his shoes, restricting liquids after that liquid bomb plot, etc. His point is that fighting the "last war" isn't going to prevent future attacks using as-of-now unknown attacks.

In fact, he's long advocated techniques like the detailed interviewing and behavior detection long used in Israeli airports. Checking IDs is pointless, especially when it's just a cursory check at the gate. The employee making the check has never (in my experience) asked me my full name or anything like that, they're just in a hurry to get me on the plane. It's pointless. Now, when I visited Israel and security agents asked me a number of detailed questions designed to determine my risk, that wasn't pointless. But we don't do that. And that's his criticism.

Further, his criticisms of the TSA predate by several years Ron/Rand Paul, and I have absolutely zero idea what they have to do with "technocommunism" other than the fact that Schneier is often quoted by the tech press that you have made a career of hating.

Now, I know you seem to be able to read hearts and minds, but I have no idea what his opinion on Anonymous is, because I've never asked him, and I can't find an instance of him being quoted on the record about Anonymous. Frankly, I don't think ANYONE would have completely share as shrill an opinion as you that they are some forward vanguard of an evil revolution that has long been in planning since they were in Second Life or something.

I also don't know what his opinion is on the Swartz matter, or on the CFAA, because again, he hasn't been quoted on the record, and I haven't asked him. And I'm not sure what you mean by "his own white-hat 'explorations'" because I don't think he's in the business of breaking into others computers. He's actually known more as the designer of encryption algorithms.

I also don't know if he considers himself a "progressive" or what -- for all I know he's a Republican. After all, he is kind of wealthy. But regardless, I don't see how you can formulate such sweeping conclusions about his supposed opinions. I suspect the reason he criticizes the government when writing about TSA or wiretapping is that the government runs the TSA and the NSA warrantless wiretapping programs.

Now, his opinion piece doesn't say the government intruded on anyone's privacy. He simply wrote about the ease with which the government was able to track people who thought they were being careful. This wasn't invasion of privacy, it was law enforcement tracking, which is all he was writing about.

You are unhinged because you're taking an article with a very narrow scope and using it to attack the author because, why? Because he doesn't use your shrill tones to say how bad these people all were and that they all deserved to be tracked and brought down and whatever?

That wasn't the point of his article. I'm sure he has strong opinions about Chinese hacking, LulzSec and Paula Broadwell. But he wasn't writing to condone or condemn them, just use them as examples of how even security-aware people can be tracked despite precautions.

Where you are pulling Anonymous' "outing" SCOTUS (I'm not sure what you're talking about there since none of that got very far) or Matthew Keys (who is obviously an idiot) from? Neither of them have anything to do with the fact that the FBI track Paula Broadwell in their investigation of potential leaks. You make it seem as if Schneier is indignant over the FBI's tracking. But that's not what he wrote.

You're not supposed to "worry about the sanctity of her email" because Schneier wasn't worried about it, at least not in the opinion piece you link to as evidence of his bad intentions. I don't think anyone would have seen this as a story about Paula Broadwell's privacy, only about how she was still tracked after taking precautions to not be tracked.

My problem that I can't understand any of this is that you're not making sense.

[Catherine Fitzpatrick]

Andrew,

I've been reading him for years.

He's wrong about driver's license checks, and it doesn't matter if the 911 suicide bombers got through, you still do it, and do it more. Hence, the TSA, he doesn't like it, too bad, so sad. Of course it prevents another 9/11 because it's a layer of security that prevents at least common garden-variety hacks like walking through with an expired document or a stolen passport that your eyes twitch about.

Security theater seems to be whatever doesn't involve him as a consultant. There is nothing wrong with removing shoes after a shoe bomber is discovered. It's normal. He's too clever by half. He is a product of the irrational Internet that becomes "science".

Checking IDs and the TSA linie *is* an interviewing technique. It *does* have spot checks. Have you been overseas lately? I've spent hours and hours in these lines in the last year, and also been "spot checked". VERY detailed. We DO do this. He's nuts if he claims we don't.

Schneier needs criticism. He is worshipped and adored and that's wrong. The weakest link in any security system is always, always, always the geek himself. The arrogant asshole geek. Do I need to explain how?

Yeah, he never says anything about Anonymous. That's just it. He probably drinks with them.

I don't care if you find my critique shrill, out of touch, blah blah. Everybody said no one could ever hack a water plant and it was all just hysteria. Then they could. Whatever.

He doesn't support the crackdown on hackers because that would hamper his ability to do...whatever it is that he *does*...for his clients. Which is secret.

He's no Republican, don't be ridiculous. Hey, you'd be wealthy, too, if you were in the computer security business!

His critique of MAINLY the government and not Google or Anonymous lets me know just what kind of politics he has. The overwhelming majority of hacks in the US this last year came from China and Anonymous. But he's ranting about the government and TSA. Honestly, Andrew, it's insane.

Anonymous hacked the US Sentencing Commission. They also hacked a site with the Justices. They spilled their private information. This was in connection with their revenge hacking over Swartz. Google it. Of course they got that far.

Anonymous outed Matthew Keys, Andrew. Sabu did. Again, Google it. Or Bing it, give the business to somebody else beside the main snoop in our lives for a change.

Of course Schneier was worried about her gmail!!!! He said as much in that piece and others, that the feds shouldn't have breached it. But sorry, if you are banging the head of the CIA, that will happen to you to make sure you don't harm national security.

I'm making absolute sense and you aren't. EVERYON among the hackster set sees Paula Broadwell's story about privacy. From Chris Soghoian on down. Where have you been???

[Catherine Fitzpatrick]

Schneier's tap dance on this thread about Anonymous is just -- well, commentary is excessive.

http://www.schneier.com/blog/archives/2011/07/members_of_anon.html

[Andrew]

So you're the only sane one left?

How does ID Check prevent ANOTHER 9/11 when the SAME PRACTICES didn't prevent the FIRST 9/11 IN THE FIRST PLACE?

100% ID Check wouldn't have stopped ANY of the hijackers, suicide bombers, whatever you want to call them (yes, I see you semantic trick -- making it appear I don't recognize their inherent evil because I call them hijackers and you call them suicide bombers) because they all had VALID, CURRENT, and REAL drivers licenses and travel documents. This is one of the reasons they weren't detected -- they blended in.

The 9/11 perpetrators weren't "common, garden-variety" anything. They meticulously planned every detail of their crime.

Schneier isn't the only one talking about "security theater" and I haven't yet seen him mention anything involving consulting fees for him, because he designs encryption algorithms for a living. That's what his fees come from. Where you get the idea that "security theater" involves anything that doesn't pay him I'm not sure, because numerous others, including airline pilots whose lives depend on security, have made similar criticisms (see Smith, Patrick). And of course, removing shoes will prevent another shoe bomber. But do you think the next attack will come that way? It makes people feel better. But it's reactive, not proactive. Oh, and those overseas security lines aren't the same thing as TSA. They're often more effective.

But let's move on, because now you're really piling on the bullshit.

You write: "Schneier needs criticism. He is worshipped and adored and that's wrong. The weakest link in any security system is always, always, always the geek himself. The arrogant asshole geek. Do I need to explain how?"

Everyone can use some healthy criticism sometimes. Even you.

But why does he, more than anyone else, NEED criticism? And about what, specifically? Because he's considered an expert in something you're not expert in?

The ironic thing is that Schneier (based on his books, which is all I know aside from a few times I've interviewed him as a source) would probably agree with you that the weakest link in any given system is the HUMAN FACTOR.

But you say "the arrogant, asshole geek."

Who did what to you? Seriously, Catherine. You sound really unhinged here. You don't need to explain just how, you need to explain who you mean and why. You've NEVER answered my question about WHO qualifies as one of these dangerous geeks, and HOW they get there. Anyone who works in IT? But not all security is IT security. So you're saying the Secret Service is a bunch of arrogant, asshole geeks, too?

Your unhinged, irrational prejudice is showing here. Did a bunch of pocket-protector wearing geeks beat you up in high school? Because the hatred with which you attack a whole group of people that you can't even define as far as membership is concerned removes any amount of logic from the equation, since once you label anyone as "geek" then they no longer need to be proven malevolent in your eyes.

When has the man said he doesn't support a "crackdown on hackers?" I can't find anything in his copious public writing to support that statement. And is he suddenly no longer allowed to make a living, or should he have to disclose what he does to you, to satisfy you?

But now you go off the rails. The piece you linked to had NOTHING to do with TSA. He was writing about how easy it is to be tracked when you're sloppy. And Schneier NEVER said in that piece that "the feds shouldn't have breached [Broadwell's GMail].

He wrote, correctly, that identifying her was done not with GMail, but with hotel registration data.

You're the one who isn't making sense. You saw an opinion piece about the ubiquity of tracking on the Internet and thought it should have been an attack on Anonymous, and because he didn't attack Anonymous you've taken to crowing about how he wants them protected for some reason.

First your problem is that he doesn't attack Anonymous in the piece you linked to. Then it's that he criticizes the TSA and not Anonymous. Then you start listing things Anonymous has done that have nothing to do with the piece you criticized in the first place. Then the man is dangerous because he's an "arrogant, asshole geek" who charges clients for stuff he doesn't tell you about.

And the thread you linked to is problematic how? First thing he says is that they're criminals. Then he opines that they're probably not master-criminals. I see nothing controversial here except that you see Anonymous as some sort of evil revolutionary movement and he sees a group of criminals who get more media attention than he thinks they deserve.

Again, it seems his main "crimes" are a) being a computer security expert b) being respected by people you don't like and c) not sharing your opinions.

[Catherine Fitzpatrick]

One of the reasons I write longer posts instead of this short little one I did is because i know I will get this kind of heated insanity from geeks and the near-geek world like you, and I therefore pre-anticipate it and answer it.

My criticism of anything in the universe is never a notion that only I get to be a critic and that other people must be silent or any such tripe like that, so give it up Andrew, you know better.

Checking ID will prevent the things I've mentioned -- expired, fake, stolen IDs. It has as much of a success as not checking. Common sense should tell you this.

Yeah, we get it about the 9/11 terrorists who killed my fellow parishioners and my children's friends' parents. Truly we do. Now, what was it about these people that got them through? Was the fact that they were Middle Eastern in appearance something that in fact made checkers timid about seeming to check them too hard for being politically correct? They had been admitted into this country, had driver's licenses, ID, car rentals -- they seemed to be "ordinary". They weren't. So what? That doesn't mean you don't keep checking for licenses and passports *anyway*. Logan was the most lax in security and they knew that, having scoped it out. Remember, they bought box-cutters in Maine -- a detail people forget -- because they *could* there -- they are openly sold. They aren't in New York City. And so on. Terrorist bent on a closed society exploit an open society. That doesn't mean that open society can't use the same checking methods it used for 100 years along with new ones to try to stop them. That logic is just nuts.

Nobody said Schneier is the only one. He just talks about it a lot. He's a security consultant and a speaker at conferences and an article writer on security. He makes his living that way. I can't believe you'd imagine he collects no security consulting fees. I don't care if numerous people have barked about security theater. Whenever I hear someone use that term, I know they're an idiot. They are libertarian nutbags, or just geek blowhards who may mean well, but they are using the term to appear superior to others and penetrating in their analysis, and its silly. It's security theater to have 20 cop cars go roaring up the FDR drive at odd times in what they call here the "surge". What earthly good does it do? What terrorists are scared? And yet, we haven't had any terrorists try to appear at the Mid Town tunnel since they started doing "the surge". Maybe the police know things you don't.

I fail to see why we can't use a variety of checks -- and we do -- just because "we can't know" the future. The TSA is nothing. Hearing all the scare stories and hysteria, I expected the worse. Now having passed it a number of times, I find it all fake. Edgecasing galore.

He *is* the weakest link in any security system because he is widely widely quoted; he is extremely popular; and numerous people link to him. No security system should have a weak link like that, one man's expertise, even if humble, but especially if not. Redundancy is needed. Criticism is needed.

So I guess we're getting to the heart of the matter with this, now:

The ironic thing is that Schneier (based on his books, which is all I know aside from a few times I've interviewed him as a source) would probably agree with you that the weakest link in any given system is the HUMAN FACTOR.

See, what this is about is your sense of self, your manhood, and your sense of self-esteem. You interviewed him. This gives you a feeling of professionalism. You hate to see him knocked, then, because he is what gives you credentials, too.

I don't care. Interview him all you want. Interview him again. That's a great thing to have in your resume and clipping book. But I still get to criticism and he needs scrutiny especially with his bias toward domestic state actors instead of foreing state and non-state actors who commit most hacks. That's the single most important thing I've said here, and I insist on it: Schneier has us back in the 1990s swaggering around saying phreakers should be free to explore and white hats should get to have conferences with them and pick up fees to block them -- sometimes collaboratively, but with all of us agreeing that the feds and telcos are the real evil. But we're in a different world now where they aren't, if they ever were.

The human factor isn't the weak point in a security system, except accidently. The arrogant, asshole geek is the weak point in any security system because he devised it, thinks it is great, and has no humility. Really, every security system in the world should be tested by 55 year old grandmas and 12 year old girls to help dispel that factor, it's great.

Your question isn't coherent. I've made it very clear who the problem is in every single security system in the universe, private or public, government or corporate. I defined the class and described it: the arrogant, asshole geek. Everyone has one at work. Everyone knows what I'm talking about. Everyone. But you.

I didn't claim his piece first referenced was about the TSA. I wrote about his OTHER stuff on the TSA as what's wrong about him. Schneier never supported the feds' proble of Broadwell's email EITHER. That's just IT.

Um, I saw a piece by this honcho once again that everyone retweeted thousands of times and saw it didn't reference China, the worst threat to America, or Russia, the worst threat to Europe and the world, or Anonymous, the most often found behind hacks but...the government itself, which is more often victim than intruder. That's the creepy part.

If you don't get what's wrong with this double-talk, back-tracking and referencing even to Stallman (!), then you're beyond help. But in fact he is minimizing Anonymous and not getting it about them because he is studying technical mechanics and doesn't study the social aspect of their technocommunism. That's his crime. It's not about disagreeing with me

[Andrew]

But it is about implicitly disagreeing with your worldview. You say one "minimizes" Anonymous by studying technical matters rather than "social aspects of their technocommunism" -- it seems that in your world, anyone who doesn't shriek at the top of their lungs about how Anonymous is the greatest threat to freedom extant today and spends as much energy as you talking about them and linking them to everything you consider bad is therefore in favor of their goals and approves of their tactics, even if one doesn't every speak a word to that effect.

You're operating on the maxim qui tacet consentire videtur, "he who is silent is taken to agree."

How is this a fair, much less accurate method of determining someone's beliefs? I'm no fan of China, nor one of Anonymous. But I think it's just fine to be concerned about government as a threat to liberty. After all, the framers of our constitution saw government as the greatest threat -- that's why we have the Bill of Rights. This isn't to say I don't think Chinese cyberattacks aren't problematic -- they certainly are. But Chinese law enforcement doesn't have the power to lock me up. And Anonymous hasn't had any effect on my life at all. Yeah, I get that you've been Doxed and harassed. I think that's terrible. And I think that law enforcement should have appropriate remedies against the people who've harmed you.

But I don't buy your suggestion that the government is more often victim than intruder.

And I don't buy your suggestion that the problem in every single security system ever is the "arrogant, asshole geek." You have an irrational hatred of an entire group of people which you can't even define except to say that those who disagree with you are almost automatically labeled part of the "geek class" or sympathizers of such. Also, anyone who doesn't think Google is evil, or that Aaron Swartz was an evil Anonymous sympathizer, or who doesn't worship government power (American, at least) is part of the geek technocommunist cabal which you lash out against at every turn.

I think if you'd dial it down you'd find people who agree with parts of what you say, just not all of it. But you attack those people because you say, as you do with Schneier, that not attacking as loudly as you do from the same angles as you do and hating what you hate, means that they are in favor of what you are against.

It's irrational.

[Catherine Fitzpatrick]

Um, I just not getting it.

I can't disagree with Schneier? I can't have a worldview, and then criticize him because his worldview implicitly disagrees with my worldview? Why not? What is this REAAAALY about?!

He doesn't have to shriek at the top of his lungs. I'm happy to do that as a blogger. He's going to be more circumspect as a security consultant, but I don't see anything condemning them at all. He's minimizing them, and barely discussing them. No doubt he follows that security theory that you "shouldn't feed trolls" or talk about attacks and that this makes them grow less. What tripe. It does no such thing. Anonymous is responsible for the biggest hacks in the US after the China, including really ugly social hacks undermining institutions, as in Steubenville, and he has nothing to say? But that's part and parcel of Schneier's whole shtick, knowier-than-thou, mysterious, acting as if the government is the main problem. It's very political. I criticize it. That's okay to do. I don't see him dispelling the cynical "I was just doing arithmetic" logic anywhere.

Often, he who is silent DOES agree. It's odd that a leading security expert cited lovingly and even worshipfully by others just has nothing on this...

I don't know what to do with a person who thinks the threat with China is that they might "lock you up" but that they "don't have that power". I guess you've never studied the communist takeover of countries...

I can't come up with a single case of government intrusion in recent years of the sort so hysterically trotted out. The government was absolutely right to convene a grand jury and summon Jacob Appelbaum and search him at the border. Oh, now that's ruled as overreach and they can't do that as much. Well, great, but we can see the drawbacks and one of them is getting at the bad actor Jacob Appelbaum. As we know from Weev, being a dick isn't a legal offense for Appelbaum, but I suspect there's more there like really helping WikiLeaks, and that is criminal.

I have a critique of a whole class of people who are self-identified because they are not ethical. That's okay. In fact, it's imperative. I only lash out against the geek technocommunist cabal on Tuesdays and Fridays, Andrew. On other days I lash out at libertarian extremists, oligarchic Big IT which exploits the open source cult, violent video game makers, and Democratic story crafters contriving the "war on women". Geez, get with the program. There's more than enough evil to go around here.

I'm not required to do any dialing down here. They are all perfectly capable of speaking out on their own blog in the nuanced and special way that they need to in order to keep being seen as moderates. They don't.