Such ideas have provoked the ire of civil-liberties groups, which fear that governments, corporations, and the police will misuse the new technology. Schneier's concerns are more basic. In his view, these measures can be useful, but their large-scale application will have little effect against terrorism. Worse, their use may make Americans less safe, because many of these tools fail badly—they're "brittle," in engineering jargon. Meanwhile, simple, effective, ductile measures are being overlooked or even rejected.
The distinction between ductile and brittle security dates back, Schneier has argued, to the nineteenth-century linguist and cryptographer Auguste Kerckhoffs, who set down what is now known as Kerckhoffs's principle. In good crypto systems, Kerckhoffs wrote, "the system should not depend on secrecy, and it should be able to fall into the enemy's hands without disadvantage." In other words, it should permit people to keep messages secret even if outsiders find out exactly how the encryption algorithm works.
At first blush this idea seems ludicrous. But contemporary cryptography follows Kerckhoffs's principle closely. The algorithms—the scrambling methods—are openly revealed; the only secret is the key. Indeed, Schneier says, Kerckhoffs's principle applies beyond codes and ciphers to security systems in general: every secret creates a potential failure point. Secrecy, in other words, is a prime cause of brittleness—and therefore something likely to make a system prone to catastrophic collapse. Conversely, openness provides ductility.
From this can be drawn several corollaries. One is that plans to add new layers of secrecy to security systems should automatically be viewed with suspicion. Another is that security systems that utterly depend on keeping secrets tend not to work very well. Alas, airport security is among these. Procedures for screening passengers, for examining luggage, for allowing people on the tarmac, for entering the cockpit, for running the autopilot software—all must be concealed, and all seriously compromise the system if they become known. As a result, Schneier wrote in the May issue of Crypto-Gram, brittleness "is an inherent property of airline security."
Few of the new airport-security proposals address this problem. Instead, Schneier told me in Los Angeles, they address problems that don't exist. "The idea that to stop bombings cars have to park three hundred feet away from the terminal, but meanwhile they can drop off passengers right up front like they always have ..." He laughed. "The only ideas I've heard that make any sense are reinforcing the cockpit door and getting the passengers to fight back." Both measures test well against Kerckhoffs's principle: knowing ahead of time that law-abiding passengers may forcefully resist a hijacking en masse, for example, doesn't help hijackers to fend off their assault. Both are small-scale, compartmentalized measures that make the system more ductile, because no matter how hijackers get aboard, beefed-up doors and resistant passengers will make it harder for them to fly into a nuclear plant. And neither measure has any adverse effect on civil liberties.
Evaluations of a security proposal's merits, in Schneier's view, should not be much different from the ordinary cost-benefit calculations we make in daily life. The first question to ask of any new security proposal is, What problem does it solve? The second: What problems does it cause, especially when it fails?
Tsutomu Matsumoto, a Japanese cryptographer, recently decided to look at biometric fingerprint devices. These are security systems that attempt to identify people based on their fingerprint. For years the companies selling these devices have claimed that they are very secure, and that it is almost impossible to fool them into accepting a fake finger as genuine. Matsumoto, along with his students at the Yokohama National University, showed that they can be reliably fooled with a little ingenuity and $10 worth of household supplies. Matsumoto uses gelatin, the stuff that Gummi Bears are made out of. First he takes a live finger and makes a plastic mold. (He uses a free-molding plastic used to make plastic molds, and is sold at hobby shops.) Then he pours liquid gelatin into the mold and lets it harden. (The gelatin comes in solid sheets, and is used to make jellied meats, soups, and candies, and is sold in grocery stores.) This gelatin fake finger fools fingerprint detectors about 80% of the time ... There's both a specific and a general moral to take away from this result. Matsumoto is not a professional fake-finger scientist; he's a mathematician. He didn't use expensive equipment or a specialized laboratory. He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with "live finger detection" features ... If he could do this, then any semi-professional can almost certainly do much more. —Bruce Schneier, Crypto-Gram, May 15, 2002
Failure comes in many kinds, but two of the more important are simple failure (the security measure is ineffective) and what might be called subtractive failure (the security measure makes people less secure than before). An example of simple failure is face-recognition technology. In basic terms, face-recognition devices photograph people; break down their features into "facial building elements"; convert these into numbers that, like fingerprints, uniquely identify individuals; and compare the results with those stored in a database. If someone's facial score matches that of a criminal in the database, the person is detained. Since September 11 face-recognition technology has been placed in an increasing number of public spaces: airports, beaches, nightlife districts. Even visitors to the Statue of Liberty now have their faces scanned.
Face-recognition software could be useful. If an airline employee has to type in an identifying number to enter a secure area, for example, it can help to confirm that someone claiming to be that specific employee is indeed that person. But it cannot pick random terrorists out of the mob in an airline terminal. That much-larger-scale task requires comparing many sets of features with the many other sets of features in a database of people on a "watch list." Identix, of Minnesota, one of the largest face-recognition-technology companies, contends that in independent tests its FaceIt software has a success rate of 99.32 percent—that is, when the software matches a passenger's face with a face on a list of terrorists, it is mistaken only 0.68 percent of the time. Assume for the moment that this claim is credible; assume, too, that good pictures of suspected terrorists are readily available. About 25 million passengers used Boston's Logan Airport in 2001. Had face-recognition software been used on 25 million faces, it would have wrongly picked out just 0.68 percent of them—but that would have been enough, given the large number of passengers, to flag as many as 170,000 innocent people as terrorists. With almost 500 false alarms a day, the face-recognition system would quickly become something to ignore.
The potential for subtractive failure, different and more troublesome, is raised by recent calls to deploy biometric identification tools across the nation. Biometrics—"the only way to prevent identity fraud," according to the former senator Alan K. Simpson, of Wyoming—identifies people by precisely measuring their physical characteristics and matching them up against a database. The photographs on driver's licenses are an early example, but engineers have developed many high-tech alternatives, some of them already mentioned: fingerprint readers, voiceprint recorders, retina or iris scanners, face-recognition devices, hand-geometry assayers, even signature-geometry analyzers, which register pen pressure and writing speed as well as the appearance of a signature.
Appealingly, biometrics lets people be their own ID cards—no more pass words to forget! Unhappily, biometric measures are often implemented poorly. This past spring three reporters at c't, a German digital-culture magazine, tested a face-recognition system, an iris scanner, and nine fingerprint readers. All proved easy to outsmart. Even at the highest security setting, Cognitec's FaceVACS-Logon could be fooled by showing the sensor a short digital movie of someone known to the system—the president of a company, say—on a laptop screen. To beat Panasonic's Authenticam iris scanner, the German journalists photographed an authorized user, took the photo and created a detailed, life-size image of his eyes, cut out the pupils, and held the image up before their faces like a mask. The scanner read the iris, detected the presence of a human pupil—and accepted the imposture. Many of the fingerprint readers could be tricked simply by breathing on them, reactivating the last user's fingerprint. Beating the more sophisticated Identix Bio-Touch fingerprint reader required a trip to a hobby shop. The journalists used graphite powder to dust the latent fingerprint—the kind left on glass—of a previous, authorized user; picked up the image on adhesive tape; and pressed the tape on the reader. The Identix reader, too, was fooled. Not all biometric devices are so poorly put together, of course. But all of them fail badly.