Consider the legislation introduced in May by Congressmen Jim Moran and Tom Davis, both of Virginia, that would mandate biometric data chips in driver's licenses—a sweeping, nationwide data-collection program, in essence. (Senator Dick Durbin, of Illinois, is proposing measures to force states to use a "single identifying designation unique to the individual on all driver's licenses"; President George W. Bush has already signed into law a requirement for biometric student visas.) Although Moran and Davis tied their proposal to the need for tighter security after last year's attacks, they also contended that the nation could combat fraud by using smart licenses with bank, credit, and Social Security cards, and for voter registration and airport identification. Maybe so, Schneier says. "But think about screw-ups, because the system will screw up."
Smart cards that store non-biometric data have been routinely cracked in the past, often with inexpensive oscilloscope-like devices that detect and interpret the timing and power fluctuations as the chip operates. An even cheaper method, announced in May by two Cambridge security researchers, requires only a bright light, a standard microscope, and duct tape. Biometric ID cards are equally vulnerable. Indeed, as a recent National Research Council study points out, the extra security supposedly provided by biometric ID cards will raise the economic incentive to counterfeit or steal them, with potentially disastrous consequences to the victims. "Okay, somebody steals your thumbprint," Schneier says. "Because we've centralized all the functions, the thief can tap your credit, open your medical records, start your car, any number of things. Now what do you do? With a credit card, the bank can issue you a new card with a new number. But this is your thumb—you can't get a new one."
The consequences of identity fraud might be offset if biometric licenses and visas helped to prevent terrorism. Yet smart cards would not have stopped the terrorists who attacked the World Trade Center and the Pentagon. According to the FBI, all the hijackers seem to have been who they said they were; their intentions, not their identities, were the issue. Each entered the country with a valid visa, and each had a photo ID in his real name (some obtained their IDs fraudulently, but the fakes correctly identified them). "What problem is being solved here?" Schneier asks.
Good security is built in overlapping, cross-checking layers, to slow down attacks; it reacts limberly to the unexpected. Its most important components are almost always human. "Governments have been relying on intelligent, trained guards for centuries," Schneier says. "They spot people doing bad things and then use laws to arrest them. All in all, I have to say, it's not a bad system."
One of the first times I met with Schneier was at the Cato Institute, a libertarian think tank in Washington, D.C., that had asked him to speak about security. Afterward I wondered how the Cato people had reacted to the speech. Libertarians love cryptography, because they believe that it will let people keep their secrets forever, no matter what a government wants. To them, Schneier was a kind of hero, someone who fought the good fight. As a cryptographer, he had tremendous street cred: he had developed some of the world's coolest ciphers, including the first rigorous encryption algorithm ever published in a best-selling novel (Cryptonomicon, by Neal Stephenson) and the encryption for the "virtual box tops" on Kellogg's cereals (children type a code from the box top into a Web site to win prizes), and had been one of the finalists in the competition to write algorithms for the federal government's new encryption standard, which it adopted last year. Now, in the nicest possible way, he had just told the libertarians the bad news: he still loved cryptography for the intellectual challenge, but it was not all that relevant to protecting the privacy and security of real people.
In security terms, he explained, cryptography is classed as a protective counter-measure. No such measure can foil every attack, and all attacks must still be both detected and responded to. This is particularly true for digital security, and Schneier spent most of his speech evoking the staggering insecurity of networked computers. Countless numbers are broken into every year, including machines in people's homes. Taking over computers is simple with the right tools, because software is so often misconfigured or flawed. In the first five months of this year, for example, Microsoft released five "critical" security patches for Internet Explorer, each intended to rectify lapses in the original code.
Computer crime statistics are notoriously sketchy, but the best of a bad lot come from an annual survey of corporations and other institutions by the FBI and the Computer Security Institute, a research and training organization in San Francisco. In the most recent survey, released in April, 90 percent of the respondents had detected one or more computer-security breaches within the previous twelve months—a figure that Schneier calls "almost certainly an underestimate." His own experience suggests that a typical corporate network suffers a serious security breach four to six times a year—more often if the network is especially large or its operator is politically controversial.