The right kind of "security theater"

It is not surprising that we'd find good sense about security in the words of Bruce Schneier, but this recent essay does the best job I've seen of explaining the balance between "real" and "symbolic" steps against terrorism; why some purely symbolic steps can be worthwhile; but why much of today's "security theater" is so misguided.

Read the whole thing, but crucial concepts are these. First, what we mean when we talk about "security theater":

"Security theater refers to security measures that make people feel more secure without doing anything to actually improve their security. An example: the photo ID checks that have sprung up in office buildings. No-one has ever explained why verifying that someone has a photo ID provides any actual security, but it looks like security to have a uniformed guard-for-hire looking at ID cards." [My emphasis]

On why the steady accretion of "fighting the last war" security measures, especially involving air travel, are beyond the point. E.g., because there was once a shoe-bomb plot, we all now take off our shoes; because there was once a plot involving liquids, women have perfume and gels seized from their purses, etc. There's always a demand to do "something," and...

"Often, this 'something' is directly related to the details of a recent event: we confiscate liquids, screen shoes, and ban box cutters on aeroplanes. But it's not the target and tactics of the last attack that are important, but the next attack. These measures are only effective if we happen to guess what the next terrorists are planning.... Terrorists don't care what they blow up and it shouldn't be our goal merely to force the terrorists to make a minor change in their tactics or targets..."

On what the right kind of security theater would mean: I think this is the most important and, to most politicians and readers, novel part of Scheneir's argument. He says that the best way to reduce the damage terrorism can do is to act as if we're not scared of it.

"The best way to help people feel secure is by acting secure around them. Instead of reacting to terrorism with fear, we -- and our leaders -- need to react with indomitability.

"By not overreacting, by not responding to movie-plot threats, and by not becoming defensive, we demonstrate the resilience of our society, in our laws, our culture, our freedoms. There is a difference between indomitability and arrogant 'bring 'em on' rhetoric. There's a difference between accepting the inherent risk that comes with a free and open society, and hyping the threats...

"Despite fearful rhetoric to the contrary, terrorism is not a transcendent threat. A terrorist attack cannot possibly destroy a country's way of life; it's only our reaction to that attack that can do that kind of damage."

I am predisposed to welcome this argument, having made my version of a similar case three years ago (with guidance then from Schneier and others). But this is an unusually strong formulation from an unusually well positioned authority. Please do read what he says.