Hacker News Reader

Comment by snake_doc | Hacker News Reader

The effectiveness of a security program cannot solely be measured by penetration tests under controlled circumstances. Aspects of deterrence and standardization required by the program fundamentally changes the threat actors’ calculus.

This is the very fundamentals of mixed strategy calculations in game theory.

View on HN

While this is true, the method of 11 September 2001 worked for less than two hours. It is effectively impossible to hijack an airplane now, because the passengers will assume that they're dead either way and will do anything they can to stop you. You can still blow them up a la Lockerbie, but that's about it.

I really don't see a meaningful reason for most of "security screening" anymore. It just slows things down.

True, and even two hours maybe pushing it. The crash in PA on 9/11 was a direct result of passengers attacking the cockpit after they found out what happened to the other planes.

Or being shot down by a fighter jet.

It might be worth doing some reading on the actual events of that day. For example, "being shot down by a fighter jet" wasn't an option; the fighters weren't armed when they were put up in the sky. The pilots in them went up knowing that if a plane needed to be taken out, they were going to be using themselves to do it. And none of that is to mention the passengers the parent comment was referring to, who made the conscious, heroic decision that their plane wasn't going to be used as a weapon like two previous ones had been, whatever the cost.

I don't mean to assume bad faith, but this was, at best, a throwaway comment that minimized the bravery and sacrifice of a lot of good people. Either way, I'd like to recommend you educate yourself a bit more. The Wikipedia page has some excellent detail, and if narrative structure is your thing, the book The Only Plane In The Sky is a masterpiece on the subject.

> weren't armed when they went up

How has this claim been authenticated?

From the government itself? You can listen to unclassified / declassified 9/11-related communications (all over YouTube) and literally hear the conversations happening. The pilots have done interviews. There’s really no questioning it. It’s part of the US being woefully unprepared for 9/11 because it was so left of field. All evidence points to a lot of brave people doing their absolute best, working within a system that didn’t know how to handle the circumstance. That includes not being prepared to take down a commercial airliner at short notice, because why the hell would anyone ever need to do that!? (no sarcasm intended).

That was my point. Sorry it wasn’t clear.

Truth, the primary impact was the ability to arbitrarily inflate the cost of soft goods dramatically inside the terminal.

It's such a good racket Hudson News...a little news stand company inside a few dozen terminals was able to go public on the NYSE...

The public perception that security is "doing it's job" is non-existent since everyone knows it's at best a jobs program and in practice another group of people measurably stealing travellers things.

Hudson News is a brand for its Swiss parent company, Dufry.

Dufry existed prior to the invention of the airplane…

Classic example of the Lucas Critique.

How do you propose measuring the effectiveness of the program?

I was going to suggest comparing it to other developed countries' practices vs their rate of high profile terrorist attacks, but then I realized it correlates the other way. Spain and Italy hustle you through an old-school metal detector, but going into Israel I thought I was about to be beaten down with a rubber truncheon when I forgot the piece of paper I had in my pocket.

China’s is surprisingly easy. Just a metal detector and an X ray of your carry on. Didn’t even take my shoes off.

Singapore’s is the best. The security is right at the gate so the timing is a lot more predictable and you don’t have to worry about missing your flight.

China’s is done as you’re transiting. My luggage was sniffed, my hands wiped for explosive residue, and I was x-rayed, all without having to stop for more than a few seconds.

Yeah, the number of people targeting you matters, too.

Israel’s methods are incredibly interesting and something that you just wouldn’t get away with in the US. I say this as a non-American non-US-resident, which I think is important because my comment sounds like American exceptionalism.

It is absolutely bonkers how many otherwise pretty reasonable people miss this glaringly obvious fact.

We are all vulnerable to confirmation bias

A common analogy is to think about traffic lights.

If you run a penetration test, asking an individual to run a red light. You will achieve near 100% success.

However, when the traffic lights change actors’ behaviors to stop (at some probability such that it results in less collisions), most actors will stop according to the traffic lights.

That's not a good analogy at all. The incentives and motivations are completely different. Many drivers would at one point or another consider running a red light in order to save some time. I don't think you can say the same about passengers wanting to hijack a flight.

"Aspects of deterrence and standardization required by the program fundamentally changes the threat actors’ calculus."

“By your logic I could claim that this rock keeps tigers away.”

“Oh, how does it work?”

“It doesn’t work.”

“Uh-huh.”

“It’s just a stupid rock.”

“Uh-huh.”

“But I don’t see any tigers around, do you?”

“Lisa, I want to buy your rock.”

Fear will keep the local systems in line. Fear of this battle station.

Do you believe there aren’t people who wish to use air travel for nefarious purposes?

Do you believe that none of those people are factoring in the presence of identity checks, x-rays, backscatters, bomb dogs, and metal detectors into their risk/reward calculation or the techniques by which they’d commit nefarious acts?

They're probably factoring in strengthened cockpit doors and passengers' willingness to fight back, because those actually work. The rest is security theater.

If you are going to resort to “it is because it is”, leave and let someone else argue your side.

And on the opposite side of the stupid-examples spectrum: any tech company that hasn't had a computer security breach should fire their security team. All they're doing is spending a lot of money to make their developer's lives a lot harder.

Anyone with clean floors should fire their janitors.

Etc...

Those don't mean every security spend is worthwhile and justified; but Simpsons quotes also don't mean that no security spend has any effect.

Reply on news.ycombinator.com