Identification and security

March/April 2004 Access Control & Identity Management

In recent years there has been an increased use of identification checks as a security measure. Airlines always demand photo IDs, and hotels increasingly do so. They are often required for admittance into government buildings, and sometimes even hospitals. Everywhere, it seems, someone is checking IDs. The ostensible reason is that ID checks make us all safer, but that is just not so. In most cases, identification has very little to do with security.

Let us debunk the myths one by one. First, verifying that someone has a photo ID is a completely useless security measure. All the 9/11 terrorists had photo IDs. Some of the IDs were real. Some were fake. Some were real IDs in fake names, bought from a crooked DMV employee in Virginia. Fake driver's licenses for all 50 states, good enough to fool anyone who is not paying close attention, are available on the Internet. Or if you do not want to buy IDs online, just ask any teenager where to get a fake ID.

Harder-to-forge IDs only help marginally, because the problem is not making sure the ID is valid. This is the second myth of ID checks: that identification combined with profiling can be an indicator of intention.

Our goal is to somehow identify the few bad guys scattered in the sea of good guys. In an ideal world, what we would want is some kind of ID that denotes intention. We would want all terrorists to carry a card that says 'evildoer' and everyone else to carry a card that said 'honest person who will not try to hijack or blow up anything'. Then, security would be easy. We would just look at people's IDs and, if they were evildoers, we would not let them on the aeroplane or into the building.

This is, of course, ridiculous, so we rely on identity as a substitute. In theory, if we know who you are, and if we have enough information about you, we can somehow predict whether you are likely to be an evildoer. This is the basis behind CAPPS-2, the government's new airline passenger profiling system. People are divided into two categories based on various criteria: the traveller's address, credit history, and police and tax records; flight origin and destination; whether the ticket was purchased by cash, cheque, or credit card; whether the ticket is one way or round trip; whether the traveller is alone or with a larger party; how frequently the traveller flies; and how long before departure the ticket was purchased.

Profiling - a flawed premise?

Profiling has two very dangerous failure modes. The first one is obvious. The intent of profiling is to divide people into two categories: people who may be evildoers and need to be screened more carefully, and people who are less likely to be evildoers and can be screened less carefully. But any such system will create a third, and very dangerous, category: evildoers who do not fit the profile.

Oklahoma City bomber, Timothy McVeigh, DC sniper John Allen Muhammed, and many of the 9/11 terrorists had no previous links to terrorism. The Unabomber taught mathematics at Berkeley. The Palestinians have demonstrated that they can recruit suicide bombers with no previous record of anti-Israeli activities. Even the 9/11 hijackers went out of their way to establish a normal-looking profile; frequent-flier numbers, a history of first-class travel, etc. Evildoers can also engage in identity theft, and steal the identity and profile of an honest person. Profiling can actually result in less security by giving certain people an easy way to skirt security.

False positives in profiling!

There is another, even more dangerous, failure mode for these systems: honest people who fit the evildoer profile. Because actual evildoers are so rare, almost everyone who fits the profile will turn out to be a false alarm. This not only wastes investigative resources that might be better spent elsewhere, but it causes grave harm to those innocents who fit the profile. Whether it is something as simple as 'driving while black' or 'flying while Arab', or something more complicated like taking scuba lessons or protesting the current administration, profiling harms society because it causes us all to live in fear ... not from the evildoers, but from the police.

Security is a trade-off

Security is a trade-off; we have to weigh the security we get against the price we pay for it. Better trade-offs are to spend money on intelligence and analysis, investigation, and making ourselves less of a pariah on the world stage. And to spend money on the other, non-terrorist, security issues that affect far more Americans every year.

Identification and profiling do not provide very good security, and they do so at an enormous cost. Dropping ID checks completely, and engaging in random screening where appropriate, is a far better security trade-off. People who know they are being watched, and that their innocent actions can result in police scrutiny, are people who become scared to step out of line. They know that they can be put on a 'bad list' at any time. People living in this kind of society are not free, despite any illusionary security they receive. It is contrary to all the ideals that went into founding the United States.

For more information contact Bruce Schneier, Counterpane Internet Security, [email protected], www.schneier.com





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Who has access to your face?
Access Control & Identity Management Residential Estate (Industry) AI & Data Analytics
While you may be adjusting your privacy settings on social media or thinking twice about who is recording you at public events, the reality is that your facial features may be used in other contexts,

Read more...
Advanced time & attendance solutions
Technews Publishing Access Control & Identity Management Products & Solutions
From biometric devices to a powerful mobile app, you will see how businesses of all sizes save time, cut costs, and improve productivity with BioSyn.

Read more...
Smarter security for safer estate living
neaMetrics Suprema Integrated Solutions Surveillance Access Control & Identity Management Residential Estate (Industry)
The expansion of residential estates has led to many communities being constructed with security as an afterthought. Unfortunately, fencing, cameras, and a guard at the gate only create a false sense of safety, which vanishes after the first incident.

Read more...
Visitor management views
Entry Pro ATG Digital Technews Publishing SMART Security Solutions Access Control & Identity Management Residential Estate (Industry)
Visitor management is always changing, taking technology and legislation into account. SMART Security Solutions examines the latest trends with input from ATG Digital and Entry Pro.

Read more...
Securing your estate beyond the gate
ATG Digital Access Control & Identity Management Residential Estate (Industry) AI & Data Analytics
Protecting gated communities and lifestyle estates requires a modern, intelligent approach. A truly intelligent system protects both physical and digital perimeters, it must be a fully integrated ecosystem.

Read more...
Reliability, innovation and flexibility
Entry Pro Access Control & Identity Management Residential Estate (Industry) Products & Solutions
Through constant innovation and advancement in technology and systems, Entry Pro strives to provide its clients with not only the most suitable, but also the most advanced solution.

Read more...
Smarter security with automated visitor management
LD Africa Access Control & Identity Management Residential Estate (Industry) Products & Solutions
Automated visitor management solutions, like LD Access, are transforming this process by reducing human workload, while enhancing security and efficiency.

Read more...
Paxton enhances installer loyalty programme
Paxton Access Control & Identity Management News & Events
Paxton has made it easier for security installers to benefit from its popular loyalty programme, Paxton Rewards, with points now added automatically when purchasing through approved distribution partners.

Read more...
Identity, Security & Access Alliance focuses on intelligence and integration
SMART Security Solutions Ideco Biometrics BoomGate Systems Bosch Building Technologies Technews Publishing Integrated Solutions Surveillance Access Control & Identity Management
The Identity, Security & Access Alliance (ISAA) hosted several launch events in Johannesburg in August, showcasing the participating companies’ technical solutions with a primary focus on the solutions made possible by integrating high-quality systems to deliver comprehensive solutions.

Read more...
Rethinking access control in high-risk logistics environments
ATG Digital Access Control & Identity Management Transport (Industry) Logistics (Industry) Facilities & Building Management
South Africa’s logistics sector is under constant pressure, not only from external threats like hijackings and cargo theft, but also from internal vulnerabilities, operational blind spots, and limited support.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.