Wed, January 01, 2003 — CIO — Ask Dan Geer a question about something?privacy, for instance?and he walks straight through the topic and out its back door before even beginning his answer. The answer, when it comes, arrives deceptively from what appears to be a very great distance, some weird nether alley or off-premises parking lot. Eventually, the questioner starts to lose track of what the question was?perhaps when Geer is drawing a set of thick blue axes on a whiteboard, the vertical one labeled "people" and the horizontal one labeled "permissions."

Geer, who is CTO of @Stake, a security consultancy based in Cambridge, Mass., is trained as a biostatistician. In statistics, numbers exist to give validating shape and mass to the sort of reckonings?the likelihood, say, of a 100-year flood occurring this year?that the nonnumerical among us simply can’t get our minds around. As CTO, he mainly applies his training to working on the large problem of digital security risks, and their mitigation, on behalf of @Stake’s clients.

"Complexity is the chief enemy of security," says Geer, beginning his leisurely stroll. "Any solution in the name of security that increases complexity is asking for trouble.... Security solutions must be simple or they will be unsustainable [because] security’s accumulating costs will grow in visibility while security’s deliverables will shrink in visibility." In other words, the more successful investments are at preventing attacks, the less obvious the benefits of those investments will appear to be.

Geer argues that the traditional access-control model of creating elaborate permission-granting systems?with passwords, tokens or biometrics?is headed toward kaput because the volume of information to which access must be granted is growing rampantly (as the cost of collecting it is dropping dramatically), and because the roles and associated rights of individuals entitled to some sort of access are becoming so variable (demanding exceptional flexibility). That requires an elaborate architecture and high administrative and IT overhead so that the cost, complexity and processing burden of administering access are growing geometrically. "In the long term," says Geer, "you arrive at a point of diseconomy....

"Now, yes, I’m passionate about privacy. But I’m also a realist." Privacy? The questioner snaps back from a far, far corner of the parking lot to recall the original question. Incredibly, Geer has made his way back into the building....

He believes that the flawed economics of access control favor what he terms an "accountability" model of wide-scale surveillance and monitoring. As the cost of data collection approaches zero, privacy (as we have known it) approaches toast. It’s easier and cheaper to monitor everything everyone does?to catch them misbehaving?than to create gargantuan schemes engineered to keep them away from information to which they have no right. (That is going to come as a mighty big shock to the legions of security-management vendors whose business is built around the permissions model.)