Geer On Security vs. Privacy

Ask Dan Geer a question about something?privacy, for instance?and he walks straight through the topic and out its back door before even beginning his answer. The answer, when it comes, arrives deceptively from what appears to be a very great distance, some weird nether alley or off-premises parking lot. Eventually, the questioner starts to lose track of what the question was?perhaps when Geer is drawing a set of thick blue axes on a whiteboard, the vertical one labeled “people” and the horizontal one labeled “permissions.”

Geer, who is CTO of @Stake, a security consultancy based in Cambridge, Mass., is trained as a biostatistician. In statistics, numbers exist to give validating shape and mass to the sort of reckonings?the likelihood, say, of a 100-year flood occurring this year?that the nonnumerical among us simply can’t get our minds around. As CTO, he mainly applies his training to working on the large problem of digital security risks, and their mitigation, on behalf of @Stake’s clients.

“Complexity is the chief enemy of security,” says Geer, beginning his leisurely stroll. “Any solution in the name of security that increases complexity is asking for trouble…. Security solutions must be simple or they will be unsustainable [because] security’s accumulating costs will grow in visibility while security’s deliverables will shrink in visibility.” In other words, the more successful investments are at preventing attacks, the less obvious the benefits of those investments will appear to be.

Geer argues that the traditional access-control model of creating elaborate permission-granting systems?with passwords, tokens or biometrics?is headed toward kaput because the volume of information to which access must be granted is growing rampantly (as the cost of collecting it is dropping dramatically), and because the roles and associated rights of individuals entitled to some sort of access are becoming so variable (demanding exceptional flexibility). That requires an elaborate architecture and high administrative and IT overhead so that the cost, complexity and processing burden of administering access are growing geometrically. “In the long term,” says Geer, “you arrive at a point of diseconomy….

“Now, yes, I’m passionate about privacy. But I’m also a realist.” Privacy? The questioner snaps back from a far, far corner of the parking lot to recall the original question. Incredibly, Geer has made his way back into the building….

He believes that the flawed economics of access control favor what he terms an “accountability” model of wide-scale surveillance and monitoring. As the cost of data collection approaches zero, privacy (as we have known it) approaches toast. It’s easier and cheaper to monitor everything everyone does?to catch them misbehaving?than to create gargantuan schemes engineered to keep them away from information to which they have no right. (That is going to come as a mighty big shock to the legions of security-management vendors whose business is built around the permissions model.)

An accountability world, says Geer, “is a surveillance world,” in which whatever one does is inexpensively logged and stored, available for analysis or for later use as evidence. “You can do anything you like,” he says, “but if you screw up badly enough, someone will find you.” He cites a New York Times piece he read last year about the spread of street and building surveillance in England. “In fact, its main purpose may be to get people to feel like someone’s watching them. Which ain’t a whole lot different from what the church was teaching a thousand years ago: You can’t hide from God, and there is ultimate justice in the end.”

But the transformation of the world?from one based on managing permissions to one based on enforcing accountability?will be propelled by economic, not religious, fervor. If the invading of privacy through pervasive monitoring “is so clearly economically preferable, you’d have to make a really principled argument to say that we’re not going to do that.” In this matter, Geer counts himself sadder but wiser when he invokes the British strategic retreat at the Battle of Dunkirk. Perhaps, he says, the best recourse for privacy will be to “make the fight over the misuse of gathered information” rather than the mere fact of gathering it.

“I’m not a sociologist,” he says, “so I don’t know where this all goes. But there is a social impact to growing up not expecting privacy, to being always under surveillance. I mean, I am certain that parents in my youth would have taken their kids out of school if they thought there were cameras in schools. Nowadays, people will take their kids out of school if there aren’t cameras. I don’t know what to say about that. But this is a privacy question, not a security question. People who say that privacy and security are one in the same are wrong.”