A Real Debate About Privacy and Security

I often wonder why it appears that only a small handful of people are regularly engaged in real discussions about what is happening with privacy in Canada. These discussions typically — at least in my experience — take place on blogs, tweets flying around the ‘net and regular submissions to parliament by organizations like the Canadian Bar Association. Security breaches regularly get coverage in the media but the creeping erosion of privacy in pursuit of crime-free neighbourhoods and safe travelling seldom gets much attention.

The proposed implementation of body scanners in Canadian airports is a major exception to this and I’ve been delighted to see some real discussion about this very intrusive technology. The Halifax Chronicle Herald ran a front page story (Safety versus privacy) in which they kindly allowed me to share my thoughts. Our local CTV station had a piece that eschewed soundbites and instead focused on balancing privacy and the desire for security. Brian Bowman’s monthly column in the Winnipeg Sun (Privacy folks crying wolf on scanners) offers his nuanced opinion and concludes:

I want to be safe when I fly. I also want my privacy respected. Canadians have every right to demand both. Thankfully, if you look at the manner in which the scanners will be rolled out, there appears to be a good balance between security and privacy.

Frank Work, the Information and Privacy Commissioner of Alberta, doesn’t mince words in an interview with the Edmonton Sun (Privacy boss pans scans):

“What will they do next, after the next incident? We’re running out of toys and technological silver bullets,” said Work, one day after the federal government announced the new airport security measures.

….

“The bottom line is it’s a dignity issue, and either out of fear or because we don’t want to stand in line too long, we’ve forsaken any notion of dignity — it’s like, all right, we’ll assume the position,” said Work.

…

Work said that because human-monitored body scanners aren’t perfect, showing only a surface view of the nude passenger, he believes it’s a matter of time and/or tragedy before the next step is taken.

“The system is still prone to failure, so let’s say the next guy packs his ass with however many grams of (plastic explosive) he can shove up there, and either successfully or unsuccessfully detonates it. What do they do next?” said Work.

…

“At what point do we say, ‘Holy crap man, you’re patting me down, you’ve got pictures of me naked, you’ve got me squatting on a chair, and you’ve taken my water bottle away’. I mean at what point is enough, enough?”

The Federal Commissioner, in October and well before the recent underwear bomber incident, gave conditional approval to the technology for secondary screening (A necessary image – The Globe and Mail).

Meanwhile, well-respected security expert Bruce Schneier (Schneier on Security: Post-Underwear-Bomber Airport Security), suggests that government is accomplishing little by looking backwards:

Despite this, the proposed fixes focus on the details of the plot rather than the broad threat. We’re going to install full-body scanners, even though there are lots of ways to hide PETN — stuff it in a body cavity, spread it thin on a garment — from the machines. We’re going to profile people traveling from 14 countries, even though it’s easy for a terrorist to travel from a different country. Seating requirements for the last hour of flight were the most ridiculous example.

The problem with all these measures is that they’re only effective if we guess the plot correctly. Defending against a particular tactic or target makes sense if tactics and targets are few. But there are hundreds of tactics and millions of targets, so all these measures will do is force the terrorists to make a minor modification to their plot.

It’s magical thinking: If we defend against what the terrorists did last time, we’ll somehow defend against what they do one time. Of course this doesn’t work. We take away guns and bombs, so the terrorists use box cutters. We take away box cutters and corkscrews, and the terrorists hide explosives in their shoes. We screen shoes, they use liquids. We limit liquids, they sew PETN into their underwear. We implement full-body scanners, and they’re going to do something else. This is a stupid game; we should stop playing it.

The cynic in me thinks that the debate may not change anything, but if it raises awareness of how privacy is being traded away in favour of security (or the illusion of security), that’s a good thing in and of itself.