The Myth of Homeland Security

Rating:
Summary: Did I read the same book as the others?
Review: Every decade or so, a book comes out that fundamentally changes the way we look at an issue. Examples include Upton Sinclair's The Jungle, Rachel Carson's Silent Spring, and Ralph Nader's Unsafe at Any Speed; these books are timeless in their influence. The Myth of Homeland Security by noted information security consultant Marcus Ranum (also known as the father of the firewall) has an equally ominous message and deserves equal attention. Like Unsafe at Any Speed, Ranum's book should serve as a fulcrum for change.

Essentially, Ranum makes the point that buying duct tape by the mile and having elderly women remove their shoes at airports does absolutely nothing to increase homeland security. Ranum details other flaws in the government's approach to counter terrorism, including the huge bureaucracies that exist primarily for the purpose of prolonging their existence. He notes that the very structure of bureaucracies rewards inefficiencies and encourages territorialism and turf warfare. Want proof? More than two years after 9-11, the CIA and FBI still do not have a streamlined method for interdepartmental communications.

Throwing money (to the tune of tens of billions of dollars) at the problem without first identifying the solutions certainly are not the way to go. So what should we do?

First, as Ranum notes, we must get practical. From a physical security perspective, it is hard enough to secure a mega-mall with a few hundred stores and tens of thousands of customers. The task is exponentially more difficult, if not impossible, when extended to an entire country spanning millions of square miles of land, including long, unsecured borders, and inhabited by hundreds of millions of both permanent and transient, legal and illegal persons, with more entering daily.

Compounding the challenge of this complex and multifaceted task is the government's penchant for creating and sustaining bureaucracies without regard for whether they make getting the job done easier. For example, the Bureau of Citizenship and Immigration Services (BCIS), formerly the Immigration and Naturalization Service (INS), admits that it can't account for nearly a half-million visitors to this country.

Given the agency's poor performance historically, it should have been completely dismantled and rebuilt from the ground up. Instead, it was given a new name. If BCIS were a public company, its top management would have been fired long ago. Thus, the second step toward better homeland security would be more accountability for officials spearheading government programs.

Another issue that complicates the challenge of homeland security is that the average citizen simply does not understand risk, notes Ranum. As a result, most people will overreact to isolated incidents, such as occurred with the Washington, D.C., area sniper, while ignoring threats with a much higher probability of affecting them, such as cancer from smoking or a serious car accident from drunk driving.

Media coverage that reduces complex issues to sound bites certainly does not help. But even the authorities, who surely do not get their information from media sound bites, seem not to take a big-picture, long-term view. For example, when a shoe-bomber attempted to take down an airliner with a shoe-based bomb attack, security services started making all passengers take off their shoes before embarking.

Is this an effective way to deal with the overall risk? No. As Ranum notes, just imagine if this terrorist had stored his bomb in his underwear.

To address this problem, the third step toward better homeland security would be for officials to take a more professional approach to risk assessment and for security professionals in government and in private industry to work together to educate the public about proper risk assessment and risk management.

A fourth issue that must be addressed is the government's inability to solve problems expeditiously once they have been identified. One has to wonder, says Ranum, why Amazon.com can grow from a garage to an e-commerce powerhouse in a matter of months, yet CIA and FBI databases still can't effectively share information with each other more than two years after 9-11. A laundry list of other security problems at government agencies has been repeatedly cited by General Accounting Office reports without the problems being addressed.

Moreover, for homeland security to work, agencies such as INS/BCIS, FBI, CIA, and even the NSA all have to work together. News reports suggest that the FBI and CIA are still not cooperating to the degree they should.

Then, of course, there is the issue of the insider threat. Even if we permanently sealed our borders, there would be serious risks to homeland security, notes Ranum. Nefarious individuals such as Timothy McVeigh, Aldrich Ames, and Robert Hanssen were all Americans, in some cases with security clearances. In a democracy, there is no easy solution to this problem.

Homeland security is so big that it may be inherently unsolvable. Yet it is a risk that must be managed. That means government needs to find a reasonable level of countermeasures to establish a reasonable level of security. Instead, it continues to suggest to the American people that a few billion dollars and a reshuffling of the bureaucracy can solve the problem.

Overall, Ranum does an excellent job of showing what is right and wrong about homeland security issues. The only time the author blunders, is when he takes a somewhat overly simplistic view of the Middle East crisis, and makes some unreasonable comparisons.

The 9-11 attacks started a giant wheel moving, and that wheel's name is the Department of Homeland Security. The Jungle ushered in a new era within the meatpacking industry, while Unsafe at Any Speed fundamentally changed Detroit, and saved tens of thousands of lives in the process. If The Myth of Homeland Security has but a hundredth of the impact, and if it does nothing more than get the FBI and CIA to work better together, then maybe homeland security won't be a myth after all.

Rating:
Summary: Critical Thinking About True Homeland Defense
Review: Homeland Security is a hot topic. Even if it wasn't, the "wag the dog" mentality of the United States government would make it so. The terrorist attacks of 9/11 have defined and driven almost all aspects public policy and government spending since then. In a knee-jerk reaction to the events, many laws and initiatives were passed ostensibly to protect our country from any similar attacks in the future.

Marcus Ranum's book- The Myth of Homeland Security- illustrates how these knee-jerk reactions fall short of the goal. The Homeland Security Act and the PATRIOT Act in particular seem to do as much or more to limit and strip the individual freedoms of law abiding U.S. citizens as they do to protect the country or deter terrorism.

Much of the book is almost more of a rant about the current state of government in the United States, but even the ranting is engaging to read and Ranum backs his opinions up with intelligent, well-written and sometimes humorous points.

Ranum does offer some solutions, while also stressing that not everything is even fixable. Much of security is illusion. It is smoke and mirrors to give the sense of security when in reality a determined attacker could easily bypass the security measures and attack successfully.

I recommend this book for everyone if for no other reason than to ensure that the American public continue to think critically and question our elected officials and not simply fall for the illusion of security.

Tony Bradley is a consultant and writer with a focus on network security, antivirus and incident response. He is the About.com Guide for Internet / Network Security (http://netsecurity.about.com), providing a broad range of information security tips, advice, reviews and information. Tony also contributes frequently to other industry publications. For a complete list of his freelance contributions you can visit Essential Computer Security (http://www.tonybradley.com).


Rating:
Summary: entertaining polemic
Review: I purchased and read this entertaining romp despite having skimmed it at the bookstore and reading this poor ad hominem argument:

"After watching the way the worldwide media and the international community reacted to the question of Iraq's weapons of mass destruction, I don't think they'd see a smoking gun if you stuck it right against their foreheads." (p. 220)

I purchased it anyway, because although I think that's an incredible feeble aside (Mr. Ranum doesn't bother to say what smoking guns he thinks have been established, and it seems clear as of this writing that there are no WMDs in Iraq, and no good evidence that there were any post-1994), elsewhere in my initial skimming I saw what looked to be very interesting information about the Homeland Security Act and the USA PATRIOT Act. Largely because of this material, I did find the book to be worth my time (if not quite worth the dollars I spent on it--I should have waited for a paperback edition).

The book is definitely a polemic, not a researched and referenced scholarly tome--there are no references or footnotes, beyond the suggested further reading material on pp. xvi-xvii. There is much to disagree with besides the above example, as other reviewers here have noted. It's short on conclusions and suggested remedies, though there are a few radical (i.e., politically impossible) suggestions, such as abolishing the INS and starting over from scratch (probably not a bad idea at all).

I recommend it for those interested in a lightweight, quick read to get a quick overview of the problems of securing an entire nation and the means that are being adopted with that alleged goal, but if you are looking for depth and detail, with solidly argued conclusions and recommendations, you'll need to look elsewhere.

Rating:
Summary: Makes you think
Review: I've known Marcus for several years. One of the things that has always impressed me was his ability to make you think, to demonstrate ideas you never heard of before. His book does just that, it makes you think, which is critical for security. While I may not agree with the some of the points he raises, its important to question and understand the issues involved.

Rating:
Summary: The perfect boxcutter companion!
Review: If you're a little uneasy these days with teenagers testing our homeland security by planting boxcutters and getting away with it, this book is a must read! Ranum takes what a lot of us have been thinking for the past couple of years and puts it into perspective. It's refreshing to see something other than rants. This guy actually brings common sense into the picture with his In a Perfect World at the end of each chapter. By the time you finish checking out his "you should know" factoids, you know you're a much better informed citizen. It's the perfect "plane read" (especially that chapter on Airline Insecurity).

Rating:
Summary: It's about Ranum, not about Homeland Security
Review: It was reassuring to see Ranum discussing the areas he's known for: downplaying the over-hyped risks cyber-terrorism (and he has thoughtful comments on a cyber "pre-"Pearl Harbor).

But the rest of the book is a lot more about Ranum's opinions and speculations, and rather light on reliable facts. Where you already agree, you might cheer Ranum on. But if he introduces material that surprises or challenges, he cites no sources, so who know's if he's talking fact or blather?

In numerous places, he's vague or superficial or appears to contradict points he made a chapter or two back. It's as though the book was written in a number of brief bursts, the author forgetting between times what he'd said before.

One strange example: on p174, Ranum claims that the Code Red virus might have been caught even by outdated virus software, hence Code Red's spread is indicative of mass lack of any kind virus protection, not simply virus writer being a small step ahead. Interesting enough to deserve a bit more of an explanation.

The book review by Rob Slade (Google newsgroups) takes Ranum to task for this comment. Then an "annoyed" Ranum, replying in Risk Digest 23.14, claims he never wrote this!

I'm pretty sure this was just an example of vagueness... but it's emblematic of what's wrong with this book, and it's exponentially moreso in the squishier political and governmental areas.

Rating:
Summary: A level-headed look by a 6 month-expert
Review: Ranum admits that he's no expert on homeland security. And proceeds to prove it. (He has a solid background in computer security but spent only several months researching homeland security). He says that he read the Homeland Security Act and that both the ACLU and the Justice Dept are wrong about it's contents, but does a poor job of detailing what it is all about.
He quotes lots of hearsay and old data. He grabs snippets of information to make his point, not realizing that they could sometimes equally well prove the opposite point. He spends many pages telling us, both how hard the job of security is, how important it is and how badly it is being done, but his solutions, when offered, however, aren't terribly practical or aren't much better than what is in place.
Like the other reviewers, I agree with most of what he says, but I already knew most of it too. Gov't is bloated. Politicians are more concerned with gain for themselves and their districts than with effective legislation. Security is at least 50% illusion. It is impossible to stop a truely determined terrorist. And the Homeland Security Act is a double-edged sword that is as likely to hamper our freedoms as citizens as it is to slow down terrorism. Yep. It's all true, Marcus.

Overall, I give the author gets points for being concerned. He gets points for pointing out legitimate problems and for caring enough to research the situation. And he does know his computer security. But I wish he had more solutions and less frustration. I found myself saying "Yep, I agree" far more than "Wow! This guy is sharp or well-informed or insightful". I've read better editorials about the Homeland Security Act than this book (and worse ones too). It ain't bad, it just ain't all that good neither.

Rating:
Summary: A level-headed look by a 6 month-expert
Review: Ranum admits that he's no expert on homeland security. And proceeds to prove it. (He has a solid background in computer security but spent only several months researching homeland security). He says that he read the Homeland Security Act and that both the ACLU and the Justice Dept are wrong about it's contents, but does a poor job of detailing what it is all about.
He quotes lots of hearsay and old data. He grabs snippets of information to make his point, not realizing that they could sometimes equally well prove the opposite point. He spends many pages telling us, both how hard the job of security is, how important it is and how badly it is being done, but his solutions, when offered, however, aren't terribly practical or aren't much better than what is in place.
Like the other reviewers, I agree with most of what he says, but I already knew most of it too. Gov't is bloated. Politicians are more concerned with gain for themselves and their districts than with effective legislation. Security is at least 50% illusion. It is impossible to stop a truely determined terrorist. And the Homeland Security Act is a double-edged sword that is as likely to hamper our freedoms as citizens as it is to slow down terrorism. Yep. It's all true, Marcus.

Overall, I give the author gets points for being concerned. He gets points for pointing out legitimate problems and for caring enough to research the situation. And he does know his computer security. But I wish he had more solutions and less frustration. I found myself saying "Yep, I agree" far more than "Wow! This guy is sharp or well-informed or insightful". I've read better editorials about the Homeland Security Act than this book (and worse ones too). It ain't bad, it just ain't all that good neither.

Rating:
Summary: ... and the truth shall make you free
Review: Ranum's book is engaging, unsettling, entertaining, and disturbing. Yet, I think it is an accurate assessment of the morass that is "homeland security." MJR may not make any friends in the FBI, INS, or DHS, but as he turns his keen analytical mind towards security issues broader than an area for which he is world-renowned -- computer and network security -- he brings clarity to this seemingly unfathomable topic.

Many security practitioners have recognized the "when you don't know what to do, do something" aspect of some homeland security initiatives. Ranum identifies the agencies and actions that shape homeland security, and makes suggestions for change. Warning: Not everything is fixable, and he makes that clear also. But the beginning of any solution is to first recognize the real problems -- the real risks. The next step is to assess what you are already doing. The third is to toss out what is not working, reform what is marginal, and implement what is missing. In this book, Ranum suggests solutions.

The security of the US homeland, and all that it entails, affects Americans, certainly, as well as the whole world. Mr. Ranum is a skilled writer and instructor. Never satisfied to merely lecture, he endeavors to "cause one to learn." Though he is famous in a highly technical field, the "techie" as well as the "artsy" will be able to read this book, as Ranum makes the subject matter accessible and -- although the subject matter is "life and death" -- enjoyable.

Rating:
Summary: Glad to see this book
Review: The Myth of Homeland Security is an excellent debunking of the counter-terrorism security nonsense that we're all being forced to put up with. Marcus has written an honest, straightforward, sensible book. I don't agree with every point he makes, but it's refreshing to read someone who actually takes a stand on the issues and supports his stance with intelligent arguments and not rhetoric. The fact that this book is enjoyable to read is a bonus.