Secrecy and security

Bruce Shneier points to interesting testimony from the Director of the National Security Archive regarding rising levels of secrecy within the government, using the war on terror as a justification. The testimony highlights the observation that secrecy often doesn't contribute to security (a point that Shneier has made elsewhere)

The lesson of 9/11 is that we are losing protection by too much secrecy. The risk is that by keeping information secret, we make ourselves vulnerable. The risk is that when we keep our vulnerabilities secret, we avoid fixing them. In an open society, it is only by exposure that problems get fixed. In a distributed information networked world, secrecy creates risk -- risk of inefficiency, ignorance, inaction, as in 9/11. As the saying goes in the computer security world, when the bug is secret, then only the vendor and the hacker know -- and the larger community can neither protect itself nor offer fixes.

The testimony offers some great examples of instances where exposing secrets actually contributed to averting attacks or catching criminals and argues that one of the lessons of 9/11 was the need for greater openness, rather than increased secrecy:

The number one lesson of 9/11 is that the "relevant players" include the public, front and center. As the staff director of the Congressional Joint Inquiry on 9/11 found, "The record suggests that, prior to September 11th, the U.S. intelligence and law enforcement communities were fighting a war against terrorism largely without the benefit of what some would call their most potent weapon in that effort: an alert and informed American public. One need look no further for proof of the latter point than the heroics of the passengers on Flight 93 or the quick action of the flight attendant who identified shoe bomber Richard Reid." After all, the only part of our national security apparatus that actually prevented casualties on 9/11 was the citizenry - those brave passengers on Flight 93 who figured out what was going on before the Pentagon or the CIA did, and brought their plane down before it could take out the White House or the Capitol.

Look at the case of the Unabomber, the Harvard-educated terrorist who blew up random scientists with letter bombs. Years of secret investigation turned up nothing but rambling screeds against modernity and the machine, and only after the madman threatened more violence unless his words were published, did the FBI relent and give the crank letter file to the newspapers. The Washington Post and the New York Times went in together on a special section to carry the 35,000 words in 1995, but the key paper was the Chicago Tribune, read at the breakfast table in a Chicago suburb by the bomber's brother, who said, sounds like crazy Ted, guess I'd better call the cops.

How did we catch the Washington sniper? The police had been chasing a white van for weeks with no luck, and finally changed the description to a blue sedan based on an eyewitness report. They refused to give out the license plate number (because the sniper would then change the plates, of course); but finally an unnamed police official took it upon herself to leak the license number at midnight, local radio and TV picked it up, and a trucker was listening who saw a blue sedan in a rest area in western Maryland. He checked the plate number, and bingo, within three hours of the leak they arrested the sniper. Openness empowers citizens.