The subtitle should be, "Whom do we think we're fooling, and how does this serve our security objectives?" Let us begin with a few cases from the real world.
A FACILITY IN THE WOODS
A research facility that once engaged my consulting firm to help defend against ecoterrorist attacks had some executives who wondered aloud about the merits of stretching their security dollars by putting up dummy video cameras interspersed among functioning devices installed for perimeter intrusion detection. This was a bad idea. Why? If they had accompanied their junior and middle managers to the field for a reality check, as I did, they would have seen that the only consistent attention drawn by such dummy cameras was for target practice. My local guide, a field supervisor and long-term company employee, pointed out how the only value realized from a former executive's bright idea about installing dummy cameras at the corner of a tree farm was that these devices drew most of the rifle fire that would have otherwise been aimed at a ground-level access hatch to a utility connection. The supervisor ruefully noted that executive management tended to ignore his input on the effectiveness of these dummy installations, perhaps because he lacked the organizational authority that comes with more senior rank. He wondered if the same advice from an external consultant, me, might not find a more receptive ear in mahogany row. So did I. It did. The executives quietly buried the dummy camera idea.
A SCHOOL IN THE DARK
A colleague found himself advising a public school on what to do about security lighting for a facility repeatedly struck by burglars and vandals at night. His client, having read up on crime prevention through environmental design, reasoned that protective lighting would deter intruders because it would increase their chance of detection, hence their risk of apprehension. So the client dutifully surrounded the school with extra floodlights, arranged them to avoid glare that would affect surrounding homes, and asked for the lighting contractor to make sure that the light was of the proper illumination and strength to provide deterrence. The intrusions and losses not only continued but started to increase. Unlike his client, my colleague actually went to the school at different hours of the day and night, first to measure the lighting strength in foot candles and then to determine whether there was an undetected flaw in coverage. Perhaps a gap in lighting had inadvertently surfaced to provide intruders with concealment that had gone undetected. No, that was not the case. What had happened? My colleague roamed around the school and the entire neighborhood before figuring out that the school lighting was acting not as a deterrent but as a beacon. It was attracting burglars and vandals, illuminating their target and facilitating their movement once on the premises. What did he advise? He had the school try shutting off the floodlights and all but a few motion-activated lights in order to see what would happen. As a result, intruders moved to other, better lit targets. Problem solved.
A NUISANCE CORNER
A home I once had rested on a corner lot where trees and ivy looked presentable during the day but started attracting juvenile loiterers at night. The kids started gathering in that spot, leaving beverage cans, cigarette butts, and other detritus that only a future archaeologist might find noteworthy. Why? It was just out of the cone of illumination of the nearest street light. Thanks to the know-how of a visiting relative, I had the help it took to install floodlights along the dark corner of my home, but this project triggered a debate. My relative suggested using a motion-activated sensor to switch the lights on when kids passed the side of the house. I voted for a light sensor that switched them on automatically at night. Since the house and expense were mine to bear, my vote was decisive. This decision also worked and saved money. How so? My option worked like the street light that the kids were avoiding by hanging out at the side of my house. By turning on automatically as the street lights turned on as well, my new lights instantly removed the attraction that was drawing the kids to my corner. So they shuffled off somewhere else. If I had relied on a motion sensor, chances are the kids would have been able to figure out how to bypass the sensor and still manage to keep loitering in the same general area -- unless I installed a lot more motion sensors. Then they would have also had the option of entertaining themselves by seeing how many times they could trigger the sensors on and off. In any case, turning sensors on and off this way would sentence my family to the annoyance of constant clicking sounds and would likely wear out my floodlights faster, at greater expense. Turning the lights on automatically at night kept the loiterers from approaching in the first place -- something the motion-activated option would not do equally. One option was tailored to solve the problem. The other option was not as thought out as it was reflexive.
LESSONS
Symbolic security offers more value to its advocates than to targets needing protection. And it does this by generating two kinds of expense. First, there is the direct cost of symbolic security: the cost of installing, operating, or replacing dummy cameras, lights, and any other stage management expenses of security theater. Second, there is the less tangible yet more corrosive damage to security's credibility and to voluntary adoption of security recommendations by a targeted population turned into reluctant, jaded customers. That is the real cost: losing the people whose voluntary compliance is vital to defending against threats.
WIDER APPLICATION
Look at any overextended, intrusive, and costly program unburdened by metrics or demonstrable returns yet perpetuated under the banner of security. Some aspects of TSA screening and NSA data vacuuming come to mind. Are the programs delivering results in proportion to what they are costing us? Or, like dummy cameras and symbolic security, are they fooling only those who perpetuate them while the real villains safely smile from a distance, patiently devising the next attack and watching defenders chase their tails?
-- Nick Catrantzos