Re: Castles and Security (fwd)

[Adam Shostack <adam () homeport org>]

On Thu, Jan 04, 2001 at 02:26:32PM -0500, Marcus J. Ranum wrote:
> I keep coming back to this issue of improving targeting and it seems
> like lots of people don't "get it" - I'm worried that I'm not
> communicating effectively, or something. Am I being obscure?

You're using an analogy which folks with a background in the military, 
or military history get, and others don't.  I don't think you're being 
obscure, but I will argue that targeting is not as valuable as you
hope.  The problem is the effect of firing for effect.  You're going
to put a large number of children in jail.  (We could argue that
they're not children, etc, etc, but thats not relevant.  You'll put
some 14 year old honor photogenic honor student away, and we'll be in
the child-vs-adult debate.)

You can sometimes solve terrorism problems when you have a small
number of terrorists by smashing the terrorist group.  The western
democracies now all have units who are trained to enter a terrorist
situation, and kill all the terrorists.   They do
this because if you take the terrorists prisoner, then they spend
time in jail agitating while their friends become terrorists and
demand their release.  Also, it seems to be an effective deterrent to
terrorism to know that you're not going to make it out alive.

However, this doesn't work when you can't kill the terrorists.  A few
years of juvinile detention for a small fraction of script-kiddies is
not going to deter all the rest.

The only ways I'm aware of that terrorism campaigns are stopped when
you have a large population of recruits is through a hearts and minds
campaign (Ireland, Malaysia--you can argue these), or by a massive
crackdown (Soviet Russia).

So, lets assume that you have perfect targeting capability: You can
backtrace any vandalism you want.  Lets also assume a set of costs:
$50, $50,000, and $5 million.

What do you do in each of these cases?

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
                                                       -Hume



_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards