Saturday, November 28, 2009

A lesson from Tuesday's gate-crashing

I can only imagine how heads will roll--if they haven't already--at the Secret Service, following the black eye they took from the gate-crashers at Tuesday's state dinner. (As if the spectacle of the former President dodging shoes wasn't embarrassing enough...) As the 90's most notorious hacker (Kevin Mitnik) demonstrated time and again, no policy manual in the world will bullet-proof security. Mainly because policies and procedures are a cookie-cutter for the irregularly-shaped mat of dough we fondly call Reality. Those leftover bits of dough can include data errors, gray areas, new circumstances, unforeseen circumstances, emergencies--even the obligatory unguarded reactor exhaust vent on every Death Star. And most especially the alchemy of human personality itself. All combine to create the need for the ability to override policy/procedure. And that's where any self-respecting gate-crasher (or desperate Rebel Alliance) will home in.

That being said, paranoia combined with inflexible adherence to procedure is not a valid response. Period. Ditto betting your security on writing an absolutely perfect policy manual that covers all contingencies. Because, paradoxically, human beings can also be the strongest point in any security system. Particularly when they are trained and exhaustively experienced enough that their gut instincts are more reliable than pure metrics (e.g. ticking off boxes on a checklist). In other words, cameras and scanners and policy manuals and what-have-you are only as good as those who use them--a point ably illustrated by the fact that planting over ten thousand security cameras in London have not significantly boosted crime-solving rates, at least not as of 2007 and 2008.

Fortunately for the Secret Service--and the USA's political continuity--President Bush has decent reflexes (not to mention that insult, rather than injury, was intended) and Mr. & Mrs. Salahi were basically joy-riding. But the take-away boils down to this: If one of the world's foremost security organizations can have such glaring lapses, how realistic is it to expect that we can keep what we consider "valuable" safe from all who would steal or vandalize it? And, more importantly, what are we willing/able to do about that?