Bruce Schneier is a lot like Janeane Garofalo.  Bear with me here for a second.  I LOVE Janeane Garofalo.  In fact until very recently, she was number one on my list of what I call 50/50 women.  That is women who I know only through their celebrity and therefore my mental image of them is made up of 50% real information and 50% my imagination filling in the gaps between their public persona and who they really are.  No doubt, 50% real information is a very high estimate, but I, like everyone else, like to think I'm a good judge of people, so I'm giving myself credit for being right about a lot of things that are really just guesses.

Anyway, Janeane is smart, funny, and beautiful not to mention self deprecating.  She is good with a turn of phrase, and she seems to be a very light hearted person.  That was of course until the last presidential election cycle.  At some point she changed from a comedian/actress into a full time political activist.  And this change was definitely for the worse in her case.  Not because there is anything wrong with political activism itself.  I think everyone should take action on the things that they feel strongly about.  It's a bad thing because in making this change, she left behind all of the things that I loved about her.  In her activist role, there seems to be no room for humor as she feels the need to treat even minor issues with deadly seriousness and there appear to be little need for intelligence as her arguments have become largely emotion driven leaving reason in the dust.  She's even not as cute when she's so glum.

That brings me back to Bruce for a second.  For a long time, Bruce was the male Garofalo.   Very smart and funny with a razor like wit that really got to the core of security issues.    He's probably even handsome for a geek in a no so dirty hippy kind of way.  But he somehow veered off the rails recently, I'd guess since 9-11 and the response to it in this country.  Where he was at one time driven primarily by logic and allowed reason to guide him to the points he would eventually make, he appears to have also been taken over by emotion.  His articles these days start with a premise that entities, especially governments, taking away what are viewed as civil liberties is bad, and he will then proceed to filter the evidence in the case at hand to support that conclusion.

Much like Garofalo, I don't disagree with most of his points overall, but the way that he delivers them and the evidence he uses to support them have grown weaker and weaker until they mostly seem like an obligatory inclusion rather than an actual logical argument.

The other comparison that comes to mind is Ayn Rand.  You start with the premise that everyone should thing for themselves and view the world rationally, and then you decide that if everyone did that they would come to the same conclusions you do, so you decide to save them all a bunch of time by just skipping to telling them the conclusions.  If anyone disagrees, they aren't being rational enough and they need to rethink their position.  Or even better, just accept your.

Bruce hasn't made that full transition yet obviously, because he still feels the need to provide evidence to support his positions no matter how weak that evidence is.  Luckily, most of the people reading his blog don't need any evidence to agree with him, and they just skim over those parts of the articles which re-enforces the idea that evidence really isn't needed.

I've been thinking about this for a while, but the other day I was reading this blog entry (http://www.schneier.com/blog/archives/2008/06/cctv_cameras.html) and it all sort of jumped out at me again.  Maybe I was just in a bad mood for some reason or feeling extra critical that day, but the article and the evidence didn't line up the way I would expect them to.  The premise is clearly that CCTV monitoring is bad because it's a violation of rights of privacy, and the support is that it's also not very effective.  A reasonable argument to make, but a pretty weak one when you read the details.  There are two major classes of issues that he talks about making the CCTVs ineffective, one is poor implementation and the other is circumventability ( yes I made up a word).

The problem is that if you took these same two classes of problems and presented them to him in the description of a network security control, they wouldn't carry nearly as much weight.  Poorly implemented firewalls or encryption systems provide very little security.  In fact, according to Bruce's recent work, they may be worse than nothing because they give you a false sense of security.  Still, I wouldn't think that he would expect people to abandon these solutions en-mass because if they are executed poorly they won't work.  The better answer is to make sure you execute them well.

The circumventablity of a control by a resourceful attacker is also a well known problem in the network security field.  An attacker with enough resources, or resourcefulness, and enough time will bypass most controls.  Again, this isn't a good reason to trash those controls.  It's a good reason to execute them well, execute them in depth, and monitor them.  Arguments that Bruce himself has made over the years.

So why aren't these problems treated the same in network security as they are in CCTV deployments?  Because of the sensitive political and emotional impact of CCTV monitoring.  There's nothing wrong with that, but you have to be willing to call that out and admit that you are swayed by the emotional impact of the control and not rely on weak logical arguments to support and emotional finding.  Bruce hasn't crossed the line that Janeane and Ayn crossed where he is ready to openly toss aside logic and argue for emotion, so he tries to provide the obligatory supporting information, but his heart isn't in it, so he's no longer as critical as he should be.

I would love to read a good article directly addressing the weighing of effectiveness vs. privacy intrusion of well implemented CCTV monitors in public places, but it appears to not be the type of debate we can expect from Bruce these days.  After hearing his talk at RSA and speaking with him a little bit during the week, I don't expect anything different any time soon.

On the bright side, it looks like we'll have a democratic president in a few months, so maybe Garofalo will be back.  If so, call me. ;)