Sometimes, Security Theater Really Works

Israeli security researchers Gadi Evron and Imri Goldberg find that security theater can be about more than window dressing

Security theater isn't necessarily as ineffective as the security community believes. In Israel, there is a guard at the entrance to every store. The guard isn't very useful to stop an attacker, and yet in several cases the guards' presence does make a difference, often at the cost of their lives.

The term "security theater" describes security measures designed to make people feel secure by putting up a reassuring show. It is observable security, if not necessarily useful. In this article we want to discuss a case where it works really well, if rather grim.

As information security professionals we often believe that physical security is in our repertoire and that we understand it well, which is not always the case. We are annoyed when we observe security theater such as when visiting airports in the United States, watching the TSA at work. Budgets for security are difficult to secure so watching so much of it being misused (wasted) without a real gain to actual security is disturbing, to say the least.

By itself, security theater can have positive effects. It has been argued that security theater yields a false sense of security. However, the goal of a terror organization is to destroy the sense of security people enjoy in their lives.

It uses the media to leverage relatively few successful attacks, to create panic and fear, aiming to prevent people from going on with their daily lives. This can be considered as trying to create a "false sense of insecurity." Viewed in this light, security theater may be effectively combating that effect.

One immediately observable use of security theater is deterrence. Security theater is in fact security by obscurity. If played right, it can play a crucial role in the larger security strategy and add a layer of psychological deterrence to potential attackers.

Indeed, this has been grimly observed as operationally viable in preventing terror attacks such as suicide bombings in Israel.

When visiting Israel, one of the first things tourists note is that at the entrance to nearly every public venue, be it a mall or a restaurant, there is an armed security guard. Unlike other places around the world, the security guard is there to screen incoming customers, rather than outgoing ones. They are not there to prevent thefts, but a terror attack.

It is not the guard's effectiveness in sniffing bombs that saves lives. These guards are not very formidable. Often they are either young 20-something students paying for their tuition or, more commonly, retired elderly folks.

Their training varies from absolutely non-existent to three days of learning how to shoot a gun. In some rare cases they are soldiers on active duty, guarding a problematic location.

The guard stands (or sits) on a chair at the entrance to the venue, he (or she) range in observed activity from staring at people as they walk in, to using metal detectors and looking inside their bags. In between you can find ineffective guards who feel a bag's bottom (let's don't and say we did, eh?) and those who stare into it and let you in.

While these guards' screening abilities are far from being adequate, many of the terror suicide bombings in the past few years failed because of them. Sometimes it's because the guard actually recognized that the person was a terrorist and acted with varying levels of success. In other occasions, the terrorist panics.

When he (or she) approaches the guard they either panic immediately and blow themselves up, or wait until the guard goes on with his cursory checking. They take the guard and possibly others to their deaths along with them, but the people inside are safe, and a much bigger disaster is averted.

It is important to note that suicide bombers and their operators aim to "increase their ROI" (a macabre way of saying, aiming for maximum casualties). This means that a suicide bomber will go to a place with a large crowd. When that bomber sees a guard at the door, he (or she) might choose a different place, not wanting to risk the guard being effective. The suicide bomber has just one shot at it, and he'd rather go to a place with fewer people, but less guarded.

Naturally, security theater is not always a strategic choice, a part of the larger security plan. But despite the bad name it now has, it can be.

Security theater is not always laughable.

Gadi Evron and Imri Goldberg are security researchers living in Israel.

Copyright © 2008 IDG Communications, Inc.

Microsoft's very bad year for security: A timeline