Skating on Stilts

123: Christmas in July

Edward Snowden criticizes Russia’s mass surveillance law, and a Russian official retaliates by outing him ‒ as a Russian intelligence source.  Silent Circle, the phone company that built its marketing on fear and loathing of the NSA, is nearing bankruptcy.  Members of the dominant European Parliament faction are asking the Commission, “Hey! How come you keep demanding more data export and privacy concessions from the US without asking for bupkis from China?”  And the FBI now has three politically viable paths to win back authority to obtain electronic communications transaction records with a National Security Letter. 

Truly, episode 123 feels like a reward for living through 2013.

In other news, Alan Cohn and Katie Cassel report on the Bank for International Settlements’ surprisingly sophisticated cybersecurity standards.  I whinge about Bob Litt’s 18 pages of binding commitments to Europe on how the US will conduct intelligence from now on.  Alan and I compliment CBP on its technical savvy in easing border clearance ‒ and ponder the role of stools in protecting the homeland.

I report that Belgian courts have reversed a verdict by the local DPA against Facebook, and Maury Shenk comments on broader implications for EU data protection.  Katie notes that FTC commissioner Maureen Olhausen continues to tout the advantages of her agency’s “flexible” privacy and security standard and to diss the FCC’s more explicit approach.  I mock the ACLU for demanding the right to violate criminal law to get information from private companies and ask if I can do the same to get the ACLU to answer my Twitter questions about whether it provides real security for its clients.  And Maury reports that China is still rolling out new internet regulations, from online search standards to where to store Chinese citizens’ personal data (China, natch).

As always, the Cyberlaw Podcast welcomes feedback.  Send email to [email protected] or leave a message at +1 202 862 5785. 

Download the 123^rd episode (mp3).

Subscribe to the Cyberlaw Podcast here. We are also now on iTunes, Pocket Casts, and Google Play!

Excerpt 11 -- Conservatives for Exponential Change

This is another excerpt from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

Some lessons from my time at DHS are hard-won: Even if al Qaeda disappears, the temptation to terrorism will not go away. And tools that can give new power to terrorists are being improved every day. Terrorist attacks using these technologies are completely predictable.

But I also know now just how hard it is to head off predictable disasters. Anything government proposes to modify the trajectory of that technology, any suggestion that we apply the brakes or wear a helmet will face diplomatic, privacy, and business resistance.

These constituencies will fight for the status quo. It’s a strange kind of status quo that they want – constant, exponential acceleration. But acceleration can feel very stable. For a while.

***

I’m proud of what DHS was able to do at the border. It was a revolution. It took years of hard fighting to put in place security solutions that worked with new technologies instead of against them. Truth be told, it took three thousand deaths, too.

I’d like to think that we can apply those lessons to other technologies before we suffer a catastrophe. I’d like to think we can build prudent, imaginative security measures into information networks and biotechnology, just as we did with our border procedures. I’d like to think that we can act before there’s been a disaster.

But, really, I don’t know if we can.

Excerpt 10 -- International Resistance

This is another excerpt from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

Business and privacy groups were conservative by choice in this debate. The third player – the international community -- is conservative by nature. Other countries just don’t like it when the United States changes policies. And our new border strategy was a change. The Canadian ambassador to the United States was vocal in questioning our fight plan to require passports for all travelers, questioning whether we were ready and predicting disaster if we actually carried out our plan. He pressed us many times to postpone the requirement, and the Canadian government would have been delighted to see it delayed forever.

It makes a kind of sense that other nations would line up against change. After all, the travel and tourism businesses are often multinationals (so are the privacy groups, in some cases). If new U.S. border measures may make Americans safer but put a burden on Lufthansa, European officials may feel it’s their job to represent the interests of Lufthansa.

Sometimes it’s hard to separate that motive from a less attractive one. Unfortunately, anti-Americanism is now an institutionalized part of the politics of most Western nations. Practically all developed democracies, particularly in Europe, have a party that is anti-American and a party that is not.

There are a lot of reasons for this. They may blame us for changes in the world that aren’t exactly our responsibility (we blame Hollywood for the skewed values taught by the movies; Europeans blame us). They may have felt slighted or ignored as the U.S. puts its policies together. And President Bush’s moral certainty after 9/11 did not wear well abroad; he was cast as a handy villain in a tale of American unilateralism and imperialism. Even with a new President, I don’t expect much change in this institutionalized anti-Americanism. Saying “no” – or “yes, but” – to the United States is the diplomatic default position of virtually every foreign ministry across the globe.

And that is indeed what the diplomats of the European Union said when DHS began to implement a data-based screening system. Borrowing arguments from both their travel industry and their privacy advocates, European officials set out to thwart DHS’s new policy and to roll back the clock, to take us back as near as possible to the old, failed status quo.

As we’ll see, they very nearly won.

Excerpt 9 -- The Privacy Lobby

This is another excerpt from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

I started to believe that some of the privacy groups just objected in principle to any use of technology that might help catch criminals or terrorists. The example I remember best was when the police at Logan Airport got handheld computers. The computers were connected to public databases so they could check addresses and other information when they stopped someone. It was pretty much what any businessman could do already with a Blackberry or iPhone.

The ACLU went nuts. The executive director of the Massachusetts chapter called the handhelds "mass scrutiny of the lives and activities of innocent people,” and “a violation of the core democratic principle that the government should not be permitted to violate a person's privacy, unless it has a reason to believe that he or she is involved in wrongdoing." Another ACLU spokesman piled on. "If the police went around keeping files on who you lived with and who your roommates were, I think people would be outraged," He told USA Today. "And yet in this case, they're not doing it, but they're plugging into a company that is able to do it easily."

Remember, the handheld computers just tied to public databases that any citizen could search. "It's nothing we don't have access to already," Lieutenant Thomas Coffey told the Boston Globe. "Instead of me having to go down to the registry of deeds in a particular county, I can now access this information via a BlackBerry," he added.

If the ACLU considered that a civil liberties disaster, I remarked, we’d better not tell them that we also have access to the White Pages.

Still, “no” was the privacy community’s default answer to any improvement in law enforcement technology. The rest of us can use Blackberries, Google and Facebook all we want to gather information about our friends, our business associates, and even our blind dates, the ACLU seemed to think, but law enforcement should live in 1950 forever.

So it’s no surprise that privacy groups challenged our passenger screening time and again, in the press and on the Hill. Each time, they found sympathetic ears. They forced us to justify our plan over and over again. Without the strong, consistent support of Michael Chertoff, a superb policy advocate in his own right, and his willingness to take on the New York Times and the ACLU, our strategy would have been chipped away bit by bit.

Excerpt 8 -- The Opposition

This is another excerpt from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

At this point, some readers must be wondering what the fuss is about. Surely this approach to border security is obvious. There’s nothing especially ground-breaking or high-tech about a passenger screening program that uses data to improve decisionmaking.

Well, yes and no.

Yes, it’s easy to imagine such a border control system. It was easy to imagine such a system in the 1980s, too. But governments didn't implement it. They did the opposite. They surrendered to the tide of travelers.

Why, we asked, did they make a choice that seems so foolish now? We soon found out. We were going to have to fight for our new border strategy. And it wasn’t at all clear that we were going to win – even though the new approach moved most travelers as fast as before, and even though the old approach had produced a disastrous failure and left three thousand dead. It didn’t matter. We were in for a bruising political and diplomatic battle.

We were fighting powerful constituencies that weren’t used to losing. To them, our new approach was a threat greater than terrorism. They had defended the status quo against past efforts to revise border procedures, and they didn’t think the unfortunate events of 9/11 were a reason to change course.

The first and most obvious opponents of change were the businesses whose profits depended on the status quo. Our new strategy was going to shake things up. For example, in the old days, to encourage travel, the United States had told a number of countries in the Western Hemisphere that they could come to the United States without a passport. That put a big hole in our security strategy, but when we filled it by requiring that all international air travelers have passports, industry howled. Tourism, travel, and airline executives wanted to keep riding the exponential growth in jet travel. They didn’t want any innovations in government security on the border. The industry couldn’t be sure that the measure would improve security, but they were sure of one thing. If the measure made travel less attractive, they'd be hurt. So the safe course for industry was to always advocate less control, not more. And that’s what they did. We had to jam the requirement through over their resistance.

An even more formidable opponent was the privacy lobby. Throughout our tenure at DHS we faced claims from privacy groups that using data to screen travelers was somehow an abuse of personal information. Privacy watchdogs in the United States and Europe didn’t like it when government got access to any information for any purpose. If the data was collected at all, they agreed, it must be cabined in the most stringent manner. They wanted suffocating controls on what we gathered and how we used it.

Excerpt 7 -- Clean Skins

This is another excerpt from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

The problem of jet travel, at its heart, is a matter of seconds.

At our airports, when international flights arrive, we can spend no more than thirty seconds with each traveler. In those thirty seconds, we have to decide who should be waved through and who should get more detailed attention. Indeed, thirty seconds is probably more than we can afford to spend; anyone who has experienced the lines at JFK or Dulles when all the international flights arrive together knows that they are dehumanizing and exhausting – not exactly a welcoming ceremony.

Our solution was to use information about the traveler more effectively. In the end, we boiled our border solution down to what we called the three Who’s: Who is coming the U.S.? Who are we worried about? And, finally, is this person who he says he is?

Answering the first question – who’s coming to the U.S.? -- required a major effort. To find out, in advance, who was coming here, we had to get information from the airlines about the passengers they were carrying. In the end, we had to insist that all international travelers, even those who didn’t need a visa, must provide information about themselves before they traveled.

Answering the second question – who are we worried about? -- meant assembling a list of known or suspected terrorists. We had to knock heads in the bureaucracy to ensure that each agency was contributing to a single list.

More importantly, we needed data. We needed information from other countries; if you want to know who the terrorism suspects are in Hungary, chances are that the Hungarian authorities have better sources than the FBI or CIA.

We also needed information that would help us spot new recruits who hadn’t yet come to the attention of the authorities.

Aussie ranchers call their unbranded calves “clean skins.” Their intelligence agencies have borrowed the term to describe terrorists who don’t yet have a record. They are every terrorist’s dream and every government’s nightmare. But no terror recruit is perfectly clean – with the right information, subtle connections can be found and risky travelers identified.

That was the heart of the solution. If we got data in advance, we could identify the tiny fraction of travelers who should be pulled aside for additional screening. The thirty second interview in the booth was no longer our only chance to find bad guys. Instead, it would become a backstop – a chance to doublecheck work that had been done in advance.

In theory, that should have been enough. If you know who you’re worried about and who’s coming, you can do the sorting on that basis. But terrorists aren’t always so obliging, or so stupid. If the government screens travelers based on who they are, then the terrorists will try to defeat the system by changing identities.

That’s why we had to answer the third question -- is the traveler really who he says he is? We had to lock travelers to a single identity, by raising security standards for passports around the world, and by recording travelers’ fingerprints that so that terrorists couldn’t use different passports to enter the United States. Even if they managed to fool another country into issuing a passport in a false name, they wouldn’t be able to fool us.

Excerpt 6 -- The Tokugawa Option

This is another excerpt from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

As the risks of future misuse emerged, a failure of imagination started to look pretty good compared to actually, you know, having an imagination. Because the question for DHS was what we were going to do about these risks now that we saw them.

I knew one thing. We couldn’t call timeout -- turn our backs on the technologies and the harm they can do.

Tokugawa Japan is famous for giving up firearms in the early 1600s, a hundred years after guns had been widely adopted throughout the country. For the next 250 years, it is said, Japan was ruled and wars were fought by the sword, even though guns were acknowledged to be more effective weapons.

But Tokugawa Japan is famous because its story is so uncommon (indeed, some say it isn’t true). Certainly no other nation is known to have denied itself an important technology for so long and survived.

If we can’t give these technologies up, we knew, we would have to find ways to manage their risks. We’d have to begin now to think about how to bend the rising curve of exponential change away from the most deadly consequences. How could we do that? We weren’t sure. But we started with travel -- the technology that had already caused so much death on September 11, 2001

Excerpt 5 - Biotech

This is another excerpt from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

If jet travel and computers were the ghosts of technologies past and present, biotechnology is a specter that haunts the future. It became my personal nightmare while serving on the Robb-Silberman commission. The United States agreed to give up biological weapons in the 1970s. And it stopped all work on them at that time. The Russians signed the same treaty but if anything they expanded their biological weapons programs, making ever more loathsome and unstoppable diseases. Little wonder then that their client states and allies, like Iraq, also had biological programs.

Most troubling from an intelligence point of view, our spies had little or no insight into these programs, in Russia or in Iraq, until defectors revealed them. It was just too easy to hide them, in medical or insecticide factories, say, or in anonymous laboratories in obscure cities.

Just as bad, the death and demoralization that biological weapons cause can be equivalent to a nuclear detonation. That made it crucial that we do a better job of tracking foreign governments’ illicit biological programs, as the Robb-Silberman commission recommended.

But that wasn’t the scariest part. What scared me was how rapidly the ability to make biological weapons is being democratized. Biotechnology is growing as fast as jet travel and computers. The cost and difficulty of biological engineering is being reduced at an exponential rate.

And scientists’ ability to build dangerous organisms is increasing just as fast. In 2005, the deadly 1918 flu virus was rebuilt from scratch. Smallpox has been eradicated in the wild; it is more dangerous to humankind than ever, now that vaccinations have stopped. It has not been synthesized, at least not that we know of. But the failure to recreate smallpox is now a matter of choice, not capability. Larger and more complex organisms have already been created, and the cost and difficulty of assembling such DNA sequences keeps dropping.

In fact, the current state of the art has moved from viruses (which some would describe as less than living) to bacteria. In 2008, scientists assembled the entire DNA sequence for a small bacterium that causes urinary tract infections.

Of course, you have to be really talented to assemble that large a sequence. Only a handful of labs could accomplish that feat today. But Moore’s law will do soon do for DNA synthesis what it did for mainframes. DNA experiments that were once the province only of big institutions with sophisticated staffs will in a few years be the playground of smart high school kids.

Indeed, that’s the dream of a lot of influential and wealthy industry leaders. The people who lived through the information revolution would like the biotech revolution to be a straight replay -- complete with DNA hackers operating out of their parents’ garage, DNA synthesis IPOs, and “open source” DNA coding languages. They’re not concerned that biotech and synthetic DNA haven’t really delivered big improvements in human health yet. Massively democratizing computer power was good for all of us, they say, pointing to the results of the personal computer and the Internet. Why shouldn’t the mass democratization of DNA synthesis also produce an outpouring of creativity, playfulness, and unexpected progress? Besides, they conclude, it’s going to happen whether we like it or not, so we might as well get on the bandwagon.

But you don’t have to be Cassandra, or Ned Ludd, to see that a world where millions of people can make smallpox from scratch might turn out to be a dangerous place.

That's not a future that wants to kill you; that’s a future that could kill you in a fit of adolescent pique.

Excerpt 4 -- Information Technology

This is excerpt 4 from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

For decades, information technology has been driven by Moore’s Law. One version of the law holds that the number of transistors that can be cheaply placed on a chip will double every 18 to 24 months.

It’s true. A computer that cost $1 million in 1970 could be duplicated for $500,000 in 1972 and for $10,000 in 1984. By the end of the 1980s, personal computers were giving individuals capabilities that were once available only to government and the Fortune 500; electronic spreadsheets, word processors, contacts files, and email began changing the way we all do business.

Surely one of the oddest results of going to work for the National Security Agency was my initiation into the vanguard of this trend. NSA controlled encryption, and especially exports of encryption. But as cheap home computers made the Internet a potential source of mass electronic commerce, Microsoft and other software companies wanted to build encryption into their products. They rightly saw a need for more security if computer networks were going to carry large transactions.

So, to defend NSA’s encryption policy, I had to understand the Internet, and the changes it would bring. While I never fully accepted their encryption policy proposals, I came to believe that the Internet revolution was coming. After leaving government I built a law practice around that technology, representing Netscape before its IPO launched the revolution and dozens of other Silicon Valley firms.

That meant I had a ringside seat as Moore’s Law worked its magic. By the late 1990s, computing power that had cost $1 million in 1970 could be had for a hundred dollars.

Cheap computing and telecommunications (not to mention a gradually softening policy on encryption exports) did indeed create a mass market Internet. We were able to search the accumulated wisdom and folly of humanity in seconds. We could download books, music, and movies – what we wanted when we wanted it. We could bank, play games, trade securities, salute friends, trash enemies, and gossip, build businesses, lose and find lovers, all on line.

Oh, and a few more things: we could be defrauded, robbed, extorted, and blackmailed with stolen secrets on line, too. The effort to export strong encryption turned out to be a red herring. Crooks easily found ways around even the strongest encryption.

But, as with commercial jet travel, it took a while for the bad news about information technology to arrive.

Some of the first hackers discovered that they could obtain free phone service by fooling AT&T’s computers in the 1970s, and the first computerized “worm” to clog the Internet wasn’t launched until 1988. Computer viruses emerged in 1980s, passed from disk to disk. They were an annoyance, but little more. Most were written to show off the skills of the author, a twentieth century version of “counting coup.”

But as we moved our lives on line, criminals followed. Hackers discovered that there was money in compromising other people’s computers. Spammers could use those machines to send messages without fear of being shut down. Nigerian spammers learned to defraud gullible men and women who had never traveled out of the country.

Networks of compromised machines were marshaled into vast zombie armies that could attack a single website together, knocking it off line. For some sites, being off line even for an hour was so costly that they’d pay extortionate fees to stop the attack.

Suddenly, exploiting computer security holes wasn’t the cyberspace equivalent of spraypainting graffiti on subway cars. It was a new form of organized crime. It paid well enough to attract real talent. And that talent found new ways to make insecurity pay.

Compromising the computers of credit card processors and merchants allowed identity theft and credit card fraud on a massive scale. Sending booby trapped emails to known individuals, in contrast, might only compromise a single machine, but it would allow the criminal to steal every name and password used on the machine – and to empty the bank account of the victim.

As the criminals demonstrated what could be done on line, governments followed their example. Governments didn’t steal money, though. They stole secrets. Protected from prosecution and motivated by patriotism, government hackers turned out to be even more effective than the crooks. Countries that depended on computer networks began to wonder whether they had any secrets left.

Bad as it was to lose secrets, that wasn’t the worst threat from government hacking. Once a system has been compromised, the attacker can choose its fate; he can keep the system alive and milk it of its secrets or he can kill it – shut it down for an indeterminate period. This meant that government attackers could exploit critical adversary systems for intelligence purposes for years, and then, in a crisis, they could shut the systems down.

The tools to infiltrate our information systems grow more sophisticated every year. The United States is the most at risk. It is probably among the top five intelligence targets of every government on earth. Why? Because our unique global military reach means that no government on earth can safely ignore the likely US reaction to its actions. Put another way, every tinpot president-for-life who wants to attack a neighbor has to worry first about whether he can beat the neighbor and second about whether the U.S. will stop him. So every government wants to know how we will react to what it does, and ideally it wants a weapon that can persuade us not to get in its way.

For many governments, hacking US information systems serves both purposes. Hostile nations can gather intelligence about our view of them while they plan attacks on a neighbor. And once the attack is launched, if the US interferes, the code that once spied on us can be used to shut our systems down. Electricity, aviation, communications, and banking can be disrupted, perhaps even sabotaged irreversibly. Without a shot being fired, without even a clear sense of who the attacker is, much of the United States could find itself living in post-Katrina New Orleans, but without hope of a rescue any time soon.

How effectively this weapon could be deployed today is in dispute. But there is little dispute that the attackers have been gaining on the defenders by leaps and bounds. Two nations have already suffered serious, coordinated cyberattacks originating in Russia during disputes with that country. The attacks were effective, but not crippling. So perhaps foreign nations cannot use information technology to kill or harm Americans on a large scale today. But it seems likely that they will have that capability soon. Just as it took decades for terrorists to cause catastrophic failures in the air transport system, it will take decades to find and exploit the most damaging holes in our information networks. So far, there is no sign that the spies and the crooks who are trying to do that are running out of ideas or money.

And what are we doing as this threat gathers?

More or less what border officials were doing in the 1980s. We are embracing information networks with the same enthusiasm we have displayed since the 1970s, and doing very little to close the security holes this technology opens.

We are up on the bike and flying downhill. Only now, as the scenery begins to blur, are we starting to understand that maybe this technology, too, will find a way to kill us.

Excerpt 3 -- Technology and Terror

This is excerpt 3 from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

Four years after the attacks, I joined the Department of Homeland Security. Chertoff asked me to create and run a policy office that would let DHS could lift its head above the scrum of daily crises and think about its biggest challenges.

DHS was still a startup, barely two years old, and it had spent those two years getting organized, finding desks and office space – and at the same time frantically trying to build defenses against an unseen enemy. No one had had much time to think about the future. That was one of the reasons we needed a policy office, or so I thought.

I wanted to think about 9/11 in a new way. It seemed to me that it was an event driven as much by technological change as by evil men and government errors. Sure, there were evil men, and there were errors. But we had to get beyond the immediate mistakes and focus on the long term trends that had made the attacks possible in the first place.

It’s when we started tracing the roots of the 9/11 attacks that we realized how jet travel and a growing flood of travelers had wrecked our traditional border defenses. That’s when we began to ask what other technologies might have in store for us.

***

Technologies like jet travel are seductive. That’s why we flock to them. They give us more choices and more reach. Commercial jets allowed us to work and play on any continent in a matter of hours. More recently, computers and the Internet gave us instant access to knowledge that once was available only to a handful of librarians. Biotechnology, just emerging as an exponential technology, will give us the power to create and design life itself.

Giving individuals these choices, reach and power is a great thing -- most of the time. In the end, though, technologies that empower ordinary individuals will also empower Osama bin Laden and John Wayne Gacy. It may take a long time. Commercial jet technology had been around for nearly half a century before nineteen men were able to use it to kill three thousand. But something like 9/11 was inherent in the technology from the start.

The 9/11 Commission criticized officials for a failure of imagination in the runup to the attacks. We didn’t see it coming. I resolved when I joined DHS to keep that failure in mind. Where else was our imagination failing us, I asked.

Once I began to think about it that way, I realized that jet travel is not the only technology that will put Americans at risk. Technologies like computers and bioengineering are more recent. Their power to change our lives is still growing, and their future is harder to predict. But if we wanted to get ahead of tomorrow’s terrorism, DHS had to begin thinking about their risks as well.

Based on my own experiences, I knew of two that were bearing down on us fast.

Excerpt 2 -- Yesterday's Technological Revolution

This is excerpt 2 from the book I'm writing on technology, terrorism, and my time at DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the category on the right labeled "excerpts from the book.")  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected].  If you're dying to order the book, send mail to the same address.  I'm still looking for an agent and a publisher, so feel free to make recommendations on that score too. 

--Stewart Baker

                                       

Lots of technology is like the bicycle. It seems implausible at first. As Arthur C. Clarke once said, “Any sufficiently advanced technology is indistinguishable from magic.”

Once we relax and learn to trust it, it really does give us new, nearly magical powers.

Then it starts finding new ways to kill us.

***

In a way, that’s what happened on September 11, 2001.

Technology – cheap commercial jet travel – made the attacks possible. In fact, it made attacks like September 11 more or less inevitable.

It may be hard to remember now, but air travel was once seen as the great technological achievement of the twentieth century. Futurists marveled at how it would change our world.

In 1907, as heavier-than-air flight was just becoming a reality, Alexander Graham Bell declared that it would not be long until “a man can take dinner in New York and breakfast the next morning in Liverpool.”

By the 1920s and 1930s, airplanes and air travel were to young men what computers became in the 1970s and 1980s – a way to revolutionize society, make a better world, and find a fortune. After World War II, the youngsters of the 20s and 30s set about building their dreams, and they succeeded.

As late as 1958, European flights were still a special event. That year, Life Magazine ran a feature story “Off for Paris in Jet Time,” describing a Pan Am flight from Idlewild (not yet LaGuardia) airport in New York. Actress Greer Garson was in “de luxe” class, along with 40 other passengers paying $909 for their round trip tickets. Another 71 economy passengers, dressed mostly in suit and tie, or dresses, also made the trip.

Fifty years after Bell envisioned trans-Atlantic travel, it was still remarkable enough to deserve a gushing feature in the pre-eminent magazine of the era.

That ended in 1959, when Boeing introduced its 707. The new jet cut flying time between New York and London from twelve hours to six. In an instant, international air travel went from luxury to commonplace. By 1965, 95 percent of transatlantic travelers were crossing in the fast jets of Pan Am and European airlines such as British Overseas Air.

In the 70s, Boeing introduced the jumbo jet. By then, jet travel had lost any resemblance to magic and had acquired an unfortunately close resemblance to, well, bus travel. Yet jet tourism kept growing. In 1950, air travelers flew about 28 billion kilometers. By 2000, that number had grown to three trillion.

In those years, international air travel had roughly doubled every five years. That’s fifty years of exponential growth.

Any technology that grows that fast is going to have some unexpected effects. As it grew, jet travel brought a slow revolution to the border.

The Department of Homeland Security is our youngest department, but its border agencies can trace their heritage to the beginning of the American republic. They had lived through the era of exponentially increasing international travel. They had watched as a rising tide of international travelers slowly overwhelmed their 1950-era security measures.

Border checkpoints and searches, travel visas and printed passports – these things had changed little since the 19th century. Some were even older; written safe conduct passes for travelers go back to 1414 in England, and the oldest existing passport was issued in 1641 by King Charles I. Even the name “passport” reveals its antiquity. Passports were used to pass through the gate ("porte") of a city wall in medieval Europe. By the 1980s, though, the walls were down and the gate was open.

Border controls that depended on a serious inspection of individuals, their passports and their luggage, simply could not keep up. Border officials could not spend much time with each traveler. The lines at the border were getting too long.

By the 1980s, governments had begun to vie with each other to dismantle these border security measures. U.S. Customs abandoned individual inspection of travelers, allowing those with nothing to declare simply to stroll through the Green Lane. The United States also adopted the Visa Waiver Program. The VWP abolished the single most important restraint on international travel, the visa.

Visas are travel permits. Issued by a country's embassy or consulate abroad, they authorize the visa holder to travel to that country. The process of issuing a visa can be quite simple or quite elaborate, but it typically requires at a minimum that the visa applicant go to the embassy of the country he wants to visit to provide whatever information the consular official requires.

As a control mechanism, the visa is highly flexible. To discourage illegal economic migration, countries may grant very few visas in poor countries -- and those only to the well-to-do. They may also deny visas to potential troublemakers, criminals, or terrorists. They may insist that the local government vouch for the visa applicant. They may require that applicants fill out detailed forms, or provide fingerprints, to help in the clearance process.

These control mechanisms worked pretty well in the first half of the 20th century. But a flood of commercial jet travelers turned visas into costly barriers to casual travel. Barriers that soon began to fall.

In 1988, the United States stopped requiring visas for nationals of Japan and the United Kingdom, and these governments did the same for Americans. The United States was certainly not alone. If anything, other countries moved further and faster. In 1985, for example, most members of the European Union began simply abolishing controls at their borders with other member states. In countries like Belgium, border inspectors were deployed only at international airports. Everywhere else, travelers were free to enter and leave the country without a glance from officialdom.

By the end of the 1980s, even the world’s most notorious border barriers had fallen. The fortified Iron Curtain cutting Eastern Europe off from the West was broken -- by governments and by crowds of citizens from East and West.

Soon, the retreat from border control measures became a rout. Thirteen years after admitting two countries to the visa waiver program, we had opened the doors to two dozen. By 2001, half of all the foreign visitors to the US – a million a month or more – were coming without a visa. No American official laid eyes on these travelers or even knew they were coming, right up to the moment they reached the immigration booth at LAX or JFK.

Even when visas were required, they were streamlined to eliminate the hassles, as well as the safeguards. In Saudi Arabia, for example, the U.S. State Department launched the Visa Express program in June 2001. The program allowed applicants to get a visa by submitting a two-page visa application to their Saudi travel agency instead of going to a US consulate to provide visa information.

Commercial jet technology had triumphed. It had made mass international travel possible, empowering millions. And almost without noticing it, these millions of empowered travelers had broken down a system of border security that had existed for decades.

Border officials noticed, of course, but they could not resist. If they insisted on the old controls, tourism and foreign investment would lag behind the rest of the world. As they saw it, they had only one choice: surrender the old control system or let their country stagnate.

So they surrendered.

We all know what happened next.

Excerpt 1: The improbable bicycle

A bicycle is an implausible thing. To see how implausible, take it out in the street and stand it up. Now let go.

It falls over.

Stand it up in the street and put a man on it; it falls over faster, and he’s likely to skin his knee. The thing is utterly unstable.

So who would imagine that the way to solve the instability is to put a man on it and roll the bicycle down a long hill? 

Nobody. It defies common sense that something so unstable could become more stable when it's moving. Perhaps that's why nobody imagined the bicycle, at least not for a couple of thousand years after it became perfectly possible to build one.

It took a lot to make the bicycle imaginable. In 1815, the battle of Waterloo brought an end to nearly twenty years of European war. At the same time, the largest volcanic explosion in recorded history occurred, at Mount Tambora in what is now Indonesia.

The next year, summer never came. Snow fell in every month. Crops failed. Without the crops, pack animals died.

Everyone in Europe cast at wary eye on St. Helena, where Napoleon was imprisoned, and wondered how they’d fight a war without pack animals.

The year after that, in 1817, a German official named Karl von Drais solved the pack animal shortage by inventing the bicycle. He demonstrated that soldiers could carry heavy weights quickly over long distances by riding and pushing a crude bicycle. His model weighed nearly 50 pounds, was built of wood and had no pedals. But once he showed that it worked, others improved the design until by the turn of the century the bicycle as we know it was everywhere.

The Romans -- perhaps even Alexander the Great -- could have built a bicycle like Karl von Drais’s, something with crude bearings and no pedals.

They didn’t, though, probably because the whole idea must have seemed so implausible. Who could imagine traveling at high speeds on a vehicle that can’t even stand upright by itself? 

But moving forward is the key to the bicycle’s stability. A bike moving at 1 mile per hour is a lot more stable than a bike at rest, and at 5 mph it’s more stable still. At even higher speeds, the bike can adjust faster and roll over obstacles that would bring it to a dead stop at lower speeds.

Go faster and feel safer. We all remember discovering this amazing rule as kids. If 5 mph is good, 10 should be better. And it is!  We remember how it ends, too. Fifteen mph is better still. And twenty. Everything is better on a bike when you go faster. Until, quite surprisingly, it’s not.

That’s when you discover that falling off a bike at 30 mph means something a lot worse than a skinned knee.

And suddenly the Romans don’t look quite so dumb.