Bruce Schneier Quotes & Sayings

A colleague once told me that the world was full of bad security systems designed by people who read Applied Cryptography — Bruce Schneier

Security is a process, not a product. — Bruce Schneier

Air travel survived decades of terrorism, including attacks which resulted in the deaths of everyone on the plane. It survived 9/11. It'll survive the next successful attack. The only real worry is that we'll scare ourselves into making air travel so onerous that we won't fly anymore. — Bruce Schneier

It doesn't matter how big your neocortex is or how abstractly you can reason: unless you can trust others, your species will forever remain stuck in the Stone Age. — Bruce Schneier

One of the most surreal aspects of the NSA stories based on the Snowden documents is how they made even the most paranoid conspiracy theorists seem like paragons of reason and common sense. — Bruce Schneier

When a big company lays you off, they often give you a year's salary to 'go pursue a dream.' If you're stupid, you panic and get another job. If you're smart, you take the money and use the time to figure out what you want to do next. — Bruce Schneier

More people are killed every year by pigs than by sharks, which shows you how good we are at evaluating risk. — Bruce Schneier

Buy American Doesn't Sell Well Anymore Because It Means Give A Copy To The NSA — Bruce Schneier

Privacy is a fundamental human need — Bruce Schneier

Despite fearful rhetoric to the contrary, terrorism is not a transcendent threat. A terrorist attack cannot possibly destroy our country's way of life; it's only our reaction to that attack that can do that kind of damage. — Bruce Schneier

The most common misconception about privacy is that it's about having something to hide. "If you aren't doing anything wrong, then you have nothing to hide," the saying goes, with the obvious implication that privacy only aids wrongdoers. — Bruce Schneier

We can't keep weapons out of prisons; we can't possibly expect to keep them out of airports. — Bruce Schneier

No one can duplicate the confidence that RSA offers after 20 years of cryptanalytic review. — Bruce Schneier

Data is the pollution problem of the information age, and protecting privacy is the environmental challenge. — Bruce Schneier

Most people don't seem to care whether their intimate details are collected and used by corporations; they think that surveillance by governments they trust is a necessary prerequisite to keeping them safe. Most people are still overly scared of terrorism. They don't understand the extent of the surveillance capabilities available to both governments and private parties. They underestimate the amount of surveillance that's going on and don't realize that mass government surveillance doesn't do much to keep us safe. Most people are happy to exchange sensitive personal information for free e-mail, web search, or a platform on which to chat with their friends. — Bruce Schneier

We saw this in late 2014 when Apple finally encrypted iPhone data; one after the other, law enforcement officials raised the specter of kidnappers and child predators. This is a common fearmongering assertion, but no one has pointed to any actual cases where this was an issue. Of the 3,576 major offenses for which warrants were granted for communications interception in 2013, exactly one involved kidnapping - and the victim wasn't a child. — Bruce Schneier

The mantra of any good security engineer is: 'Security is a not a product, but a process.' It's more than designing strong cryptography into a system; it's designing the entire system such that all security measures, including cryptography, work together. — Bruce Schneier

When people are scared, they need something done that will make them feel safe, even if it doesn't truly make them safer. Politicians naturally want to do something in response to crisis, even if that something doesn't make any sense. But unfortunately for politicians, the security measures that work are largely invisible. — Bruce Schneier

Choosing providers is not a choice between surveillance/not; it's just choosing which feudal lord gets to spy on you. — Bruce Schneier

We tend to focus on rare and spectacular threats and ignore the more frequent and pedestrian ones. So we fear flying more than driving, even though the former is much safer. Or we fear terrorists more than the police, even though in the US you're nine times more likely to be killed by a police officer than by a terrorist. — Bruce Schneier

Liberty requires security without intrusion, security plus privacy. — Bruce Schneier

The more technological a society is, the greater the security gap is. — Bruce Schneier

It is insufficient to protect ourselves with laws; we need to protect ourselves with mathematics. — Bruce Schneier

If anyone thinks they can get an accurate picture of anyplace on the planet by reading news reports, they're sadly mistaken. — Bruce Schneier

There are two types of encryption: one that will prevent your sister from reading your diary and one that will prevent your government. — Bruce Schneier

If someone steals your password, you can change it. But if someone steals your thumbprint, you can't get a new thumb. The failure modes are very different. — Bruce Schneier

Estimates put the current number of Internet-connected devices at 10 billion. — Bruce Schneier

People often represent the weakest link in the security chain and are chronically responsible for the failure of security systems. — Bruce Schneier

The user's going to pick dancing pigs over security every time. — Bruce Schneier

Cryptography products may be declared illegal, but the information will never be — Bruce Schneier

If you have nothing to hide, then you have nothing to fear. This is a dangerously narrow conception of the value of privacy. Privacy is an essential human need, and central to our ability to control how we relate to the world. Being stripped of privacy is fundamentally dehumanizing, and it makes no difference whether the surveillance is conducted by an undercover policeman following us around or by a computer algorithm tracking our every move. — Bruce Schneier

Only amateurs attack machines; professionals target people. — Bruce Schneier

ID can be hijacked, and cards can be faked. All of the 9/11 terrorists had fake IDs, yet they still got on the planes. If the British national ID card can't be faked, it will be the first on the planet. — Bruce Schneier

When my mother gets a prompt 'Do you want to download this?' she's going to say yes. It's disingenuous for Microsoft to give you all of these tools with which to hang yourself, and when you do, then say it's your fault. — Bruce Schneier

Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break. — Bruce Schneier

Beware the Four Horsemen of the Information Apocalypse: terrorists, drug dealers, kidnappers, and child pornographers. Seems like you can scare any public into allowing the government to do anything with those four. — Bruce Schneier

Microsoft knows that reliable software is not cost effective. According to studies, 90% to 95% of all bugs are harmless. They're never discovered by users, and they don't affect performance. It's much cheaper to release buggy software and fix the 5% to 10% of bugs people find and complain about. — Bruce Schneier

Terrorism is a crime against the mind. We win by refusing fear. — Bruce Schneier

Data is the exhaust of the information age. — Bruce Schneier

Microsoft made a big deal about Windows NT getting a C2 security rating. They were much less forthcoming with the fact that this rating only applied if the computer was not attached to a network and had no network card, and had its floppy drive epoxied shut, and was running on a Compaq 386. Solaris's C2 rating was just as silly. — Bruce Schneier

We no longer know whom to trust. This is the greatest damage the NSA has done to the Internet, and will be the hardest to fix. — Bruce Schneier

Post-9/11 surveillance has caused writers to self-censor. They avoid writing about and researching certain subjects; they're careful about communicating with sources, colleagues, or friends abroad. A Pew Research Center study conducted just after the first Snowden articles were published found that people didn't want to talk about the NSA online. A broader Harris poll found that nearly half of Americans have changed what they research, talk about, and write about because of NSA surveillance. — Bruce Schneier

In the 17th century, the French statesman Cardinal Richelieu famously said, "Show me six lines written by the most honest man in the world, and I will find enough therein to hang him." Lavrentiy Beria, head of Joseph Stalin's secret police in the old Soviet Union, declared, "Show me the man, and I'll show you the crime." Both were saying the same thing: if you have enough data about someone, you can find sufficient evidence to find him guilty of something. — Bruce Schneier

The very definition of news is something that hardly ever happens. If an incident is in the news, we shouldn't worry about it. It's when something is so common that its no longer news - car crashes, domestic violence - that we should worry. — Bruce Schneier

Computer security can simply be protecting your equipment and files from disgruntled employees, spies, and anything that goes bump in the night, but there is much more. Computer security helps ensure that your computers, networks, and peripherals work as expected all the time, and that your data is safe in the event of hard disk crash or a power failure resulting from an electrical storm. Computer security also makes sure no damage is done to your data and that no one is able to read it unless you want them to — Bruce Schneier

Those of us who fought the crypto wars, as we call them, thought we had won them in the 1990s. What the Snowden documents have shown us is that instead of dropping the notion of getting backdoor government access, the NSA and FBI just kept doing it in secret. — Bruce Schneier

NSA analyst touches something in the database, — Bruce Schneier

If you ask amateurs to act as front-line security personnel, you shouldn't be surprised when you get amateur security. — Bruce Schneier

If the FBI parks a van bristling with cameras outside your house, you are justified in closing your blinds. — Bruce Schneier

I am regularly asked what the average Internet user can do to ensure his security. My first answer is usually 'Nothing; you're screwed'. — Bruce Schneier

Metadata equals surveillance; it's that simple. — Bruce Schneier

Surveillance makes us feel like prey, just as it makes the surveillors act like predators. — Bruce Schneier

History has taught us: never underestimate the amount of money, time, and effort someone will expend to thwart a security system. It's always better to assume the worst. Assume your adversaries are better than they are. Assume science and technology will soon be able to do things they cannot yet. Give yourself a margin for error. Give yourself more security than you need today. When the unexpected happens, you'll be glad you did. — Bruce Schneier

Mug shot extortion sites turn this sort of thing into a business. Mug shots are public record, but they're not readily available. Owners of mug shot sites acquire the photos in bulk and publish them online, where everybody can find them, then charge individuals to remove their photos from the sites. — Bruce Schneier

The fundamental driver in computer security, in all of the computer industry, is economics. That requires a lot of re-education for us security geeks. — Bruce Schneier

But eavesdropping acquired a new, and more intense, life after the terrorist attacks of 9/11. "Never again" was an impossible mandate, of course, but the only way to have any hope of preventing something from happening is to know everything that is happening. That led the NSA to put the entire planet under surveillance. — Bruce Schneier

Corporate and government surveillance aren't separate; they're an alliance of interests. — Bruce Schneier

Think of your existing power as the exponent in an equation that determines the value of information. The more power you have, the more additional power you derive from the new data. — Bruce Schneier

Something that looks like a protocol but does not accomplish a task is not a protocol - it's a waste of time. — Bruce Schneier

For if we are observed in all matters, we are constantly under threat of correction, judgment, criticism, even plagiarism of our own uniqueness. We become children, fettered under watchful eyes, constantly fearful that - either now or in the uncertain future - patterns we leave behind will be brought back to implicate us, by whatever authority has now become focused upon our once-private and innocent acts. We lose our individuality, because everything we do is observable and recordable.
[The Eternal Value of Privacy, May 18, 2006] — Bruce Schneier

Increasingly, companies use their power to influence and manipulate their users. Websites that profit from advertising spend a lot of effort making sure you spend as much time on those sites as possible, optimizing their content for maximum addictiveness. — Bruce Schneier

But in this country, while you have to be competent to pull off a terrorist attack, you don't have to be competent to cause terror. All you need to do is start plotting an attack and - regardless of whether or not you have a viable plan, weapons or even the faintest clue - the media will aid you in terrorizing the entire population. — Bruce Schneier

I used to say that Google knows more about what I'm thinking of than my wife does. But that doesn't go far enough. Google knows more about what I'm thinking of than I do, because Google remembers all of it perfectly and forever. — Bruce Schneier

You can think of the difference between tactical and strategic oversight as the difference between doing things right and doing the right things. Both are required. — Bruce Schneier

It's frustrating; terrorism is rare and largely ineffectual, yet we regularly magnify the effects of both their successes and failures by terrorizing ourselves. — Bruce Schneier

People don't understand computers. Computers are magical boxes that do things. People believe what computers tell them. — Bruce Schneier

Privacy is an inherent human right, and a requirement for maintaining the human condition with dignity and respect. It is about choice, and having the power to control how you present yourself to the world. — Bruce Schneier

The more we expect technology to protect us from people in the same way it protects us from nature, the more we will sacrifice the very values of our society in futile attempts to achieve this security. — Bruce Schneier

Secret courts making secret rulings on secret laws, and companies flagrantly lying to consumers about the insecurity of their products and services, undermine the very foundations of our society. — Bruce Schneier

One hundred years ago, everyone could have personal privacy. You and your friend could walk into an empty field, look around to see that no one else was nearby, and have a level of privacy that has forever been lost. As Whitfield Diffie has said: No right of private conversation was enumerated in the Constitution. I don't suppose it occurred to anyone at the time that it could be prevented — Bruce Schneier

Terrorism isn't a crime against people or property. It's a crime against our minds, using the death of innocents and destruction of property to make us fearful. Terrorists use the media to magnify their actions and further spread fear. And when we react out of fear, when we change our policy to make our country less open, the terrorists succeed
even if their attacks fail. But when we refuse to be terrorized, when we're indomitable in the face of terror, the terrorists fail
even if their attacks succeed. — Bruce Schneier

Why is it that we all - myself included - believe these stories? Why are we so quick to assume that the TSA is a bunch of jack-booted thugs, officious and arbitrary and drunk with power? It's because everything seems so arbitrary, because there's no accountability or transparency in the DHS. — Bruce Schneier

The real targets of terrorism are the rest of us: the billions of us who are not killed but are terrorized because of the killing. The real point of terrorism is not the act itself, but our reaction to the act. And we're doing exactly what the terrorists want [ ... ] Our politicians help the terrorists every time they use fear as a campaign tactic. The press helps every time it writes scare stories about the plot and the threat. And if we're terrified, and we share that fear, we help. — Bruce Schneier

As former NSA general counsel Stewart Baker said, "Metadata absolutely tells you everything about somebody's life. If you have enough metadata you don't really need content. — Bruce Schneier

Surveillance of power is one of the most important ways to ensure that power does not abuse its status. But, of course, power does not like to be watched. — Bruce Schneier

The science and engineering of programming just isn't good enough to produce flawless software, and that isn't going to change anytime soon. The — Bruce Schneier

It doesn't matter how good the card is if the issuance process is flawed. — Bruce Schneier

The whole notion of passwords is based on an oxymoron. The idea is to have a random string that is easy to remember. Unfortunately, if it's easy to remember, it's something nonrandom like 'Susan.' And if it's random, like 'r7U2*Qnp,' then it's not easy to remember. — Bruce Schneier

It is sort of interesting that in our society this days we are very quick to apply the term 'war' to places where thare are no actual wars, and loath to apply the term 'war' when we are actually fighting wars. — Bruce Schneier

Chaos is hard to create, even on the Internet. Here's an example. Go to Amazon. Buy a book without using SSL. Watch the total lack of chaos. — Bruce Schneier

I tell people if it's in the news don't worry about it. Because by definition news is something that almost never happens. — Bruce Schneier

Trying to make bits uncopyable is like trying to make water not wet. The sooner people accept this, and build business models that take this into account, the sooner people will start making money again. — Bruce Schneier

The potential for manipulation here is enormous. Here's one example. During the 2012 election, Facebook users had the opportunity to post an "I Voted" icon, much like the real stickers many of us get at polling places after voting. There is a documented bandwagon effect with respect to voting; you are more likely to vote if you believe your friends are voting, too. This manipulation had the effect of increasing voter turnout 0.4% nationwide. So far, so good. But now imagine if Facebook manipulated the visibility of the "I Voted" icon on the basis of either party affiliation or some decent proxy of it: ZIP code of residence, blogs linked to, URLs liked, and so on. It didn't, but if it had, it would have had the effect of increasing voter turnout in one direction. It would be hard to detect, and it wouldn't even be illegal. Facebook could easily tilt a close election by selectively manipulating what posts its users see. Google might do something similar with its search results. — Bruce Schneier

It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security. — Bruce Schneier

If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology. — Bruce Schneier

Embedded in digital photos is information such as the date, time, and location - yes, many cameras have GPS - of the photo's capture; generic information about the camera, lens, and settings; and an ID number of the camera itself. If you upload the photo to the web, that information often remains attached to the file. — Bruce Schneier

Digital files cannot be made uncopyable, any more than water can be made not wet. — Bruce Schneier

By 2010, we as a species were creating more data per day than we did from the beginning of time until 2003. By 2015, 76 exabytes of data will travel across the Internet every year. — Bruce Schneier

Given the credible estimate that we've spent $1 trillion on anti-terrorism security — Bruce Schneier

There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files. — Bruce Schneier

Societies without a reservoir of people who don't follow the rules lack an important mechanism for societal evolution. Vibrant societies need a dishonest minority; if society makes its dishonest minority too small, it stifles dissent as well as common crime. — Bruce Schneier

It is poor civic hygiene to install technologies that could someday facilitate a police state. — Bruce Schneier

This is not the internet the world needs, or the internet its creators envisioned. We need to take it back. And by we, I mean the engineering community. — Bruce Schneier

The overwhelming bulk of surveillance is corporate, and it occurs because we ostensibly agree to it. I don't mean that we make an informed decision agreeing to it; instead, we accept it either because we get value from the service or because we are offered a package deal that includes surveillance and don't have any real choice in the matter. — Bruce Schneier

Technical problems can be remediated. A dishonest corporate culture is much harder to fix. — Bruce Schneier

We kill people based on metadata. — Bruce Schneier

You can't defend. You can't prevent. The only thing you can do is detect and respond. — Bruce Schneier

If something is free, you're not the customer; you're the product. — Bruce Schneier

Terrorists can only take my life. Only my government can take my freedom. — Bruce Schneier

Ubiquitous surveillance means that anyone could be convicted of lawbreaking, once the police set their minds to it. It is incredibly dangerous to live in a world where everything you do can be stored and brought forward as evidence against you at some later date. There is significant danger in allowing the police to dig into these large data sets and find "evidence" of wrongdoing, especially in a country like the US with so many vague and punitive laws, which give prosecutors discretion over whom to charge with what, and with overly broad material witness laws. This is especially true given the expansion of the legally loaded terms "terrorism," to include conventional criminals, and "weapons of mass destruction," to include almost anything, including a sawed-off shotgun. The US terminology is so broad that someone who donates $10 to Hamas's humanitarian arm could be considered a terrorist. — Bruce Schneier