Inside the twisted mind of the security professional

[ciphergoth]

Bruce Schneier once wrote an excellent essay entitled Inside the twisted mind of the security professional.

Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that you could get ants sent to you in the mail.

I replied: "What's really interesting is that these people will send a tube of live ants to anyone you tell them to."

Security requires a particular mindset. Security professionals -- at least the good ones -- see the world differently. They can't walk into a store without noticing how they might shoplift. They can't use a computer without wondering about the security vulnerabilities. They can't vote without trying to figure out how to vote twice. They just can't help it.

This was my reaction on reading this story on craziestgadgets.com (propogated from booklectic):

A Norwegian hospital is outfitting all newborn babies with Anti-Theft Alarms. The alarms consist of a small chip placed on the baby’s ankle bracelet and it is paired with a matching chip on the mother’s bracelet.

If the two chips are separated by more than a certain distance, an alarm goes off. If the baby’s bracelet is removed without authorization, the whole hospital goes into lockdown mode with the elevators stopping and the doors locking. The alarms are meant to prevent both kidnappings and baby mixups.

My question is, is there a crime you could commit by locking down the hospital at a time of the criminal's choosing? Prop open a few doors (or have associates hold them open), then snip the bracelet to lock down the rest, and use the ensuing chaos to steal stuff? Or indeed, could you use it to commit a murder?

Comments

[drdoug.livejournal.com]

They will surely get far more false alarms than real ones, which will have the obvious effect on people's reactions to the alarm/lockdown happening.

An obvious place to subvert this system is before the tags get put on, or - actually, this is probably by far the best plan - simply get hold of the gadget that removes the tags when people are discharged. A little light social engineering would suffice.

But more fundamentally, I can believe that political pressure and a loss of clear thinking (easily done w.r.t. small children) could lead to the introduction of a system along those sort of lines (with an alarm) but cannot believe that any hospital (with a maternity unit) would introduce a system that would stop all the elevators. Think about it for a minute. It's a bonkers plan. Elevators in hospitals are a life-critical system. (Locking all the external doors seems a little fishy but is not quite as self-evidently ludicrous.) And then re-read the linked story and look for any specific details that would make it possible to falsify or verify it independently ... oh look, there aren't any.

Or indeed, could you use it to commit a murder?

My initial thought was "but a hospital is already a really good place to do that", except of course for the small matter that the victim is conveniently located for quick access to expert emergency health care, so you'd need to choose method appropriately.