We Have Root

Bruce Schneier is an internationally renowned security technologist, called a "security guru" by The Economist. He is the author of over one dozen books as well as hundreds of articles, essays, and academic papers. His influential newsletter "Crypto-Gram" and his blog "Schneier on Security" are read by over 250,000 people. He has testified before Congress, is a frequent guest on television and radio, has served on several government committees, and is regularly quoted in the press. Schneier is a fellow at the Berkman Klein Center for Internet & Society at Harvard University; a Lecturer in Public Policy at the Harvard Kennedy School; a board member of the Electronic Frontier Foundation, AccessNow, and the Tor Project; an Advisory Board Member of the Electronic Privacy Information Center and VerifiedVoting.org; and a special advisor to IBM Security.

• Introduction xi1 Crime, Terrorism, Spying, and War 1Cyberconflicts and National Security 1Counterterrorism Mission Creep 4Syrian Electronic Army Cyberattacks 7The Limitations of Intelligence 8Computer Network Exploitation vs Computer Network Attack 11iPhone Encryption and the Return of the Crypto Wars 13Attack Attribution and Cyber Conflict 16Metal Detectors at Sports Stadiums 19The Future of Ransomware 212 Travel and Security 25Hacking Airplanes 25Reassessing Airport Security 283 Internet of Things 31Hacking Consumer Devices 31Security Risks of Embedded Systems 32Samsung Television Spies on Viewers 36Volkswagen and Cheating Software 38DMCA and the Internet of Things 41Real-World Security and the Internet of Things 43Lessons from the Dyn DDoS Attack 47Regulation of the Internet of Things 50Security and the Internet of Things 53Botnets 69IoT Cybersecurity: What’s Plan B? 704 Security and Technology 73The NSA’s Cryptographic Capabilities 73iPhone Fingerprint Authentication 76The Future of Incident Response 78Drone Self-Defense and the Law 81Replacing Judgment with Algorithms 83Class Breaks 875 Elections and Voting 89Candidates Won’t Hesitate to Use Manipulative Advertising to Score Votes 89The Security of Our Election Systems 91Election Security 93Hacking and the 2016 Presidential Election 966 Privacy and Surveillance 99Restoring Trust in Government and the Internet 99The NSA is Commandeering the Internet 102Conspiracy Theories and the NSA 104How to Remain Secure against the NSA 106Air Gaps 110Why the NSA’s Defense of Mass Data Collection Makes No Sense 114Defending Against Crypto Backdoors 117A Fraying of the Public/Private Surveillance Partnership 121Surveillance as a Business Model 123Finding People’s Locations Based on Their Activities in Cyberspace 125Surveillance by Algorithm 128Metadata = Surveillance 132Everyone Wants You to Have Security, But Not from Them 133Why We Encrypt 136Automatic Face Recognition and Surveillance 137The Internet of Things that Talk about You behind Your Back 141Security vs Surveillance 143The Value of Encryption 145Congress Removes FCC Privacy Protections on Your Internet Usage 148Infrastructure Vulnerabilities Make Surveillance Easy 1507 Business and Economics of Security 155More on Feudal Security 155The Public/Private Surveillance Partnership 158Should Companies Do Most of Their Computing in the Cloud? 160Security Economics of the Internet of Things 1658 Human Aspects of Security 169Human-Machine Trust Failures 169Government Secrecy and the Generation Gap 171Choosing Secure Passwords 173The Human Side of Heartbleed 177The Security of Data Deletion 179Living in a Code Yellow World 180Security Design: Stop Trying to Fix the User 182Security Orchestration and Incident Response 1849 Leaking, Hacking, Doxing, and Whistleblowing 189Government Secrets and the Need for Whistleblowers 189Protecting Against Leakers 193Why the Government Should Help Leakers 195Lessons from the Sony Hack 197Reacting to the Sony Hack 200Attack Attribution in Cyberspace 203Organizational Doxing 205The Security Risks of Third-Party Data 207The Rise of Political Doxing 210Data is a Toxic Asset 211Credential Stealing as an Attack Vector 215Someone is Learning How to Take Down the Internet 216Who is Publishing NSA and CIA Secrets, and Why? 218Who are the Shadow Brokers? 222On the Equifax Data Breach 22610 Security, Policy, Liberty, and Law 229Our Newfound Fear of Risk 229Take Back the Internet 232The Battle for Power on the Internet 234How the NSA Threatens National Security 241Who Should Store NSA Surveillance Data? 244Ephemeral Apps 247Disclosing vs Hoarding Vulnerabilities 249The Limits of Police Subterfuge 254When Thinking Machines Break the Law 256The Democratization of Cyberattack 258Using Law against Technology 260Decrypting an iPhone for the FBI 263Lawful Hacking and Continuing Vulnerabilities 265The NSA is Hoarding Vulnerabilities 267WannaCry and Vulnerabilities 271NSA Document Outlining Russian Attempts to Hack Voter Rolls 275Warrant Protections against Police Searches of Our Data 277References 281