Bruce Schneier: The security mirage

翻译人员: Yuli Zhou 校对人员: Tony Yet

安全其实是两种事物：

So, security is two different things:

它不仅是感觉，也是现实。

it's a feeling, and it's a reality.

这两样事物是完全不同的。

And they're different.

你可以在不安全的时候

You could feel secure even if you're not.

感觉很安全。

And you can be secure

或者你不感到安全的时候

even if you don't feel it.

却很安全

Really, we have two separate concepts

真的，我们有两种不同的概念

mapped onto the same word.

存在于同一个词语上。

And what I want to do in this talk is to split them apart --

我在这里想要做的是

把它们区分开来

figuring out when they diverge and how they converge.

找出什么时候它们存在分歧，

什么时候又聚合在一起。

And language is actually a problem here.

语言是个大问题。

因为没有多少适合的词语去表达

There aren't a lot of good words

我们将要谈到的概念。

for the concepts we're going to talk about.

如果你将安全

So if you look at security from economic terms,

视为一个经济学的名词，

那它就是“权衡取舍”。

it's a trade-off.

每一次你得到一些安全，

Every time you get some security, you're always trading off something.

你总是在拿一些东西去交换。

不管是个人决定

Whether this is a personal decision --

比如是否给家里装一个防盗器

whether you're going to install a burglar alarm in your home --

或者国家的决策，比如去侵略哪个国家

or a national decision,

where you're going to invade a foreign country --

你都要去交换，

you're going to trade off something: money or time, convenience, capabilities,

不管是金钱、时间、便利、能力，

还可能是基本自由权。

maybe fundamental liberties.

And the question to ask when you look at a security anything

当你面对安全的时候，要问的

is not whether this makes us safer,

不是这个能不能让我们更安全，

而是值不值得我们去交换。

but whether it's worth the trade-off.

You've heard in the past several years, the world is safer

你们这几年都听过，

世界更安全了是因为萨达姆倒台了。

because Saddam Hussein is not in power.

那个可能是真的，但没什么关系。

That might be true, but it's not terribly relevant.

问题是，值得吗？

The question is: Was it worth it?

你可以有自己的想法，

And you can make your own decision,

and then you'll decide whether the invasion was worth it.

然后决定那个侵略是否值得

那就是你如何在以权衡取舍

That's how you think about security: in terms of the trade-off.

来考虑安全。

Now, there's often no right or wrong here.

这里没有绝对的对与错。

我们中的有些人在家安了防盗器

Some of us have a burglar alarm system at home and some of us don't.

有些人没有

And it'll depend on where we live,

安不安取决于我们住在哪里

我们是独居还是有个家庭

whether we live alone or have a family,

我们有多少值钱的东西

how much cool stuff we have,

how much we're willing to accept the risk of theft.

我们愿意接受多少

盗窃带来的风险

In politics also, there are different opinions.

对于政治来说也是一样

存在着各种不同的观点

A lot of times, these trade-offs are about more than just security,

很多时候，这些权衡取舍

不仅仅跟安全有关

and I think that's really important.

对于这点我觉得很重要

Now, people have a natural intuition about these trade-offs.

当今人们有一种

关于这些权衡取舍的直觉

We make them every day.

我们每天都在用它来做决定

Last night in my hotel room, when I decided to double-lock the door,

比如昨晚我在酒店房间里

决定是否给门上两层锁的时候

or you in your car when you drove here;

或者你在驾车到这里的路上

或者当我们去吃午饭时

when we go eat lunch

and decide the food's not poison and we'll eat it.

会认为食物是没毒的然后放心地吃

We make these trade-offs again and again,

我们反复做出这种权衡取舍

每天都有很多次

multiple times a day.

我们甚至没有留意它们

We often won't even notice them.

They're just part of being alive; we all do it.

它们只是生活的一部分，人们都是这么做的

每一个物种都是这么做的

Every species does it.

Imagine a rabbit in a field, eating grass.

想象有一只兔子在吃草

然后它看到了一只狐狸

And the rabbit sees a fox.

That rabbit will make a security trade-off:

那只兔子需要做出一个关于安全的权衡取舍

"Should I stay, or should I flee?"

“我应该留下，还是逃跑呢？”

正如你所见

And if you think about it,

懂得做出权衡取舍的兔子

the rabbits that are good at making that trade-off

will tend to live and reproduce,

会选择生存和繁衍

and the rabbits that are bad at it

而不懂的兔子

will get eaten or starve.

则被吃掉

So you'd think

所以你可能会想

作为这个星球上一支成功的物种的我们 --

that us, as a successful species on the planet -- you, me, everybody --

你、我、所有人 --

would be really good at making these trade-offs.

比较擅长于做出有利的权衡取舍

然而事实一次又一次地证明

Yet it seems, again and again, that we're hopelessly bad at it.

我们并非如此

And I think that's a fundamentally interesting question.

我认为那是个关键又有趣的问题

I'll give you the short answer.

我给你们一个简短的答案

The answer is, we respond to the feeling of security

答案就是，我们依据的是安全的感觉

而非现实

and not the reality.

Now, most of the time, that works.

很多时候，这样没什么问题

Most of the time,

因为在大部分时间里

feeling and reality are the same.

感觉和现实是相同的

Certainly that's true for most of human prehistory.

在绝大部分史前人类历史中

那也是没错的

We've developed this ability

我们发展了这个能力

because it makes evolutionary sense.

因为它有利于进化

继续思考一下就知道

One way to think of it is that we're highly optimized

我们做出某些风险决策的能力

是高度优化了的

for risk decisions

这些决策是以群居的小型家庭形式

that are endemic to living in small family groups

in the East African Highlands in 100,000 BC.

生活在公元前十万年的东非高地的人们所独有 --

2010 New York, not so much.

其实2010年的纽约也差不多

Now, there are several biases in risk perception.

现在有一些对风险的偏见

很多实验都关于这些偏见

A lot of good experiments in this.

And you can see certain biases that come up again and again.

你可以观察到有些偏见反复出现

我讲四个

I'll give you four.

We tend to exaggerate spectacular and rare risks

第一个，我们会夸大那些耸人听闻但少见的风险

并漠视常见的

and downplay common risks --

比如像飞机和汽车的事故率

so, flying versus driving.

The unknown is perceived to be riskier than the familiar.

第二个，未知的被认为比熟悉的

更加危险

举个例子

One example would be:

people fear kidnapping by strangers,

人们害怕被陌生人绑架

when the data supports that kidnapping by relatives is much more common.

即使数据证实被亲戚绑架更常见

以上都是针对孩子们来说的

This is for children.

Third, personified risks are perceived to be greater

第三个，人格化的风险

被认为比匿名的更严重

than anonymous risks.

So, Bin Laden is scarier because he has a name.

所以本拉登很可怕是因为他有个名字

第四个是

And the fourth is:

people underestimate risks in situations they do control

人们在他们觉得可以掌控的情况下

会低估风险

而在不能控制的情况下高估风险

and overestimate them in situations they don't control.

So once you take up skydiving or smoking,

所以你在开始跳伞或抽烟后

you downplay the risks.

会不再重视它们带来的风险

如果你猛然面临某种风险 -- 恐怖主义是个好例子 --

If a risk is thrust upon you -- terrorism is a good example --

你会高估它，因为你不觉得你可以控制了

you'll overplay it,

because you don't feel like it's in your control.

There are a bunch of other of these cognitive biases,

还有许多这样的认知偏见

that affect our risk decisions.

影响着我们的风险决策

There's the availability heuristic,

有一种易得性偏差

意思是

which basically means we estimate the probability of something

我们在估计某事发生的概率时

by how easy it is to bring instances of it to mind.

依据的是想到具体的例子是否容易

So you can imagine how that works.

你可以想象那是怎么作用的

If you hear a lot about tiger attacks, there must be a lot of tigers around.

如果你听说了许多老虎袭击人的消息，那么你会认为肯定有很多老虎在附近

如果你没听说狮子袭击人，那么就没有多少狮子在附近

You don't hear about lion attacks, there aren't a lot of lions around.

这是可行的直到报纸被发明

This works, until you invent newspapers,

because what newspapers do is repeat again and again

因为报纸所做的

就是一遍又一遍地重复

那些少见的风险

rare risks.

I tell people: if it's in the news, don't worry about it,

我告诉大家，如果事情出现在新闻里，那就不用担心了

因为按照定义

because by definition, news is something that almost never happens.

新闻是从来没有发生过的事情

（笑）

(Laughter)

When something is so common, it's no longer news.

当事情变得常见了，那就不是新闻了

Car crashes, domestic violence --

比如车祸和家庭暴力

those are the risks you worry about.

你会担心这些风险

We're also a species of storytellers.

我们同时也是一种会讲故事的物种

We respond to stories more than data.

相比于数据，我们更喜欢故事

And there's some basic innumeracy going on.

在故事里，总有些对科学的无知存在

I mean, the joke "One, two, three, many" is kind of right.

比如 “一、二、三、很多”（见英文） 这个笑话

我们善于用小数字

We're really good at small numbers.

One mango, two mangoes, three mangoes,

一个芒果，两个芒果，三个芒果

10,000 mangoes, 100,000 mangoes --

一万个芒果，十万个芒果 --

it's still more mangoes you can eat before they rot.

在烂掉前还有足够的芒果等你去吃

So one half, one quarter, one fifth -- we're good at that.

二分之一，四分之一，五分之一 -- 我们擅长这些

百万分之一，十亿分之一 --

One in a million, one in a billion --

它们就像永远不会发生那样

they're both almost never.

So we have trouble with the risks that aren't very common.

所以我们不知如何面对

那些不常见的风险

And what these cognitive biases do

这些认知偏见所起的作用

is they act as filters between us and reality.

就是像过滤器一样隔断我们和现实

结果呢

And the result is that feeling and reality get out of whack,

感觉和现实被割开

它们变得不同了

they get different.

Now, you either have a feeling -- you feel more secure than you are,

现在你要么有种感觉 -- 你觉得比现实更加安全

这是一个错误的安全感

there's a false sense of security.

要么相反

Or the other way, and that's a false sense of insecurity.

出现错误的不安全感

我写了很多关于”安全剧场“的文章

I write a lot about "security theater,"

which are products that make people feel secure,

这个概念只起到让人们觉得很安全的作用

but don't actually do anything.

除此之外一无是处

There's no real word for stuff that makes us secure,

现实世界里不存在让我们安全

但不让我们觉得安全的事物

but doesn't make us feel secure.

可能这就是CIA应该为我们做的

Maybe it's what the CIA is supposed to do for us.

So back to economics.

好了，回到经济学里

If economics, if the market, drives security,

如果经济，或者市场，以安全为重

and if people make trade-offs based on the feeling of security,

并且人们根据安全的感觉

作出权衡取舍

then the smart thing for companies to do for the economic incentives

那么精明的公司所应该做的

为了经济上的激励

is to make people feel secure.

就是让人们觉得安全

And there are two ways to do this.

有两种方法可以做到

One, you can make people actually secure

一，你可以真正地做到安全

然后希望人们可以注意到

and hope they notice.

Or two, you can make people just feel secure

二，你可以让人们觉得安全

and hope they don't notice.

然后希望他们没有注意到真相

Right?

So what makes people notice?

那么到底什么可以引起人们注意是否安全呢？

有很多，比如

Well, a couple of things:

understanding of the security,

对安全的理解

对风险和威胁的理解

of the risks, the threats,

对 对策及其原理的理解

the countermeasures, how they work.

But if you know stuff, you're more likely

如果你知道很多东西

那么你更有可能拥有与现实一致的感觉

to have your feelings match reality.

很多现实生活中的例子可以帮助理解

Enough real-world examples helps.

比如我们都了解我们居住的地区的犯罪率

We all know the crime rate in our neighborhood,

because we live there, and we get a feeling about it

因为我们住在那，并且我们能够感受的到

that basically matches reality.

这种感觉与现实基本相符

”安全剧场“会在失灵的时候

Security theater is exposed

when it's obvious that it's not working properly.

很明显的暴露出来

好，接下来，什么让人们不去注意安全呢？

OK. So what makes people not notice?

Well, a poor understanding.

这里有个简单的理解

If you don't understand the risks, you don't understand the costs,

如果你不理解风险，你就不理解成本

you're likely to get the trade-off wrong,

你就会做出错误的权衡取舍

and your feeling doesn't match reality.

并且你的感觉与现实不符

Not enough examples.

没多少例子

There's an inherent problem with low-probability events.

在小概率事件里

存在一个固有的问题

If, for example, terrorism almost never happens,

举个例子

如果恐怖行动从来没发生过

it's really hard to judge the efficacy of counter-terrorist measures.

那么就很难对反恐措施的效果

进行衡量

This is why you keep sacrificing virgins,

这是为什么人们牺牲处女

和对童话的抵触会如此成功的原因

and why your unicorn defenses are working just great.

There aren't enough examples of failures.

鲜有失败的例子

同时，对于事情的感觉

Also, feelings that cloud the issues --

the cognitive biases I talked about earlier: fears, folk beliefs --

-- 之前说的认知偏见

恐惧和盲目相信熟悉的人 --

basically, an inadequate model of reality.

基本上一个对现实的不完整模型

让我深入一点

So let me complicate things.

I have feeling and reality.

我现在有感觉和现实

I want to add a third element. I want to add "model."

我想加入第三个元素，一个模型

Feeling and model are in our head,

感觉和模型存在于脑海里

现实存在于外部世界

reality is the outside world; it doesn't change, it's real.

它是不会变的，它是真实的

Feeling is based on our intuition,

所以感觉是建立在直觉上的

模型是建立在理智上的

model is based on reason.

那是关键的不同之处

That's basically the difference.

In a primitive and simple world,

在一个原始又简单的世界里

there's really no reason for a model,

没有建立模型的必要

因为感觉和现实很接近

because feeling is close to reality.

You don't need a model.

你不需要

But in a modern and complex world,

但是在现在这个复杂的世界里

你需要模型

you need models to understand a lot of the risks we face.

去理解面对的很多风险

There's no feeling about germs.

比如说，没有什么感觉是关于细菌的

你需要一个模型去了解它们

You need a model to understand them.

所以这个模型

This model is an intelligent representation of reality.

是在理智层面上的现实

It's, of course, limited by science, by technology.

它当然被科学和技术

所限制着

我们没法在发明显微镜观察细菌前

We couldn't have a germ theory of disease

before we invented the microscope to see them.

拥有一套关于细菌和疾病的理论

It's limited by our cognitive biases.

它同时也被我们的认知偏见所限制

但模型有能力

But it has the ability to override our feelings.

凌驾于我们的感觉

Where do we get these models? We get them from others.

我们从哪里得到这些模型的呢？从其他人那里

We get them from religion, from culture, teachers, elders.

从宗教、文化

老师、长辈那里得到

很多年前

A couple years ago, I was in South Africa on safari.

我在南非狩猎

The tracker I was with grew up in Kruger National Park.

跟我一起的那个追踪者是在克鲁格国家公园长大的

He had some very complex models of how to survive.

他有一些如何生存的复杂模型

And it depended on if you were attacked by a lion, leopard, rhino, or elephant --

分别针对被狮子、猎豹、

犀牛还是大象所攻击的情况

and when you had to run away, when you couldn't run away,

和什么时候应该逃跑，什么时候应该爬树

when you had to climb a tree, when you could never climb a tree.

和什么时候千万别上树

我可能会在一天内就死在那里

I would have died in a day.

但他生在那里

But he was born there, and he understood how to survive.

他知道生存的方法

我生在纽约

I was born in New York City.

我可以把他带到纽约，估计他也会在一天内就没命了

I could have taken him to New York, and he would have died in a day.

（笑）

(Laughter)

Because we had different models based on our different experiences.

原因在我们有建立在我们各自经验上的

不同的模型

Models can come from the media,

模型来自媒体

from our elected officials ...

来自我们选出的政府

Think of models of terrorism,

想一下恐怖袭击的模型

child kidnapping,

绑架儿童的模型

airline safety, car safety.

飞机和汽车的安全模型

Models can come from industry.

模型可以来自某个工业领域

The two I'm following are surveillance cameras,

我关注的两个是监视器

和身份证

ID cards,

很多计算机安全模型都来自它们

quite a lot of our computer security models come from there.

还有些模型来自科学

A lot of models come from science.

Health models are a great example.

以健康模型为例

Think of cancer, bird flu, swine flu, SARS.

想想癌症、禽流感、猪流感、非典

All of our feelings of security about those diseases

我们所有关于

这些疾病的感觉

come from models given to us, really, by science filtered through the media.

都来自于

媒体从科学里过滤出来之后灌输给我们的

所以模型是可变的

So models can change.

Models are not static.

模型不是静态的

As we become more comfortable in our environments,

随着我们越来越适应环境

our model can move closer to our feelings.

模型会越来越接近现实

So an example might be,

举个例子

如果你回到一百年前

if you go back 100 years ago,

when electricity was first becoming common,

那时电刚刚普及

仍然有很多人害怕它

there were a lot of fears about it.

有些人害怕按门铃

There were people who were afraid to push doorbells,

因为那有电，所以很危险

because there was electricity in there, and that was dangerous.

对于我们来说，我们跟电相处地很融洽

For us, we're very facile around electricity.

我们不用怎么想

We change light bulbs without even thinking about it.

就可以换灯泡

Our model of security around electricity is something we were born into.

我们拥有的关于电和安全的模型

是天生的

It hasn't changed as we were growing up.

它没有随着我们的成长而变化

And we're good at it.

并且我们很适应

Or think of the risks on the Internet across generations --

再想想在不同年龄层的人

关于互联网风险的认识 --

how your parents approach Internet security,

你的父母是怎么看待互联网安全的

你是怎么看待的

versus how you do,

versus how our kids will.

你的孩子们会怎么看待

Models eventually fade into the background.

模型最终会消失在无意识里

"Intuitive" is just another word for familiar.

直觉来自于熟悉

So as your model is close to reality and it converges with feelings,

所以随着你的模型越来越接近现实

它将同感觉合二为一

you often don't even know it's there.

你将感觉不到它的存在

以去年的猪流感为例

A nice example of this came from last year and swine flu.

以去年的猪流感为例

当猪流感第一次出现时

When swine flu first appeared,

一开始的新闻造成了过度的反应

the initial news caused a lot of overreaction.

Now, it had a name,

现在它有了个名字

which made it scarier than the regular flu,

使之变得比平常的流感更加可怕

even though it was more deadly.

即使它没那么致命

And people thought doctors should be able to deal with it.

另外，人们觉得医生应该能够解决掉它

So there was that feeling of lack of control.

所以产生了一种失去控制的感觉

以上两种原因

And those two things made the risk more than it was.

使风险变得比实际更严重

As the novelty wore off and the months went by,

几个月过去了，随着新鲜感的消退

there was some amount of tolerance; people got used to it.

人们接受了

并且习惯了猪流感的事情

There was no new data, but there was less fear.

没有新的数据，但恐惧减少了

By autumn,

秋天的时候

people thought the doctors should have solved this already.

人们想

医生应该已经解决问题了

And there's kind of a bifurcation:

一个选择出现了 --

people had to choose between fear and acceptance --

人们必须从

恐惧接受中选择 --

实际上是恐惧和漠视 --

actually, fear and indifference --

他们选择了怀疑

and they kind of chose suspicion.

当疫苗在冬天出现的时候

And when the vaccine appeared last winter,

很多人 -- 非常大的数量 --

there were a lot of people -- a surprising number --

who refused to get it.

拒绝接种

And it's a nice example of how people's feelings of security change,

这可以作为

人们的安全感和模型是如何

how their model changes,

剧烈地

sort of wildly,

with no new information, with no new input.

在没有新信息

的情况下改变的

这种情况经常发生

This kind of thing happens a lot.

现在我再把概念深入一点

I'm going to give one more complication.

We have feeling, model, reality.

我们有感觉、模型和现实

I have a very relativistic view of security.

我认为安全其实还是相对的

它取决于观察者

I think it depends on the observer.

And most security decisions have a variety of people involved.

大多数关于安全的决策

是由各种人群所参与决定的

And stakeholders with specific trade-offs will try to influence the decision.

有小算盘的利益相关者

有小算盘的利益相关者

会试着影响决策的进行

And I call that their agenda.

我称其为他们的议程

你可以瞧见这个议程 --

And you see agenda -- this is marketing, this is politics --

不管是市场还是政治 --

trying to convince you to have one model versus another,

它尝试着说服你只拥有其中一种模型

trying to convince you to ignore a model

说服你去忽视模型

and trust your feelings,

而相信感觉

marginalizing people with models you don't like.

边缘化那些拥有跟你的模型的不同的人们

This is not uncommon.

这很常见

An example, a great example, is the risk of smoking.

这里有个例子，很好的例子，关于吸烟的危害

在过去50年里，吸烟的危害

In the history of the past 50 years,

the smoking risk shows how a model changes,

展示了一个模型是怎么变化的

and it also shows how an industry fights against a model it doesn't like.

同时也展示了一个工业是怎么对付

一个它不喜欢的模型

Compare that to the secondhand smoke debate --

你可以把它跟20年后

关于二手烟的争论相比较

probably about 20 years behind.

Think about seat belts.

再想想安全带

When I was a kid, no one wore a seat belt.

当我还小的时候，没人系安全带

Nowadays, no kid will let you drive if you're not wearing a seat belt.

现在呢，如果你不系安全带

没有哪个孩子会让你开车

Compare that to the airbag debate,

你可以把它跟30年后

关于安全气囊的争论相比较

probably about 30 years behind.

这几个例子里的模型都变了

All examples of models changing.

What we learn is that changing models is hard.

由此我们可以的出结论，模型是很难被改变的

模型是很难被移除的

Models are hard to dislodge.

如果模型跟你的感觉相符

If they equal your feelings,

你甚至不知道你有个模型

you don't even know you have a model.

再说另一个认知偏见

And there's another cognitive bias

证实性偏见

I'll call confirmation bias,

意思是我们倾向于接受

where we tend to accept data that confirms our beliefs

那些能够支持我们观点的数据

and reject data that contradicts our beliefs.

而拒绝那些反对的

So evidence against our model, we're likely to ignore,

所以对于那些与我们的模型相反的证据

我们会忽略掉，即使它们很有说服力

even if it's compelling.

It has to get very compelling before we'll pay attention.

那些证据必须非常非常令人信服，我们才会去关注

New models that extend long periods of time are hard.

一个时间跨度长的新模型难以让人接受

比如像全球变暖

Global warming is a great example.

我们很难接受一个

We're terrible at models that span 80 years.

超过80年的的模型

We can do "to the next harvest."

我们可以接受一年的

We can often do "until our kids grow up."

我们也可以接受让一个小孩长大那么长的时间

But "80 years," we're just not good at.

但80年还是太难了

So it's a very hard model to accept.

所以那是个非常难以让人接受的模型

We can have both models in our head simultaneously --

我们可以同时拥有对同一件事情的

that kind of problem where we're holding both beliefs together,

两个模型

此时，我们拥有同时两种信念

这种情况也叫认知不协调

the cognitive dissonance.

最后

Eventually, the new model will replace the old model.

新模型代替了旧模型

Strong feelings can create a model.

强烈的感觉可以产生一个模型

September 11 created a security model in a lot of people's heads.

911在很多人脑里

产生了一个安全模型

Also, personal experiences with crime can do it,

同时，个人的犯罪经历和

一次健康危机 --

personal health scare,

a health scare in the news.

就是那种在新闻里可以看到的那种 -- 也可以产生模型

那些经历在心理学里叫做

You'll see these called "flashbulb events" by psychiatrists.

闪光灯事件

它们能迅速地产生一个模型

They can create a model instantaneously,

because they're very emotive.

因为引起了强烈的个人感情

So in the technological world,

所以在一个技术世界里

we don't have experience to judge models.

我们没有可以判断模型

的经历

And we rely on others. We rely on proxies.

我们依赖其他人，我们依赖于代理人

这样是可以的，只要它能够纠正错误就行

And this works, as long as it's the correct others.

We rely on government agencies

我们依赖政府

to tell us what pharmaceuticals are safe.

来告诉我们哪些药品是安全的

I flew here yesterday.

我是昨天坐飞机来的

I didn't check the airplane.

我没检查飞机是否安全

I relied on some other group

我依赖其他人

去决定我坐的飞机是否安全

to determine whether my plane was safe to fly.

We're here, none of us fear the roof is going to collapse on us,

我们坐在这里，没人担心屋顶会塌

不是因为我们亲自检查过

not because we checked,

but because we're pretty sure the building codes here are good.

而是我们非常确定

这建筑符合规范

It's a model we just accept

这是一种模型我们只是

因为信念而接受

pretty much by faith.

这也没错

And that's OK.

Now, what we want is people to get familiar enough with better models,

现在，我们希望的是

人们能够认识一些

更好的模型 --

have it reflected in their feelings,

在感觉里显现出来 --

以帮助他们做出更好的权衡取舍

to allow them to make security trade-offs.

当感觉和模型分开的时候

When these go out of whack, you have two options.

你有两个选择

One, you can fix people's feelings, directly appeal to feelings.

第一，改变人们的感觉

直接诉诸于感觉

这是一种操纵，但有效果

It's manipulation, but it can work.

第二，更诚实一点的做法

The second, more honest way

就是改变模型

is to actually fix the model.

Change happens slowly.

改变是很缓慢的

The smoking debate took 40 years -- and that was an easy one.

吸烟的争论持续了40年

而那还是比较简单的一个

有一些是非常困难的

Some of this stuff is hard.

是真的很困难

Really, though, information seems like our best hope.

看起来信息是我们最好的希望

事实上我之前撒了个谎

And I lied.

Remember I said feeling, model, reality; reality doesn't change?

我之前提到感觉、模型和现实

我说现实不会改变。事实上它会。

It actually does.

我们生活在一个技术的世界里

We live in a technological world;

reality changes all the time.

现实每时每刻都在改变

So we might have, for the first time in our species:

所以，可能是我们这个物种里的第一次

feeling chases model, model chases reality, reality's moving --

感觉追赶着模型，模型追赶着现实，而现实则在不断改变

它们可能永远也追不上

they might never catch up.

We don't know.

这点谁知道呢

但是就长期来看

But in the long term,

感觉和现实是很重要的

both feeling and reality are important.

And I want to close with two quick stories to illustrate this.

结束前我想以两个小故事来说明这点

1982 -- I don't know if people will remember this --

1982年 -- 我不知道人们还记不记得 --

那时在美国发生了一次

there was a short epidemic of Tylenol poisonings

时间不长但传播范围广的泰诺中毒事件

in the United States.

It's a horrific story.

很可怕。有人拿了一瓶泰诺胶囊，

Someone took a bottle of Tylenol,

放毒进去，关上盖子，然后又放回货架

put poison in it, closed it up, put it back on the shelf,

七个人买回去吃了然后中毒而死

someone else bought it and died.

This terrified people.

人们很害怕

There were a couple of copycat attacks.

当时还有些模仿此投毒的行为

There wasn't any real risk, but people were scared.

幸好后者没什么真正的危险，但人们被吓到了

And this is how the tamper-proof drug industry was invented.

这是防盗瓶盖产业

得以发展起来的原因

Those tamper-proof caps? That came from this.

那些防盗瓶盖就是这么来的

It's complete security theater.

它就是所谓的安全剧场

As a homework assignment, think of 10 ways to get around it.

你们可以想想10种破解防盗瓶盖的方法

我先说一个，用注射器

I'll give you one: a syringe.

But it made people feel better.

即使没那么安全，但至少人们感觉更安全了

It made their feeling of security more match the reality.

它让人们对安全的感觉

跟现实更为符合

最后一个故事。几年前，我一个朋友要生了

Last story: a few years ago, a friend of mine gave birth.

我去医院看她

I visit her in the hospital.

It turns out, when a baby's born now,

发现当一个婴儿出生后

they put an RFID bracelet on the baby, a corresponding one on the mother,

他们会给婴儿戴上一个带RFID的手镯

然后给母亲也配一个对应的

so if anyone other than the mother takes the baby out of the maternity ward,

这样，当一个不是母亲的人想把婴儿从产房带走

警报就会响

an alarm goes off.

我说：“这措施不错。

I said, "Well, that's kind of neat.

I wonder how rampant baby snatching is out of hospitals."

我想知道在医院

偷盗婴儿的行为有多猖獗。”

I go home, I look it up.

回到家，我查了一下。

It basically never happens.

基本上从来没发生过

(Laughter)

但如果你仔细想想

But if you think about it, if you are a hospital,

如果你是医生

and you need to take a baby away from its mother,

你需要给婴儿从母亲身边带走

out of the room to run some tests,

带出房间做点测试

you better have some good security theater,

你最好有安全剧院

or she's going to rip your arm off.

不然的话那位母亲会把你的胳膊都拽下来

(Laughter)

（笑）

所以，安全剧院这个概念对于

So it's important for us,

those of us who design security,

那些做安全设计的，

那些以实际效果来看待

who look at security policy --

or even look at public policy in ways that affect security.

安全政策或公共政策的人来说

是非常重要的

它不只是现实，它是感觉和现实

It's not just reality; it's feeling and reality.

重要的是

What's important

它们几乎是一样的

is that they be about the same.

It's important that, if our feelings match reality,

如果我们的感觉和现实相符

我们就能够做出更好的关于安全的权衡取舍

we make better security trade-offs.

谢谢

Thank you.

(Applause)

（鼓掌）