An Interview with Bruce Schneier, Renowned Security Technologist

The NSA's phone program cost $100 million over four years and only twice generated unique information for the FBI. What's your takeaway? Does that say more about the program's inefficiency or about how much data the NSA already collects?

Collecting data is easy; analyzing it is hard. Gathering actionable intelligence from mass surveillance data is often described as finding a needle in a haystack. The obvious extension of that metaphor is that piling more hay onto the pile doesn't help. What we know is that conventional investigative techniques—following the leads—is very effective. This means that targeted surveillance can be very effective. Mass surveillance, not so much. It's good at social control, which is why totalitarian governments like it so much. But despite the US government's insistence that it's essential for national security, it turns out that when you examine the actual evidence, it is not.

What kind of constraints are there on academics publishing cryptography papers? Does the NSA restrict academic freedom at all?

No, they do not. That's a very 1970s way of limiting the spread of cryptographic expertise around the globe. It worked for a while, until the establishment of cryptography as an academic discipline in the 1980s. Around then, the NSA switched to export controls as a way to regulate the use of strong cryptography worldwide. That collapsed with the rise of the Internet and electronic commerce....