Bruce Schneier (; born January 15, 1963) is an American cryptographer,

computer security Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, t ...

professional,

privacy Privacy (, ) is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively. The domain of privacy partially overlaps with security, which can include the concepts of ...

specialist, and writer. Schneier is a Lecturer in Public Policy at the

Harvard Kennedy School The Harvard Kennedy School (HKS), officially the John F. Kennedy School of Government, is the school of public policy and government of Harvard University in Cambridge, Massachusetts. The school offers master's degrees in public policy, publi ...

and a Fellow at the

Berkman Klein Center for Internet & Society The Berkman Klein Center for Internet & Society is a research center at Harvard University that focuses on the study of cyberspace. Founded at Harvard Law School, the center traditionally focused on internet-related legal issues. On May 15, 2008, ...

as of November, 2013. He is a board member of the

Electronic Frontier Foundation The Electronic Frontier Foundation (EFF) is an international non-profit digital rights group based in San Francisco, California. The foundation was formed on 10 July 1990 by John Gilmore, John Perry Barlow and Mitch Kapor to promote Internet ...

Access Now Access Now is a non-profit organization founded in 2009 with a mission to defend and extend the digital civil rights of people around the world. Access Now supports programs including an annual conference on Human Rights (RightsCon), an index ...

, and

The Tor Project The Tor Project, Inc. is a Seattle-based 501(c)(3) research-education nonprofit organization founded by computer scientists Roger Dingledine, Nick Mathewson and five others. The Tor Project is primarily responsible for maintaining software f ...

; and an advisory board member of

Electronic Privacy Information Center Electronic Privacy Information Center (EPIC) is an independent nonprofit research center in Washington, D.C. EPIC's mission is to focus public attention on emerging privacy and related human rights issues. EPIC works to protect privacy, freed ...

and VerifiedVoting.org. He is the author of several books on general

security" \n\n\nsecurity.txt is a proposed standard for websites' security information that is meant to allow security researchers to easily report security vulnerabilities. The standard prescribes a text file called \"security.txt\" in the well known locat ...

topics, computer security and

cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or '' -logia'', "study", respectively), is the practice and study of techniques for secure communication in the presence of adv ...

and is a

squid True squid are molluscs with an elongated soft body, large eyes, eight arms, and two tentacles in the superorder Decapodiformes, though many other molluscs within the broader Neocoleoidea are also called squid despite not strictly fittin ...

enthusiast. In 2015, Schneier received the EPIC Lifetime Achievement Award from Electronic Privacy Information Center.

Early life

Bruce Schneier is the son of Martin Schneier, a Brooklyn Supreme Court judge. He grew up in the Flatbush neighborhood of

Brooklyn Brooklyn () is a borough of New York City, coextensive with Kings County, in the U.S. state of New York. Kings County is the most populous county in the State of New York, and the second-most densely populated county in the United States, be ...

New York New York most commonly refers to: * New York City, the most populous city in the United States, located in the state of New York * New York (state), a state in the northeastern United States New York may also refer to: Film and television * '' ...

, attending P.S. 139 and

Hunter College High School Hunter College High School is a secondary school located in the Carnegie Hill neighborhood on the Upper East Side of Manhattan. It is administered by Hunter College of the City University of New York (CUNY). Hunter is publicly funded, and there ...

. After receiving a physics bachelor's degree from the

University of Rochester The University of Rochester (U of R, UR, or U of Rochester) is a private research university in Rochester, New York. The university grants undergraduate and graduate degrees, including doctoral and professional degrees. The University of ...

in 1984, he went to

American University The American University (AU or American) is a private federally chartered research university in Washington, D.C. Its main campus spans 90 acres (36 ha) on Ward Circle, mostly in the Spring Valley neighborhood of Northwest D.C. AU was cha ...

in Washington, D.C. and got his master's degree in computer science in 1988. He was awarded an honorary Ph.D from the

University of Westminster The University of Westminster is a public university based in London, United Kingdom. Founded in 1838 as the Royal Polytechnic Institution, it was the first polytechnic to open in London. The Polytechnic formally received a Royal charter in Aug ...

London, England London is the capital and largest city of England and the United Kingdom, with a population of just under 9 million. It stands on the River Thames in south-east England at the head of a estuary down to the North Sea, and has been a major se ...

in November 2011. The award was made by the Department of Electronics and Computer Science in recognition of Schneier's 'hard work and contribution to industry and public life'. Schneier was a founder and chief technology officer of Counterpane Internet Security (now BT Managed Security Solutions). He worked for IBM once they acquired Resilient Systems where Schneier was CTO until he left at the end of June 2019.

Writings on computer security and general security

In 1991, Schneier was laid off from his job and started writing for computer magazines. Later he decided to write a book on applied cryptography "since no such book existed". He took his articles, wrote a proposal to John Wiley and they bought the proposal. In 1994, Schneier published ''Applied Cryptography'', which details the design, use, and implementation of cryptographic algorithms. "This book allowed me to write more, to start consulting, to start my companies, and really launched me as an expert in this field, and it really was because no one else has written this book. I wanted to read it so I had to write it. And it happened in a really lucky time when everything started to explode on the Internet". In 2010 he published ''Cryptography Engineering'', which is focused more on how to use cryptography in real systems and less on its internal design. He has also written books on security for a broader audience. In 2000, Schneier published ''Secrets and Lies: Digital Security in a Networked World''; in 2003, '' Beyond Fear: Thinking Sensibly About Security in an Uncertain World''; in 2012, '' Liars and Outliers: Enabling the Trust that Society Needs to Thrive''; and in 2015, ''Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World''. Schneier writes a freely available monthly Internet newsletter on computer and other security issues, ''Crypto-Gram'', as well as a security weblog, ''Schneier on Security''. The blog focuses on the latest threats, and his own thoughts. The weblog started out as a way to publish essays before they appeared in Crypto-Gram, making it possible for others to comment on them while the stories were still current, but over time the newsletter became a monthly email version of the blog, re-edited and re-organized. Schneier is frequently quoted in the press on computer and other security issues, pointing out flaws in security and cryptographic implementations ranging from

biometrics Biometrics are body measurements and calculations related to human characteristics. Biometric authentication (or realistic authentication) is used in computer science as a form of identification and access control. It is also used to identify i ...

to airline security after the

September 11 attacks The September 11 attacks, commonly known as 9/11, were four coordinated suicide terrorist attacks carried out by al-Qaeda against the United States on Tuesday, September 11, 2001. That morning, nineteen terrorists hijacked four commer ...

. Schneier revealed on his blog that in the December 2004 issue of the SIGCSE Bulletin, three

Pakistan Pakistan ( ur, ), officially the Islamic Republic of Pakistan ( ur, , label=none), is a country in South Asia. It is the world's List of countries and dependencies by population, fifth-most populous country, with a population of almost 24 ...

i academics, Khawaja Amer Hayat, Umar Waqar Anis, and S. Tauseef-ur-Rehman, from the International Islamic University in

Islamabad Islamabad (; ur, , ) is the capital city of Pakistan. It is the country's ninth-most populous city, with a population of over 1.2 million people, and is federally administered by the Pakistani government as part of the Islamabad Capital ...

, plagiarized an article written by Schneier and got it published. The same academics subsequently plagiarized another article by Ville Hallivuori on "Real-time Transport Protocol (RTP) security" as well. Schneier complained to the editors of the periodical, which generated a minor controversy. The editor of the SIGCSE Bulletin removed the paper from their website and demanded official letters of admission and apology. Schneier noted on his blog that International Islamic University personnel had requested him "to close comments in this blog entry"; Schneier refused to close comments on the blog, but he did delete posts which he deemed "incoherent or hostile".

Viewpoints

Blockchain

Schneier warns about misplaced trust in

blockchain A blockchain is a type of distributed ledger technology (DLT) that consists of growing lists of records, called ''blocks'', that are securely linked together using cryptography. Each block contains a cryptographic hash of the previous block, ...

and the lack of use cases, calling blockchain a solution in search of a problem. "What blockchain does is shift some of the trust in people and institutions to trust in technology. You need to trust the cryptography, the protocols, the software, the computers and the network. And you need to trust them absolutely, because they’re often single points of failure." "I’ve never seen a legitimate use case for blockchain. I’ve never seen any system where blockchain provides security in a way that is impossible to provide in any other way." He goes on to say that

cryptocurrencies A cryptocurrency, crypto-currency, or crypto is a digital currency designed to work as a medium of exchange through a computer network that is not reliant on any central authority, such as a government or bank, to uphold or maintain it. It ...

are useless and are only used by speculators looking for quick riches.

Cryptography

To Schneier, peer review and expert analysis are important for the security of cryptographic systems. Mathematical cryptography is usually not the weakest link in a security chain; effective security requires that cryptography be combined with other things. The term ''Schneier's law'' was coined by

Cory Doctorow Cory Efram Doctorow (; born July 17, 1971) is a Canadian-British blogger, journalist, and science fiction author who served as co-editor of the blog '' Boing Boing''. He is an activist in favour of liberalising copyright laws and a proponent of ...

in a 2004 speech. The law is phrased as: He attributes this to Bruce Schneier, who wrote in 1998: "Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break. It's not even hard. What is hard is creating an algorithm that no one else can break, even after years of analysis." Similar sentiments had been expressed by others before. In '' The Codebreakers'', David Kahn states: "Few false ideas have more firmly gripped the minds of so many intelligent men than the one that, if they just tried, they could invent a cipher that no one could break", and in "A Few Words On Secret Writing", in July 1841,

Edgar Allan Poe Edgar Allan Poe (; Edgar Poe; January 19, 1809 – October 7, 1849) was an American writer, poet, editor, and literary critic. Poe is best known for his poetry and short stories, particularly his tales of mystery and the macabre. He is wid ...

had stated: "Few persons can be made to believe that it is not quite an easy thing to invent a method of secret writing which shall baffle investigation. Yet it may be roundly asserted that human ingenuity cannot concoct a cipher which human ingenuity cannot resolve." Schneier also coined the term "kid sister cryptography", writing in the Preface to ''Applied Cryptography'' that:

Digital rights management

Schneier is critical of

digital rights management Digital rights management (DRM) is the management of legal access to digital content. Various tools or technological protection measures (TPM) such as access control technologies can restrict the use of proprietary hardware and copyrighted work ...

(DRM) and has said that it allows a vendor to increase lock-in. Proper implementation of control-based security for the user via

trusted computing Trusted Computing (TC) is a technology developed and promoted by the Trusted Computing Group. The term is taken from the field of trusted systems and has a specialized meaning that is distinct from the field of Confidential Computing. The core i ...

is very difficult, and security is not the same thing as control. Schneier insists that "owning your data is a different way of thinking about data."

Full disclosure

Schneier is a proponent of full disclosure, i.e. making security issues public.

Homeland security

Schneier has said that

homeland security Homeland security is an American national security term for "the national effort to ensure a homeland that is safe, secure, and resilient against terrorism and other hazards where American interests, aspirations, and ways of life can thrive" t ...

money should be spent on

intelligence Intelligence has been defined in many ways: the capacity for abstraction, logic, understanding, self-awareness, learning, emotional knowledge, reasoning, planning, creativity, critical thinking, and problem-solving. More generally, it can ...

, investigation, and emergency response. Defending against the broad threat of terrorism is generally better than focusing on specific potential terrorist plots. According to Schneier, analysis of intelligence data is difficult but is one of the better ways to deal with global terrorism. Human intelligence has advantages over automated and computerized analysis, and increasing the amount of intelligence data that is gathered does not help to improve the analysis process. Agencies that were designed around fighting the

Cold War The Cold War is a term commonly used to refer to a period of geopolitical tension between the United States and the Soviet Union and their respective allies, the Western Bloc and the Eastern Bloc. The term '' cold war'' is used because t ...

may have a culture that inhibits the sharing of information; the practice of sharing information is more important and less of a security threat in itself when dealing with more decentralized and poorly funded adversaries such as al Qaeda. Regarding PETN—the explosive that has become terrorists' weapon of choice—Schneier has written that only swabs and dogs can detect it. He also believes that changes to airport security since 11 September 2001 have done more harm than good and he defeated Kip Hawley, former head of the Transportation Security Administration, in an ''

Economist An economist is a professional and practitioner in the social sciences, social science discipline of economics. The individual may also study, develop, and apply theories and concepts from economics and write about economic policy. Within this ...

'' online debate by 87% to 13% regarding the issue. He is widely credited with coining the term " security theater" to describe some such changes. As a

Fellow A fellow is a concept whose exact meaning depends on context. In learned or professional societies, it refers to a privileged member who is specially elected in recognition of their work and achievements. Within the context of higher education ...

of Berkman Center for Internet & Society at

Harvard University Harvard University is a private Ivy League research university in Cambridge, Massachusetts. Founded in 1636 as Harvard College and named for its first benefactor, the Puritan clergyman John Harvard, it is the oldest institution of highe ...

, Schneier is exploring the intersection of security, technology, and people, with an emphasis on power.

Movie plot threat

"Movie-plot threat" is a term Schneier coined that refers to very specific and dramatic

terrorist Terrorism, in its broadest sense, is the use of criminal violence to provoke a state of terror or fear, mostly with the intention to achieve political or religious aims. The term is used in this regard primarily to refer to intentional violen ...

attack scenarios, reminiscent of the behavior of terrorists in movies, rather than what terrorists actually do in the real world. Security measures created to protect against movie plot threats do not provide a higher level of real security, because such preparation only pays off if terrorists choose that one particular avenue of attack, which may not even be feasible. Real-world terrorists would also be likely to notice the highly specific security measures, and simply attack in some other way. The specificity of movie plot threats gives them power in the public imagination, however, so even extremely unrealistic security theater countermeasures may receive strong support from the public and legislators. Among many other examples of movie plot threats, Schneier described banning baby carriers from

subway Subway, Subways, The Subway, or The Subways may refer to: Transportation * Subway, a term for underground rapid transit rail systems * Subway (underpass), a type of walkway that passes underneath an obstacle * Subway (George Bush Intercontin ...

s, for fear that they may contain explosives. Starting in April 2006, Schneier has had an annual contest to create the most fantastic movie-plot threat. In 2015, during the 8th and the last one, he mentioned that the contest may have run its course.

System design

Schneier has criticized security approaches that try to prevent any malicious incursion, instead arguing that designing systems to fail well is more important.Homeland Insecurity
, ''

Atlantic Monthly ''The Atlantic'' is an American magazine and multi-platform publisher. It features articles in the fields of politics, foreign affairs, business and the economy, culture and the arts, technology, and science. It was founded in 1857 in Boston, ...

'', September 2002 The designer of a system should not underestimate the capabilities of an attacker, as technology may make it possible in the future to do things that are not possible at the present. Under

Kerckhoffs's Principle Kerckhoffs's principle (also called Kerckhoffs's desideratum, assumption, axiom, doctrine or law) of cryptography was stated by Dutch-born cryptographer Auguste Kerckhoffs in the 19th century. The principle holds that a cryptosystem should be se ...

, the need for one or more parts of a cryptographic system to remain secret increases the fragility of the system; whether details about a system should be obscured depends upon the availability of persons who can make use of the information for beneficial uses versus the potential for attackers to misuse the information.

Cryptographic algorithms

Schneier has been involved in the creation of many cryptographic algorithms.

Hash functions A hash function is any function that can be used to map data of arbitrary size to fixed-size values. The values returned by a hash function are called ''hash values'', ''hash codes'', ''digests'', or simply ''hashes''. The values are usually ...

: *

Skein Skein may refer to: * A flock of geese or ducks in flight * A wound ball of yarn with a centre pull strand; see Hank * A metal piece fitted over the end of a wagon axle, to which the wheel is mounted * Skein (unit), a unit of length used by wea ...

Stream ciphers: *

Solitaire Solitaire is any tabletop game which one can play by oneself, usually with cards, but also with dominoes. The term "solitaire" is also used for single-player games of concentration and skill using a set layout tiles, pegs or stones. These game ...

* Phelix *

Helix A helix () is a shape like a corkscrew or spiral staircase. It is a type of smooth space curve with tangent lines at a constant angle to a fixed axis. Helices are important in biology, as the DNA molecule is formed as two intertwined helic ...

Pseudo-random number generators: *

Fortuna Fortuna ( la, Fortūna, equivalent to the Greek goddess Tyche) is the goddess of fortune and the personification of luck in Roman religion who, largely thanks to the Late Antique author Boethius, remained popular through the Middle Ages until at ...

* Yarrow algorithm

Block ciphers In cryptography, a block cipher is a deterministic algorithm operating on fixed-length groups of bits, called ''blocks''. Block ciphers are specified elementary components in the design of many cryptographic protocols and are widely used to encr ...

: * Blowfish *

Twofish In cryptography, Twofish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits. It was one of the five finalists of the Advanced Encryption Standard contest, but it was not selected for standardization. T ...

Threefish Threefish is a symmetric-key tweakable block cipher designed as part of the Skein hash function, an entry in the NIST hash function competition. Threefish uses no S-boxes or other table lookups in order to avoid cache timing attacks; The pape ...

MacGuffin In fiction, a MacGuffin (sometimes McGuffin) is an object, device, or event that is necessary to the plot and the motivation of the characters, but insignificant, unimportant, or irrelevant in itself. The term was originated by Angus MacPhail for ...

Publications

* Schneier, Bruce. ''Applied Cryptography'', John Wiley & Sons, 1994. * Schneier, Bruce. ''Protect Your Macintosh'', Peachpit Press, 1994. * Schneier, Bruce. ''E-Mail Security'', John Wiley & Sons, 1995. * Schneier, Bruce. ''Applied Cryptography'', Second Edition, John Wiley & Sons, 1996. * Schneier, Bruce; Kelsey, John; Whiting, Doug; Wagner, David; Hall, Chris; Ferguson, Niels. ''The

Encryption Algorithm'', John Wiley & Sons, 1996. * Schneier, Bruce; Banisar, David. ''The Electronic Privacy Papers'', John Wiley & Sons, 1997. * Schneier, Bruce. ''Secrets and Lies: Digital Security in a Networked World'', John Wiley & Sons, 2000. * Schneier, Bruce. '' Beyond Fear: Thinking Sensibly About Security in an Uncertain World'', Copernicus Books, 2003. * Ferguson, Niels; Schneier, Bruce. '' Practical Cryptography'', John Wiley & Sons, 2003. * Schneier, Bruce. ''Secrets and Lies: Digital Security in a Networked World'', John Wiley & Sons, 2004. * Schneier, Bruce. ''Schneier on Security'', John Wiley & Sons, 2008. * Ferguson, Niels; Schneier, Bruce; Kohno, Tadayoshi. ''Cryptography Engineering'', John Wiley & Sons, 2010. * Schneier, Bruce. '' Liars and Outliers: Enabling the Trust that Society Needs to Thrive'', John Wiley & Sons, 2012. * Schneier, Bruce. ''Carry On: Sound Advice from Schneier on Security'', John Wiley & Sons, 2013. * Schneier, Bruce. ''Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World'', W. W. Norton & Company, 2015. * Schneier, Bruce. '' Click Here to Kill Everybody: Security and Survival in a Hyper-connected World'', W. W. Norton & Company, 2018. * Schneier, Bruce. ''We Have Root: Even More Advice from Schneier on Security'', John Wiley & Sons, 2019.

Activism

Schneier is a board member of the

References

External links

Personal website, Schneier.com

"Glenn Greenwald's Encryption Guru," by Alex Carp, March 16, 2014
Talking security with Bruce Almighty

video with Schneier participating on the Cryptographer's Panel, April 21, 2009, Moscone Center, San Francisco
Bruce Schneier on Real Law Radio
Bruce talks with Bob DiCello on the legal news talk radio program, Real Law Radio, about the case involving a Philadelphia school that allegedly spied on its students via the webcam on their computers (Podcasts/Saturday February 27, 2010). *
Bruce Schneier at Google
19 June 2013. Schneier discusses various aspects of Internet computing and global geo-politics including trust, power relations, control, cooperative systems, ethics, laws, and security technologies. (55 minutes)

on

The WELL The Whole Earth 'Lectronic Link, normally shortened to The WELL, was launched in 1985. It is one of the oldest continuously operating virtual communities. By 1993 it had 7,000 members, a staff of 12, and gross annual income of $2 million. ...

by Jon Lebkowsky, August 2012 {{DEFAULTSORT:Schneier, Bruce 1963 births Living people American cryptographers American technology writers Berkman Fellows 20th-century American Jews American University alumni University of Rochester alumni People associated with computer security Modern cryptographers Cypherpunks Privacy activists American chief technology officers Hunter College High School alumni Writers about computer security Writers from New York City Writers from Minneapolis Wired (magazine) people 21st-century American Jews