(Get the joke? It lets someone remotely override us users! Not a good idea according to Bruce Schneier.)
This is a horrifyingly bad idea. First of all, it breaks my first rule of trust – that trust isn’t transitive.
In this case I would be required to trust an entirely open-ended and ill-defined set of people: people who are “able to activate my kill-switch-bracelet”.
That just doesn’t work – there’s no way for me to intelligently extend my trust in something so specific as a human kill switch to something so vague. I must trust the holder of the switch, the manufacturer, the people who safeguard the root keys for the underlying security system, the people who designed the security, the monkeys who can actually flip the switch… more people than I have to trust when I get on a plane now, actually.
I have to trust them to be trustworthy in things that they are either demonstrably not trustworthy in, or have no experience in being trustworthy in (and no experience should mean no trust). Human kill switches require that trust be freely transitive, and that is bad.
They also break my second rule of trust – that real trust is reciprocal.
Perhaps in a perfect world we wouldn’t need to trust anyone (kind of boring and unfulfilling though). But in our real world, where we routinely need and in fact want to trust others, we would like that they have as much skin in the game as we do. This is reciprocity.
What this bracelet would do is destroy reciprocity, and in so doing could increase the chances that the plane will be successfully hijacked.
When a hijacker stands up they are stepping outside the reciprocal trust relationship by seizing power. Up until they stood up and started yelling, we assumed that they had as much skin in the staying-alive game as we did. Passengers striking back are seeking to make things reciprocal again.
Imagine the following scenario: You are on a plane and someone jumps up and starts waving a gun around the plane. She says “this is a hijacking!”. My guess is that she has about 10 seconds to live or at least be conscious and in charge of her person. That’s how long it would take even just a few passengers to overwhelm her, some possibly being wounded or dying in the process, but hey, you’re going to die anyway.
Okay, so add in the bracelets: Out comes the gun, “this is a hijacking!”, a monkey flips the switch and everyone BUT THE HIJACKER goes down like a bag of sand. The hijacker doesn’t go down for the same reason that she has a gun – there will be ways around the security system. Otherwise she wouldn’t have a gun, would she?
What about a bomb instead of a gun? Well, without the bracelet there’s a small fighting chance that she’s going to get her ass kicked and some brave souls will save the day. With bracelets, those brave souls will be twitching about in puddles of their own drool when the plane goes boom.
What about a knife instead of a bomb? Well, without the bracelet there’s actually a pretty good chance that she’s going to get her ass kicked and some brave souls will save the day. With bracelets, those brave souls will, again, be twitching about in puddles of their own drool. Now she only needs to knife the monkey who flipped the switch and she has the entire passenger compartment to herself.
What about NO WEAPON AT ALL? Without the bracelet we have, kind of, the bomb scenario. Provided just one person decides to go for it, nothing bad happens. There’s no bomb to go off, no stabbing, no shooting, just a good fight which turns into a pile-on. With the bracelets, well, she stands up, rips open her coat to show off her duct-tape bomb-vest cleverly labeled “BOMB!”, the monkey flips the switch, and… you get the picture. Hijacking a plane becomes possible through a few hours of acting lessons and some duct tape, because there’s no way for the passengers on the plane to re-assert reciprocity.
What if all the hijacker does is gain access to the switch?
One of the reasons I take my personal positions on liberty, self-sufficiency and personal ownership of guns is that I want to increase the potential that any trust relationship I must rely upon can at least potentially be reciprocal. Note that I don’t say it guarantees reciprocity, because clearly it doesn’t. But personal gun ownership does push the responsibility for the reciprocity of trust as far into the hands of everyone as it can reasonably be pushed. It also requires a great deal of responsibility.*
You could try to argue that giving everyone a bracelet provides the same protection as giving everyone a gun, but it’s not the same at all. If you are threatening to flip my kill switch and the kill switch for everyone around me, what can I do? If I have a gun, I could try to shoot you. Not a good chance, but hey, otherwise, I’m completely screwed. If all I have is nothing then I run at you, you flip the switch, down I go.
In 9/11, it was the passengers who reduced the overall damage to just the plane and its occupants. Human kill switches eliminate that ability.
This reminds me a time during the DVD CSS development days that I JOKINGLY suggested to someone (who ought to have known better) that eye-shutters and neural shunts would mitigate the analog hole. He thought I was serious and that it was a good idea. I never made a joke about that again.
In a good system, trust is reciprocal. In bad systems it isn’t.
*It could easily be argued that the writers of US constitution viewed trust reciprocity as a fundamental building block for democracy. You trust us with government, we trust you with a set of freedoms, all of which are ultimately safeguarded first by the rule of law and second by the rule of the gun. In other words, the writers of the US constitution thought that explicitly allowing people guns would increase the reciprocity of the trust relationship between citizens and their rulers, thus increasing the chances that just the rule of law would maintain reciprocity.