So I read the entire debate and while I generally agree Schneier on this topic one of Mr Hawley's arguments gave me a few second thoughts about the efficacy of

So I read the entire debate and while I generally agree Schneier on this topic one of Mr Hawley's arguments gave me a few second thoughts about the efficacy of reactive security. Bruce's argument is like this: There are two kinds attackers, amateurs and pros. Amateurs are easily caught because they don't have the time or knowledge to properly plan an attack and the pros have the resources to work around any defenses the TSA has set up because the TSA cannot be proactive enough in its measures. Bruce argues that post-9/11 security measures are both superfluous and insufficient at the same time. However, what if the amateurs and pros could work together? What if the pros developed attacks and published the directions? Amateurs could use those directions to their hearts content. In that sense, reactive security may not prevent al Qaeda from attempting new clever attacks, but it will prevent copycat attacks an the part of sympathizers (or folks with their own agendas) who have no overt connections to major terrorist networks. Organized criminal hacker organizations have been known to pull this very same stunt by releasing easy to use programs which make it possible for dilettantes to pull off attacks that they would otherwise be unable to do. In fact, it's a little bit like computer security, where, every time a vulnerability is discovered, either by a security researcher, or through a successful zero-day exploit, a patch is developed to plug the hole and thousands of sysadmins apply the patch as soon as possible. In this way, we can't prove that say, Apache, has no vulnerabilities, but we can be sure that it has no known vulnerabilities and all the easy ones to find have been dealt with long ago. So it seems to me, that by routinely 'plugging holes' so to speak by implementing reactive measures, the TSA is increasing the marginal cost of each attack for al Qaeda significantly, and this hypothetically, does increase security. Of course, that doesn't detract from any of the other arguments against the TSA in it current incarnation, especially the obvious haphazardness of its measures, the occasional abusiveness of screeners, and its political essence. It does though, seem to make one of Bruce's arguments seem less strong.