The Unfalsifiability of Security Claims

There is an inherent asymmetry in computer security: things can be declared insecure by observation, but not the reverse. There is no test that allows us to declare an arbitrary system or technique secure. This implies that claims of necessary conditions for security are unfalsifiable. This in turn implies an asymmetry in self-correction: while the claim that countermeasures are sufficient can always be refuted, the claim that they are necessary cannot. Thus, we ratchet upward: there are many ways to argue countermeasures in, but no possible observation argues one out. Once we go wrong we stay wrong and errors accumulate. I show that attempts to evade this difficulty lead to dead-ends and then explore implications.

I argue that progress has been slow in security precisely because of a failure of self-correction. Bad ideas that are justified by contradiction-proof statements persist indefinitely and the resources they consume crowds out sensible measures to reduce harm. Examples abound. Many things that deliver no observed benefit are declared necessary for security, either because they have been defined to be so, or have been reached through logically muddled arguments.

Cormac’s main current interests are data analysis problems, authentication and techniques to combat fraud and abuse. He has published widely in signal and image processing, information theory, multimedia, networking and security. He is the inventor on over 70 US patents, and has shipped technologies used by hundreds of millions of users. His research has been widely covered in media outlets such as the Economist, NY Times, Washington Post, Wall St Journal, BBC, the Guardian, Wired and the Atlantic (but mostly just for writing down stuff that was incredibly obvious). He received the PhD degree from Columbia University, the MSEE from Georgia Tech, and the BE(Elect) from the National University of Ireland.