Reassessing Airport Security

https://www.schneier.com/blog/archives/2015/06/reassessing_air.html

by Garbage • 11 years ago

106 105 11 years ago

mark-r2• 11 years ago

While I agree that the $7B spent on TSA is a waste, I can't agree with his conclusion that we should spend it on other security measures. That just leads to more "wiretap all the citizens" initiatives.

__z6• 11 years ago

Bruce Schneier is completely and 100% against wiretapping all citizens.

privong2• 11 years ago

He does say "I'd rather see that money spent on intelligence and investigation". And I think it's evident from his other writings that "intelligence and investigation" refer to focused and targeted efforts, rather than dragenet surveillance.

mark-r2• 11 years ago

Undoubtedly that's what Bruce would prefer, but what do you think are the odds it would turn out that way?

omgitstom• 11 years ago

7BN is like 250K for each public school in the US

erbo3• 11 years ago

The TSA was created for one purpose and one purpose only: To remove liability from the airlines if someone tries to blow up a plane or bring a weapon onto one for evil purposes. (At the same time as it was created, the airlines had liability retroactively removed after 9/11; without that, they'd have been sued into smoking craters by the families of the 3,000 people who died.)

The fact is, nobody in this country has been willing to die to blow up an airplane since 9/11. If there had been just ten people willing to do so, then, from the statistics, nine planes would have been blown up, and, when the tenth guy was caught, he would have blown up the airport instead.

The TSA is a failure, and an infringement of civil rights besides. Everyone responsible for it, up to and including members of Congress, should, by all rights, be fired and forfeit all salary and pension benefits.

fredgrott• 11 years ago

no, not a failure..No planes blown up and No huge Airlines liability..like it or not the politicians who made the law do not have the same expectations we do

Vexs• 11 years ago

That statement is like saying "This antivirus works really well on my computer that's not connected to the internet, I haven't gotten a virus yet!"

If there was a threat, the TSA would probably do a pretty crap job at stopping it, every test that's been run against them shows it, not to even mention the myriad of people that accidentally bring a pistol, knife, or whatever through the checkpoint and discover it when they land!

grecy• 11 years ago

Homer: Not a bear in sight. The Bear Patrol must be working like a charm.

Lisa: That's specious reasoning, Dad.

Homer: Thank you, dear.

Lisa: By your logic I could claim that this rock keeps tigers away.

Homer: Oh, how does it work?

Lisa: It doesn't work.

Homer: Uh-huh.

Lisa: It’s just a stupid rock.

Homer: Uh-huh.

Lisa: But I don't see any tigers around, do you?

[Homer thinks of this, then pulls out some money]

Homer: Lisa, I want to buy your rock.

__z6• 11 years ago

Both the underwear and shoe bombers were stopped, not by TSA, but by their own mistakes as well as vigilant passengers.

peteretep4• 11 years ago

    > The fact is, nobody in this country has been willing to
    > die to blow up an airplane since 9/11

Or they've been caught pre-airport by the Intelligence Services.

freditup2• 11 years ago

I think this is a critical point. Intelligence seems like a much more effective means of security than physical security. Of course we have to debate the relative merits of intelligence if there are tradeoffs with liberties/freedoms.

joshvm• 11 years ago

The underwear bomber in 2009 was certainly willing, although ultimately inept.

There was also the transatlantic plot in 2006. That one rejuvenated the travel-size cosmetics industry.

erbo3• 11 years ago

Neither of which were stopped by the TSA.

simoncion10• 11 years ago

Honestly, I'm not sure that the it could have been demonstrated that the airlines were liable for the losses.

Consider that every single other hijacking up to that point had ended peaceably. One of the many, many, many reasons that this attack was so successful was that it was novel and unexpected.

erbo3• 11 years ago

I don't know that it would matter whether it could have actually been demonstrated, in court, that the airlines were liable for the losses. With 3,000 grieving families looking for someone to blame, and any number of lawyers looking to cash in if they could get the airlines found liable, suits would have been filed, and the airlines would then have been obligated to defend those suits, which would have hit them hard with legal expenses, discovery expenses, and so forth, right when people were unlikely to be buying tickets, being afraid of another attack. How bad would the damage have been? There's no way to know; if it didn't destroy the airlines, it could easily have wounded them greatly.

specialist• 11 years ago

The TSA was created for one purpose and one purpose only...

To enrich cronies.

nabla9• 11 years ago

If somebody wants to kill air travelers, TSA screening checkpoint line is the most attractive target.

Just fill big suitcase with explosives and wait until you are middle of the TSA screening line during holiday season.

aetherson• 11 years ago

Or, like, any other public transportation option.

Busses and trains are not magically immune to explosives. Especially when they have literally zero security and you could easily bring an entire suitcase full of dynamite onto them. The fact is, there just aren't enough people interested in that who have the necessary skills to actually obtain explosives without alerting the FBI to their existence.

ehmorris• 11 years ago

Here at least. Bus bombings are almost common in some places: https://www.google.com/webhp#q=bus+bombing&tbm=nws

jerf• 11 years ago

If you just want to blow something up there's nothing even all that special about "transportation". Planes are special, because they have an unusual characteristic; taking control of a plane gives you an extremely powerful weapon that you can point anywhere and deliver incredible destruction. There aren't very many other things that two or three people can do that will credibly take down a skyscraper.

As it gets harder to deliberately crash a plane and there's ever more drive-by-wire, though, that threat diminishes, and the airport threat diminishes with it. Hypothetically if planes were completely ground-controlled, there would basically be no reason for airport security at all... blowing up planes isn't that intrinsically interesting, really. There'd be a certain amount of inertia to the concept, but that's it. (Yes, I know it used to be done, but post-9/11 I can't help but think that terrorists would view that as a pathetic second-best effort now.)

(Though I'd appreciate some serious security around the ground control station, though. Taking over one plane is one thing... taking over "all the planes in the area" or even "all the planes in the sky" would be something else!)

pavel_lishin3• 11 years ago

True, however I would imagine that an attack on an airport would hurt more than an attack on a bus or train depot; I'd wager that flights might get grounded until everything is sorted out. Nobody's going to shut down New York's Penn Station if something happens in Chicago or San Francisco.

freehunter5• 11 years ago

To be honest, that's a huge fear of mine every time I'm waiting in a TSA line. What happens if they find a weapon and the person decides to use it right then and there? What happens if their equipment sets off a weapon? What happens if a domestic terrorist is trying to get back at the TSA directly?

Most of my flights are what Delta or United call "connector" flights, so there are only 40-50 people on the plane anyway. Not an attractive target, I would think. But standing in line at O'Hare, there could be 100+ people there. I'm not afraid of the TSA. I'm afraid of the massive crowd of people they create.

btbuildem• 11 years ago

Exactly. If you look at airports that face actual, active threats (israel) - you'll see they've minimized security lineups.

thomas11• 11 years ago

The end-goal of terrorism is the psychological impact, not killing a few people more or less. And there's just something about airplanes that creates a larger psychological impact when they're hit. Maybe it's the thought of being stuck in one, helpless and with no way out. Or maybe they symbolize progress and freedom, making traveling the world so easy. Whatever it is, that's what the terrorist attacking airplanes are going for.

__z6• 11 years ago

From the article:

"The TSA is failing to defend us against the threat of terrorism. The only reason they've been able to get away with the scam for so long is that there isn't much of a threat of terrorism to defend against... Terrorists are much rarer than we think, and launching a terrorist plot is much more difficult than we think. I understand this conclusion is counterintuitive, and contrary to the fearmongering we hear every day from our political leaders. But it's what the data shows."

You're much more likely to get killed on the car ride to the airport than at the airport.

mikeash2• 11 years ago

I really wonder why this hasn't happened yet. I can only assume that either terrorists are maniacally fixated on the airplanes, or there are approximately zero intelligent terrorists.

freehunter5• 11 years ago

Or option C, 9/11 was a one-off, special circumstance that was difficult to create in the first place and nearly impossible to replicate.

lfam• 11 years ago

I think it hasn't happened yet because there are very few people who actually WANT to do that. The TSA and other security agencies would have you believe that the world is full of mass murderers. Based on the evidence, I'd say that's not true.

Lawtonfogle2• 11 years ago

If somebody wants to kill air travelers, TSA screening checkpoint line is the most attractive target.

My other favorite example is that in a lot of buildings, including school buildings, the standard fire drill AND bomb evacuation drill has everyone move outside, often into a single area which is far less controlled than the building being evacuated.

kgilpin• 11 years ago

The attackers objective is not blowing up a crowd of people.

Their objective is a hijacked airplane; a dangerous weapon that can be used to attack strategic targets like the White House.

simoncion10• 11 years ago

...a dangerous weapon that can be used to attack strategic targets...

Do you honestly believe that Air Force hardware won't be used to destroy a hijacked passenger jet that appears to be in service as a weapon? I don't.

rquirk2• 11 years ago

While we're at it, can we be allowed to carry bottles of water through security? At least in Europe, having to pay 3€ for a 50cl bottle of water after passing through the checks is clearly just a money-making scheme and has nothing to do with stopping terrorism.

freehunter5• 11 years ago

I'm not sure about Europe, but in the US we can carry an empty bottle through security.

I did once accidentally leave a large, full bottle of contact lens solution in my carry on, though, and it passed right through. Maybe that's the trick.

hn9780470248775• 11 years ago

I typically don't bother to remove "liquids and gels" from my baggage. The detection rate is less than 50%, and even then, they'll only find the most obvious offending water bottle (or whatever). You shrug, say "whoops", and move on.

You could probably claim contact lens solution as a "medically necessary liquid," which is exempt from the rules anyway.

__z6• 11 years ago

Contact lens solution is categorized like medicine and is exempt from the liquids rules. Once they did swab the outside of the bottle (for whatever they swab for?)

I travel with an empty water bottle every time.

knodi123• 11 years ago

Although for the record, a large full bottle of contact lens solution is permitted. It's an exception to the liquids rule.

Half the time, the TSA misses my solution bottle. The other half, they find it, have me open it, wave it under a chemical detector, and then send me on my way.

genetik• 11 years ago

When I travel, I bring an empty cycling water bottle with me and send it through the x-ray with the top off so it's obviously empty. Once through security, I fill it up in a water fountain and hydrate for free.

rquirk2• 11 years ago

Yes, I do this too. Incredibly, a lot of airports only have hot water in the bathrooms. Or sinks designed in such a way that a bottle can hardly be filled at all.

jheitmann• 11 years ago

You can do that today. Just freeze it: https://apps.tsa.dhs.gov/mytsa/cib_results.aspx?search=gel%2...

I learned that from one of the TSA line prep barkers. They were putting such a jolly spin on their spiel and it sounded so ridiculous that I assumed it was a joke. But, both happily and sadly, nope.

BinaryIdiot4• 11 years ago

My favorite part about the TSA is that you can pay about $80, fill out some forms and show a couple of pieces of identification and now you can bypass most of their security. It's just a money making scheme; being able to pay money to bypass most of their security shows their security doesn't do anything useful (otherwise why would you be able to pay to bypass it?).

jamestnz• 11 years ago

The TSA Precheck program, you mean?

At $80-100 a throw, I'm not sure it's a very good money-making scheme. For starters, when someone enrols in the precheck program, they must undergo both a background check and an in-person interview... how much of the $80 fee do you suppose that leaves?

And even once approved, you're still subject to metal-detector scans upon boarding, you just get to skip the whole shoes-belt-laptop game. Oh and they can still "randomly" subject you to those checks if they want to. So I don't really agree that it's some crude "anyone can just pay and receive carte blanche access at the airport" scheme.

Here's another good one: for nationals of APEC member countries, there's the APEC Travel Card[2]. Frequent travellers can pay for one of these cards, and they gain access to dedicated expedited immigration queues (or, in the absence of a dedicated APEC queue at your airport, you get to use the pilot/aircrew lane). The card costs $150 and is good for 3 years.

For business travellers making multiple flights per week, access to programs like these is a godsend (I used to fly internationally at least once per week for work).

I do agree with you that all the "security theatre" stuff is a transparent sham, but the existence of programs like precheck isn't proof of that.

[1] http://www.tsa.gov/press/releases/2012/02/29/tsa-pre-check-T...

[2] http://travel.apec.org/abtc-summary.html

BinaryIdiot4• 11 years ago

At $80-100 a throw, I'm not sure it's a very good money-making scheme. For starters, when someone enrols in the precheck program, they must undergo both a background check and an in-person interview... how much of the $80 fee do you suppose that leaves?

So I haven't gone through it but several people I know have and all of them report that they fill out forms, show identification and that's it. The "interview" is always a very short questionnaire and background checks are incredibly cheap to do nowadays.

And even once approved, you're still subject to metal-detector scans upon boarding, you just get to skip the whole shoes-belt-laptop game. Oh and they can still "randomly" subject you to those checks if they want to.

The metal-detector scan is incredibly fast, no one is ever in that line and you don't have to remove your laptops, shoes and other related equipment. You just go through and you're done 99% of the time.

So I don't really agree that it's some crude "anyone can just pay and receive carte blanche access at the airport" scheme.

I don't agree with that either hence why I never said it so I'm not sure why you bring it up.

simoncion10• 11 years ago

...how much of the $80 fee do you suppose that leaves?

"According to this TSA report [0], $14.50 of that [$85] fee pays for the FBI to run a criminal-records check, and the other $70.50 (83%) goes to the TSA for administration." (Via [1])

[0] http://www.tsa.gov/sites/default/files/publications/pdf/stak...

[1] http://www.loweringthebar.net/2014/03/tsa-confuses-perfume-b...

peteretep4• 11 years ago

    > It's just a money making scheme

For whom? Where's the money going?

BinaryIdiot4• 11 years ago

TSA makes money which is used to pay for more equipment and other contractors, etc. It's how all government money travels.

rhino3692• 11 years ago

1) Precheck still sends you through the metal detector / scanner and still X-rays all your stuff. It's probably 99% as effective in that that regard.

2) The background check they do probably makes it more secure than a normal screening. What the chances that a cornfed, midwestern woman who likes baseball, cherrypie, and is crazy 'bout Elvis tries to hijack a flight?

In fact that sort of scrutiny is how Israel does their airport security. The reason America doesn't is because giving the fifth degree to [muslims/political radicals/other ethnic groups] is illegal and unpopular.

A terrorist wouldn't apply to precheck.

simoncion10• 11 years ago

A terrorist wouldn't apply to precheck.

I strongly disagreement with your statement. See: http://www.loweringthebar.net/2015/03/notorious-felon-and-te...

BinaryIdiot4• 11 years ago

A terrorist wouldn't apply to precheck.

Why wouldn't they? A large majority of terrorists end up having no prior record. It's not like a background check goes and talks to family or friends, checks references, etc (a SSBI will but a regular background check does not). A regular background check is almost entirely useless.

mc32• 11 years ago

One thing to note is that the testing was done by people with detailed knowledge of operational procedures, therefore they knew the weaknesses and took advantage of that. In other words, if you got 100 semi random travelers and tried to have them sneak things thru fewer than 95 would succeed.

Now, that's not to say the TSA isn't incompetent and shouldn't improve its procedures and policies, but rather the 95% is an exaggerated value.

One other observation to make. When driving down the highway over the speed limit and a patrol car becomes visible, it's quite clear the car would not catch every infringer, yet, nearly everyone slows to comply with speed limits. In other words, as Bruce says, you don't need 100% effectiveness for the system to be effective.

bargl• 11 years ago

I got the opposite from the original CNN video. It appeared that they were using "basic" hiding techniques for these items. They weren't trying to go and reinvent the wheel by using techniques they know will get through TSA screening, but they used techniques that they figured TSA would be able to find, and they just failed.

I'm going to go re-watch the video to see if I missed something though. I'll edit this if I learn something new.

Edit: I looked for some more detailed articles and I found this quote, however it is coming from the TSA not the testing agency.

The goal of the Red Team is to build tests that push the boundaries of our people, processes, and technology. We know that the adversary innovates and we have to push ourselves to capacity in order to remain one step ahead. With that said, our testers often make these covert tests as difficult as possible. It’s not like they’re using a cartoonish bundle of dynamite with an alarm clock strapped to it. These items are extremely hard to spot.

http://nymag.com/daily/intelligencer/2015/06/tsa-fails-secur...

Edit 2: I'm an idiot the TSA was the screening agency, or at least these tests are frequently referred to as internal tests. I didn't know the Department of Homeland Security Inspector General (IG) was a part of the TSA.

a3n• 11 years ago

Even if they were using full-on, ninja terrorist techniques, you would expect screeners to train to those standards. If they train to and pass those standards, then Joe Terrorist shouldn't be a problem.

They did use that excuse in the past. Lame after-the-failure excuse making.

jhildings• 11 years ago

So, if you were someone who wanted to get through the security with some kind of dangerous object, wouldn't it make sense to map out those weaknesses? Therefore they also need to be tested against.

pavel_lishin3• 11 years ago

But isn't it a risk/reward question? I slow down because to me the high risk of getting a $125 ticket isn't worth the ten minutes I'll save driving, if I see the police car.

However, if I were a nefarious evildoer, I may be willing to take a higher risk of getting caught in order to do whatever it is I want to do.

lifeformed• 11 years ago

Those operational procedures aren't secret knowledge though. Someone who really wanted to get something through can get their hands on that information.

dredmorbius2• 11 years ago

1. There is a vastly greater prevalence of drivers travelling over the speed limit than there are of airline hijackers.

1. It's trivially easy to distinguish vehicles travelling over the speed limit than hijackers. One might even suggest that speeding enforcemnt is significantly enabled by the ease, and low false-positive rate, of detection: speed radar.

The two situations aren't comparable.

juliangregorian• 11 years ago

I just re-entered the US via JFK last night. There was an employee going up and down the line promoting "Global Entry" (skip the line). All I could think was how utterly farcical the whole thing came across.

kgrin• 11 years ago

Global Entry is for immigration/customs, not TSA security.

The trade-off is: they do a background check and take some biometrics, and in exchange you can skip the conversation with an immigration agent where they ask you where you're been, etc. - you just answer the usual customs-form questions at a kiosk.

It's actually a pretty reasonable trade-off, and speeds the process of going through Customs - which, unlike some of the TSA stuff, is in no way unique to the US (having gone through immigration/customs in 20+ countries, I can say with some experience that the US is far from the worst...)

vermooten• 11 years ago

My last TSA check took < 5 minutes, everyone courteous and professional. Ain't no thang. The bigger ballache for me (I live in the UK) is waiting at customs, sometimes 90 minutes in a line.

viraptor• 11 years ago

Try Melbourne, Australia... 2.5h last time in the "not privileged country" line :/

tomjen36• 11 years ago

Australia is basically the hell-hole of the first world.

Reassessing Airport Security

Related Stories