According to the San Franciso Chronicle:
The private firm in charge of security at San Francisco International Airport cheated to pass tests aimed at ensuring it could stop terrorists from smuggling weapons onto flights, a former employee contends.
All security systems require trusted people: people that must be trusted in order for the security to work. If the trusted people turn out not to be trustworthy, security fails.
Davi Ottenheimer • February 24, 2005 11:59 AM
If the system is predisposed to reward those that cheat and lie (and I’ll avoid the obvious examples of the US Presidential elections, the justification of the Iraq war, and deconstruction of Social Security) then why is it any surprise that the system regularly fails the test of fairness and honesty?
There is a heavy cost associated with being honest and genuine, which cheating is designed to cleverly avoid. Strong authentication with auditing and penalties are meant to reconcile this discrepancy and perhaps even deter cheaters by magnifying risk. But with a system that shows real reward from cheating justice, it makes perfect sense to find people slipping through in pursuit of their own goals.
I think Americans will find it increasingly hard to maintain a free culture of safety and security when the people they allow to run their national security system have a questionable history of misrepresenting the truth for personal and partisan gain.
lightning • February 24, 2005 12:02 PM
Note that the point of airport security is to deter hijackers, not catch them. You don’t have to have 100% security for this.
If you wanted to do something nasty on an airplane, would a 90% chance of getting caught by security convince you not to try? How about 60%?
Davi Ottenheimer • February 24, 2005 12:40 PM
@lightning
Interesting viewpoint. It seems to come from experience?
To answer you directly, current data shows that even with the slimmest chance of evading detection (far less than 1%), suicide bombers make daily attempts to blow up civilian targets.
Common sense in security should tell us we can not rely alone on deterrence, since we can not know what will truly deter someone over time. It’s impossible and foolhardy to try. The textbook case is someone who is a well-known threat, with clear intent to harm innocents. To ensure safety, they must be captured and not simply turned away at one entry point to try again elsewhere. The point of airport security, therefore is to both deter and capture hijackers. We may never achieve 100% security, but it should be as high as possible and the TSA should be perceived as fair but impenatrable to be effective.
Roy Owens • February 24, 2005 1:19 PM
The squad of decoys should try to slip through undetected, noting the failures without revealing themselves. Once a decoy is found out, the rest of the penetration should be aborted since the system will now be on full alert.
The current scheme of announcing the failures as they occur blows the penetration’s cover. Obviously the testing agency is helping the security system reduce its failure score.
Israel Torres • February 24, 2005 3:42 PM
Trust is very important. The problem isn’t who we are trusting, but whom those trusted is trusting.
This level of mistrust blurs the attacker/defender line, which doesn’t clearly define its intent.
Israel Torres
Jeff Pettorino • February 24, 2005 4:28 PM
Trust is quintessential to security. This sounds like a gross violation, and while I would think the TSA would respond harshly, they may very well not, considering we are given the appearance of security, rather than the culture of security.
CJ • February 25, 2005 2:10 AM
I would think that the detection pattern would be noticeable – aside from any other analysis, surely the decoys should have noticed that they were rarely detected on their first attempt, and frequently detected on subsequent attempts?
past employee of TSA • February 25, 2005 9:47 AM
Just wanted to pass this along. When I worked as a screener, there were SEVERAL instances of screeners taking items from the luggage that they were in charge of screening, and later taking the items home…STEALING. One case was of a valuable heirloom necklace. Nothing was ever done about it, even though the other screeners knew who this thief was. That thief resigned due to child care issues, but there were other thieves among the workforce, or those who would cheat by not reporting certain items that should not have been allowed to fly, such as biohazard. For example, a man was allowed to fly with the items even though it was in a plain, unmarked styrofoam box that was cracked and taped up. The items-inside this taped up box was dry ice and was a few glass vials with peeling labels on them with the words typed, “live virus”-Hepatitus B, and some others that I did not want to see and the screener supervisor said to let them handle it from there. This man, he said he forgot he had the items, claimed to be a doctor leaving one convention and on his way to another and was tired. He did show the airlines some identification, but did they VERIFY this? No, and besides, he should not have been allowed to fly, but TSA, in fear of upsetting the airlines and not wanting to lose their contract with them, he was allowed to fly! Yes, even with the items as his carry on. This was back in 2002, so maybe things have changed since then? Due to many such instances, I resigned and went back to school to work towards my degree. As for solutions, I say put cameras above every screener work area, this way there will be no question as to who did what. And also, if some passenger tries to say a screener “planted” something, there will be no question of this either.
Probitas • February 25, 2005 1:36 PM
Regarding the points raised by lighting and Davi:
I would say that lightning’s view is more likely from logic than from experience. As long as we are demanding perfection from anybody, no matter whether their endeavor is security, digging ditches, or being the President, we are creating the incentive to cheat. If imperfection is not tolerated by the examining bodies, and used as an opportunity to learn from our mistakes, workers are left in a position where cheating is the only logical choice.
Example: You work as a screener, and you know that failure to spot a decoy will result in a 100% chance of you losing your job. You know that if you cheat, you may or may not get caught, because the person checking your work is no closer to perfection than you are. If you stand a 90% chance of losing your job by cheating, and a 100% chance of losing it by not cheating, which way will you choose?
As long as we are relying on catching 100% of the terrorists 100% of the time, instead of looking for more realistic solutions to the whole terrorism problem, we are going to continue ending up in situations like this one.
cmils • February 25, 2005 8:12 PM
@ davi
“…current data shows that even with the slimmest chance of evading detection (far less than 1%), suicide bombers make daily attempts to blow up civilian targets.”
I’m not throwing darts at you, but where might I obtain such data? I am genuinely interested.
Davi Ottenheimer • March 2, 2005 2:56 AM
@cmils
There are many open sources of information on suicide bombers taking impossible missions, both historical and current. For example, Al-Ayyam (http://www.al-ayyam.com/znews/site/default.aspx) published a story on January 14, 2004 where the parents of Iyad al Masri “expressed outrage and demanded an investigation of the poor planning that left ‘no chance of success’ for their son to carry out a suicide bomber mission.” In brief, while trying to avoid detection he exploded prematurely, killing only himself. According to the story, the bomber had no experience making his way out of the city during a curfew, “which made it impossible for him to reach his target” without being caught.
In terms of anti-explosive methods and success, I recommend reading through some of the latest laser spectroscopy data (http://www.itlasers.com/), which claims a near-perfect detection rate for trace of explosives several meters away.
Davi Ottenheimer • March 2, 2005 3:10 AM
@Probitas
Good point. It sounds similar to the prisoner’s dilemma in game theory. However, rather than compare TSA staff to prisoners, we could reference an improvement plan such as the Shewart Cycle (Plan, Do, Check, Act). In other words, the theory is that if you apply a system of fixing issues and rewarding those who reduce risk, you actually create continuous improvement. The next step would be to factor in the costs of the improvements, as they seem to rise exponentially. Generally speaking, studies show that you get the most return for investment up to a 87% survivability rate…after that the risks must be high enough to justify a very costly program.
Aiesha • September 5, 2006 11:22 PM
Do you know a place that i can go to recieve practice questions for the tsa screening test?
I take the test and failed i am suppose to take it again in 6 month. Is there anyway you can help me?
Thank You
DAVE • June 26, 2008 8:37 AM
i have the same query as to where to get the study materials for the test.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Bill • February 24, 2005 11:05 AM
Apparently they’re cheating wasn’t good enough as they still only caught 90% of the decoys. 90%?! Shouldn’t screeners (whether cheating or not) be expected to spot more than 9 of 10 of the decoys (or real bad guys?) It’s that tenth passenger that has me worried.