Schneier on Security
A blog covering security and security technology.
« Friday Squid Blogging: Make a Giant Giant Squid Pillow |
| Fear and the Availability Heuristic »
March 23, 2009
Research in Explosive Detection
Much of this research focuses on "micromechanical" devices -- tiny sensors that have microscopic probes on which airborne chemical vapors deposit. When the right chemicals find the surface of the sensors, they induce tiny mechanical motions, and those motions create electronic signals that can be measured.
These devices are relatively inexpensive to make and can sensitively detect explosives, but they often have the drawback that they cannot discriminate between similar chemicals -- the dangerous and the benign. They may detect a trace amount of TNT, for instance, but they may not be able to distinguish that from a trace amount of gasoline.
Seeking to make a better micromechanical sensor, Thundat and his colleagues realized they could detect explosives selectively and with extremely high sensitivity by building sensors that probed the thermal signatures of chemical vapors.
They started with standard micromechanical sensors -- devices with microscopic cantilevers beams supported at one end. They modified the cantilevers so that they could be electronically heated by passing a current through them. Next they allowed air to flow over the sensors. If explosive vapors were present in the air, they could be detected when molecules in the vapor clung to the cantilevers.
Then by heating the cantilevers in a fraction of a second, they could discriminate between explosives and non-explosives. All the explosives they tested responded with unique and reproducible thermal response patterns within a split second of heating. In their paper, Thundat and his colleagues demonstrate that they could detect very small amounts of adsorbed explosives -- with a limit of 600 picograms (a picogram is a trillionth of a gram). They are now improving the sensitivity and making a prototype device, which they expect to be ready for field testing later this year.
Here's the paper, behind a paywall.
Posted on March 23, 2009 at 6:55 AM
• 33 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
So how sensitive is that really? I've heard that traces of drugs can be found on most every bill in your wallet. Given the highly explosive nature of chemicals produced in the manufacture of crystal meth, I wonder if these chemicals would be on many bills too, and detectable by these devices? What about ammonium nitrate or diesel fuel from all the farms and gardens and truck stops and mechanics? What about the by-products of household chemical reactions, we keep being told those can be used in terrorism?
Interesting tech, but I wonder if it'd just raise the noise floor one put in use and generate a lot of false positives.
From the description, this device seems to test for explosiveness. Why wouldn't that trigger on gasoline which is extremely explosive, especially in tiny amounts well mixed with air? Maybe a combination of this, which tests for explosiveness, AND conventional tests for nitrates, whether or not explosive, might be useful.
According to the paper they tested RDX, TNT and PETN and then Sodium Borate and Ammonium Chloride. The non-explosives had a Gaussian heating curve whereas the explosives didn't.
They used a 500x100x0.55 um silicon bridge with a resistive heat sensing track in the middle and two heating tracks on either side.
Looks like it actually works, assuming they haven't only included the successful results!
billswift: As far I understand the snippet, the device does not test for explosiveness in general, but for particular chemicals that its designers happen to know as explosives.
A gasoline-air mixture may well explode (I don't know if it actually detonates, though), but it is not a good choice if what you want to make is a bomb -- it is so light that it does not pack very much bang per volume, so a gasoline bomb would have to be conspicuously large.
Gasoline-air also doesn't scale. Once the bomb becomes so big it basically blows itself out. Try setting off a stick of dynamite next to a barrel of petrol and see just how lethal it isn't.
Gasoline is not explosive by itself, but requires the presence of an oxidizer (oxygen, nitrates, etc). However, explosives contain the require oxidizer (usually some sort of nitrate compound, either mixed or chemically bonded), so it is possible/likely that this distinction can be detected by these devices. I imagine that most people who tank up their cars will exude gasoline vapors for some time after they leave the station.
All these things will fail for any real threat. There are 3 main failure modes.
They detect specific chemicals. Legal explosives have a *lot* of properties outside the ability to explode that make them commercially useful. Extreme stability without a detonate is one of them. The military require very high stability in the presence of fire (aka you can burn it). Hence there are only a few common chemicals used generally (almost all use the :NO2 group ). However the list of chemicals that do explode is far far larger. It is quite impossible to track all of them.
Some of the chemicals that can be used for explosives *have* common usage. Thus its the *same* chemical, distinguishing between intent will be quite impossible.
Gasoline is a good example. Look up fuel air bomb. You can get detonations from a deflagration even in a pipe bomb design (look up pulse detonation engine). Energy density is very high. There are many others too with and without "air" usage.
Hell, just 1 or 2 liters of gasoline on a plane/train/bus/movie theater set on fire would be a real problem. Or magnesium for that mater.
Seeding false positives is easy.
Even if it works really well and thats a big if. It needs to be sensitive enough to detect small amounts of residue (Otherwise a simple wash and a air sealed bag will be enough to hide it). Thus various seeding methods can be used to ensure a very very high false positive rate.
I'm with those who would like to see this tested on a way wider range of chemicals before mass deployment. Sodium Borate and Ammonium Chloride don't even burn particularly well, much less explode. You really want to be able to detect not just the class of explosive things but individual explosives, because a lot of things that can explode (deflagrate or detonate) don't make the kind of explosives that would pose a major security threat, and raise serious chances of false positives. If the unique-signature claim can be substantiated, that would be nice.
Just like anything else, sensors can be used in the wrong way. It sounds like this is in the "science" phase as opposed to "let's make a government mandate that we all bow down and worship this thing before we enter an airport." Having good tools for finding things is important. It could be used to investigate after an explosion has happened or to check the effectiveness of containment at a factory where these explosives are being handled, etc.
This does seem to also open up the possibility of a huge denial of service atttack by simply seeding the sidewalk outside an airport (or many airports) with small amounts of some known explosive. Put it in the deicing salt or something similar and let it get spread all over the place. If the sensors are sensitive enough, then pretty much every traveller will test positive for a good long time (and as there is no real hazard created, it should be hard to trace back to the miscreant).
Many of the comments here are thinking on internet-scale instead of the real world, much like that post a long while back about gunshot detectors. These don't need to be perfect. Things in the real world rarely are. It just needs to be good enough, and it could be especially useful at checkpoints. You're not going to put these everywhere, but an extremely sensitive explosive detector would be nice for mass transit points, for instance, where no, you we aren't going to be letting you on the train/plain/cruise ship carrying those cans of gasoline.
@Kyle Wilson: "This does seem to also open up the possibility of a huge denial of service atttack by simply seeding the sidewalk outside an airport (or many airports) with small amounts of some known explosive."
This is simply absurd. You're thinking internet-scale, not the real world. You're talking about someone doing something that's just shy of getting them sent to gitmo for what? To get his jollies off? Should we not use house alarms, since someone with a bb gun can be driven down the street and with a bit of aim, shoot every house window and set off all the alarms?
This is why you have layered security. Even if the explosive detector wasn't being used, you'd still have security guards, x-rays, etc. To completely toss out a security device simply because it is possible to interfere with it is absurd.
@Kyle: I had the same thought. I bet within a day the airport would have any such device unused.
@b This is simply absurd. You're thinking internet-scale, not the real world.
As a prelude to an actual attack it would be very similar to burglars who (safely) set off the alarm every night for a couple of weeks until the guards stop responding aggressively. With a sensitive enough detector, is should not take much material in the road salt supply (or similar material stream) to get things going. If you shut down a bunch of major airports repeatedly (presumably using disposable minions if needed) you'll put some serious hurt on the air travel industry. I think that 'b' is overly optimistic about the chances of catching someone adding a small amount of material to any one of a number of sources of potential contamination in or around an airport. If the response to every batch of positives involves shutting down the terminal until things can be cleaned up enough to stop getting the positives then a small amount of contaimination can have a huge impact (and you can't just let it go, because if you do your expensive detectors are useless for a good long while).
If the firearms cartridges of security guards and police contain double-based powder, then I'm curious to see if the gadget can detect the nitroglycerin and nitrocellulose therein. If not, then the detector can be defeated by a simple sealant such as lacquer.
A pound of double-based pistol powder would be readily available and easily dispersed to 'seed' any area of dense foot traffic.
I use to load my own a while back. Yea that could have been interesting.
If these detectors work at all, they must be quite sensitive. You may not be allowed to take gasoline onto a plane, but you should be allowed to have filled the car up on the way to the airport.
How do you tell the difference? You can't.
Some of us do this in the real world. False positives at a *mass transit* location reduces its usefulness to close to zero.
"(presumably using disposable minions if needed)"
I'm sorry, I thought we were talking about the real world. My mistake. Clearly, this security device is entirely worthless in the face of the threat coming from Ming the Merciless.
News Flash: EVERY SINGLE SECURITY DEVICE EVER DEVISED CAN BE OVERCOME!
Should we then do nothing? Just throw up our hands and not bother? Of course not. Every security device can be overcome, so you layer them. Security device emitting false alarms? Find out why. Perhaps adjust it down? Perhaps beef up other types? This device can detect as little as 600 picograms. Do you think the people who invented it are so stupid that they can't put a dial on it to change its sensitivity? Or even put different thresholds for different substances? Or have different settings for different locations that have different levels of security?
Not to mention that the device isn't tied to a laser beam to immediately incinerate anyone that sets off its detector. For instance, did the guy just fill up his tank or his backpack filled with gasoline? Have the security people nearby check. Problem solved.
Anyone suggesting that this is a panacea is absurd, but equally, anyone suggesting a device to detect chemicals used in explosives is being equally absurd.
I had access to TNT and similar explosive compounds at university some time ago. Small amounts for analytical purposes, and no, they weren't locked away at all, everyone who remotely looked like they belong there could have entered the unlocked building, lab and storage room and simply took them away...
The first thought I had when I saw the vials filled with TNT, TNB etc. was: oh my, wouldn't it be interesting to load up a little spray bottle with a very dilute solution and spray it on some random people, bus seats, chairs, doorknobs at the airport...
Same of course works with MJ and other drugs. Some evildoer could easily contaminate people, clothes and luggage with the scent of drugs and cause some serious doubts in the dog handlers when they start to produce a whole lot of false positives.
Are you implying the internet is larger or smaller then the real world?
I'm having trouble agreeing with you, we suggest things like this because it's possible and because it's easy to point out the flaws in a system that doesn't really need to be there any way.
Are there flaws in a home security system? You've masterfuly pointed out there are. However I would suggest that it's easier to trip up a system like the one described at a dense point of travel, then it would be to go around an entire neighborhood and set off personal alarms.
Layered security is great, however if one of the top layers is paper thin, then it doesn't provide any security...
I haven't read the paper, but I have serious doubts that this is going to work as an explosive detector. The paper deals with the behavior of some miniature mechanical element after it has absorbed certain compounds in a lab setting. The problem is that in a real life setting a whole lot of other compounds will be absorbed on the detector element, and so far nobody knows yet what they will do, and how reliable this system can be made.
To me that sounds like a whole lot of marketing talk and someone tooting their own horn a little too loud. They try to get more funds for their research which is understandable. Unfortunately the expectations are way overblown, something that seems to be common especially when US researchers are involved. Stick to the facts dear scientists!
*) in a lab setting
meaning under clean room conditions, with carefully metered amounts of pure explosive vapor applied to the detector...
Not going to work in real life.
@Eric: "Are you implying the internet is larger or smaller then the real world?"
I'm implying that they are very different. The speed, distance, and prevalence of attacks on the internet are much greater than in the real world. Additionally, virtually all security measures on the internet must be automated. My servers are on the receiving end of ssh dictionary attacks almost continuously. However, to get into the data center where my servers are, you need a card, my thumbprint, and get past the security guard. Each of those, by themselves, is almost trivial. Combined, they're really annoying. Why? If you fail more than a couple of times to get your spoofed fingerprint past the reader (most of the methods of spoofing don't get it to work on the first try, heck, it doesn't always get my real finger on the first try), the guard will notice, even though the guard probably doesn't know my face. The layers of security are stronger than the sum of their parts in the real world.
On the internet, the layers are effectively atomic. You get past my ssh key, then you're at a login, but you'll need to break the sudo password next. The ssh breakin doesn't slow down the sudo password searching, since it has already bypassed it. Each layer is relatively atomic.
Internet attacks are widespread and thoroughly automated and can be done from half a world away. Real world attacks require that the perpetrators be on premise, massively increasing their risk. The attacker, for instance, can't stand there at a door using a dictionary attack on the keypad the way the internet attack keep knocking on my ssh door from china. The guard will see him on a security camera. Even attempting to break the door code can land the attacker in prison. The internet attackers from across the globe are quite safe; the attempt itself carries little to no risk, so they can keep trying.
Denial-of-service attacks are also quite different between the two. If I was paged every time someone tried to break through ssh on my servers, I'd never get any sleep. Again, because the attempts are remote and anonymous and there is nothing I can do to punish the attackers. A denial-of-service attack against the real world protections is more difficult, elaborate, and require much greater risk. Planting explosive chemicals into the ice-salt, as mentioned above, would get the attacker jail time, even without an actual attack on the facility.
The human element, as much as we go on about the stupidity of the bulk of homeland security personnell, would make most of the attacks that you see on the internet unworkable in the real world. Even stupid humans are more adaptable than automated computer systems.
Many people here are viewing this device akin to a system that will page me every time someone fails an ssh password. That's completely the wrong way to look at it. Look at it, instead, as giving every security guard the nose of a trained bomb dog.
The problem with a lot of "explosive" chemicals is that they are in our environment as a by product of other things both natural and man made.
For instance TNG is in small spray units for people with heart conditions. Various nitrates of celulose from ordinary house hold objects. Then there's "bringing home the bacon" or other preserved meats such as salamis etc have nitrates in them. Also but by no means the least they are also a by product of waste (human animal plant etc) and are the white crystals seen on the sides of "middens" (compost heaps) and bird dropings. Which brings you around to the substances that are used for making explosives which you can buy across the counter in stores, obviously fertaliser but also various cosmetic, camping, baking, plumbing items...
The simple fact is even when using the best of techneiques all you can say is that a chemical is present in your sample, not how it got there or how it was made...
And like the "white head candy" found in over 90% of US (and other) paper money the chances are you have it "in and on" you right now...
@ b : "as giving every security guard the nose of a trained bomb dog."
As we have observed here many times before, that probably won't help if they also have a brain (which is roughly the equivalent of that) of a trained bomb dog.
You give them far too much credit. I know some pretty smart dogs.
And what good is a alarm if you just ignore it 90% of the time? That won't improve the false negative rate and you have still spent a bucket load of money for nothing.
Quite a few house alarms and car alarms are quite useless. But you get them because you save on insurance and hence are economically viable.
I think a lot of people here are missing the point. This is not a suggestion that we should put explosives detecting machines in airports. These machines already exist and are in use. All of these suggestions made here that miscreants could "seed the sidewalk" apply equally to the existing technology.
What they have done is found a way to improve the technology so that it can now distinguish between TNT and gasoline amongst many other improvements.
The doesn't necessarily mean that it just gives a red light to traces of TNT and a green light to gasoline. It means that a computer somewhere displays the word "gasoline" or "TNT" instead of the words "explosives detected".
As with all technology, there are ways to misuse and abuse it, but any misuse of this improved technology that is likely to happen is likely to already be happening with the current, inferior technology.
By the logic of many people I'm reading here, we'd never use metal detectors. Tons of false positives, human operated, pain in the rear, but used damn ubiquitously in high security public areas. Just rename this device "chemical detector" instead of "bomb detector" just as we call them "metal detectors" instead of "weapons detectors", which is really what we use them for.
Moreover, I get the sense that many posters here would install nagios with the deault settings, then whine that it's so annoying. For a device like this, you don't just haul it in, set it to default, and call the swat team every time it beeps. You install it with notification turned off, let it collect data for a month or so, and you'll have a very good baseline.
@ David Keech,
"What they have done is found a way to improve the technology so that it can now distinguish between TNT and gasoline amongst many other improvements."
But gasoline-v-TNT is only one of the false positive issues. The main issue with this device is the increase in sensitivity.
As I noted a lot of the chemicals that go into making usable explosives are quite common in the environment as well as many being freely available across the counter in stores / shops.
The "desired signal" is not "chemical 'A' present" or "more than X amount of chemical 'A' present" but the ratio of various, chemicals (fuel:oxidizer) as well as the relative levels above some threashold.
"You install it with notification turned off, let it collect data for a month or so, and you'll have a very good baseline."
No you probably wouldn't, after a month you would have a file of apparently random data (ie a high noise level and either 'no signal' or 'none that can be identified).
At best the base line you would get from such a data set would be a threshold for the upper levels of the background noise that gave an acceptable false positive rate.
Which is (probably) not the desired signal, which unfortunatly, is likley to be so rare that it will in all probability go undetected untill further action prings it to attention..
The problem of extracting a usefull low probability signal when it is either close to or actually in the background noise is one that remains under active research. Often it requires quite complex and sensitive algorithms with large margins of error.
@cynic who says, "[security guards] ... have a brain (which is roughly the equivalent of that) of a trained bomb dog
@greg who says, "You give them far too much credit. I know some pretty smart dogs."
Please go on thinking that. Encourage the public to go on thinking that, too. A lot of industry people were very happy with "Mall Cop."
I will say that you get what you pay for. If the guard is paid less than the guy who flipped your burger, to quote Dilbert, "don't expect any CPR."
well this is a good research about explosive sensor but can i have it's circuit!
I want a schematic daigram of this detector showing how it works.Please reply, posting comments is of no use if you dont reply or answer something asked.I shall be thankful to you.
hello everyone, can anyone recommend me as to which is the best explosive detector, one should go for?
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.