Schneier on Security

Clive Robinson • January 22, 2010 2:27 PM

@ mcb,

“what about concealing contraband… …within the fat folds of the morbidly obese?”

Fly French Airways.

Apparently people have turned up having fully paid for their ticket and been told they either by a second full price ticket there and then or they don’t fly, and don’t get a refund or transfer to another airline.

On being “legaly chalenged” their PR people came up with some twaddle about only for fully booked flights…

It appears it is little more than financial blackmail as they already have peoples money and just want to be greedy.

Clive Robinson • January 22, 2010 6:02 PM

@ Bob, (AFM),

“Thermite was the very first thing I ever thought of. Unlike the video, if you know how, you can even ignite it without a flame.”

You can infact ignite it with water without any problem.

I found a way to do it when just an early teenager. And yes if you search backwards in time against my name you will find a recipe for it and more than one type of thermite (of which there are a considerable number).

“I believe what has prevented further catastrophes has not been the post-9/11 changes to airport security”

Agreed.

“… so much as the technical ignorance and ineptness of the terrorists,”

Here I strongly disagree Cptn Underpants and Cpl Hotfoot where I agree clules inept and more likly to blow them selves up if they tried to light a camping gas light. They where at best Walter Mitty types who are a real danger to whom so ever had anything to do with them. They would almost certainly pass the old fashiond “idiot test” and probably the imbeceil test as well.

However I do not belive those behind them are technicaly ignorant or inept.

The design of both the Underpant and Shoe bomb and the choice of explosives was actualy reasonably good (actuall try to make as good yourself to see why).

Importantly from a technical perspective they are like the IED’s in Afganistan and Iraq more likley to work than not.

BUT they would not bring down an aircraft and it is highly unlikely they would have caused significant fatalities.

Make some of the explosive up yourself and stick 3ounces wraped in a little cloth ontop of a three foot high bit of plastic tube in the midle of a field and set it off. It looks good it sounds good but is it realy any good, nah.

Which brings me around to,

“…combined with good police and intelligence work.”

This is hit and miss at the best of times. There are to many people to watch and insufficient is known about how Cptn Underpants and Cpl Hotfoot where recruited.

My bet is that they went around and around the mosques etc looking to get involved. They would have been loud and inept about it and a clear danger to any terrorist organisation. Terrorist organisations do not want the liability these two would have clearly been, and thuss may have assumed they where the lead edge of a sting organisation. Even if they where not they where going to attract attention.

Thus the best thing is “enrol them sideways” that is setup a fake “organisation” away from any real activity. Send them to places where they will not be high visability and play on their “Walter Mitty” charecter asspects. Make them think they need “deep cover” etc etc just to keep them of every radar.

Dust of some old plans and use them to test airport defences etc. As long as they never get to meet the real organisation then it does not matter if the succeed or not.

In fact it’s better that they do fail…

If you are a smart terrorist you use the sorry idiots to make not just airport security, but the whole Intel community look dumb. And worse the Intel community will get no real information out of them at all just fake info fed to the two designed to stir up people in the UK and US communities. Thus the authorities will be wasting resources trogging around doing the terrorists work for them…

I suspect that in both cases the bomb realy would not have been that viable and deliberatly so…

So no I would not say the terrorist organisations are technicaly ignorant or inept. There is just to much evidence around from other events IEDs, “homemade” rockets etc etc to make a credible argument that they are.

Cptn Underpants and Cpl Hotfoot where patsies who where used and thrown away with a very very definate purpose, and at an appropriate time as well. They themselves where at best a liability to those around them, they are not any longer.

In the process lots of good press for the terrorists, no women and children killed so no bad press on that score. The bombs contain no traceable materials so are a dead ends, lots of false leads for the “Plods” to ruffle the feathers of the minority communities, which gives rise to the better recruits being found, etc, etc.

Does this sound like those behind them where inept to you?

Think of it as a clown show we are all laughing at the “pratt falls” and “squirty flowers”. But that’s what’s funny and a lot of planning goes into a clown show or it just does not work. Which is why sometimes clows turn out to be very clever and far from the “stupid” they pretend to look.

Clive Robinson • January 22, 2010 7:10 PM

@ Old Fat Guy,

“Awesome! I hate wearing normal clothes anyway. Especially on long flights, they bind up…”

Shame, I was hoping you were going to crack “It realy gets your panties in a wad” joke 8)

“I’d love to just wear spandex, but at my age..”

Yeh that is why Bruce Dickinson (lead singer of Iron Maiden) took up flying comercial planes as a part time job.

He tells a quite funny story of walking through an airport in his captins uniform when he was aproached by a person in an outsized Iron Maiden T-shirt, and braced himself for being asked for his autograph etc. Instead the callowed youth asked him if directions to the loo.

Oh and in recent times he has been given as an example of a modern day polymath due to his other minor sucesses as author, script and song writter, international fencer, and train and aviation nut. He has also flown a number of humanitarian missions in the past couple of years, and apart from his roucous voice appears to be a “pretty good egg”.

Clive Robinson • January 23, 2010 4:46 AM

@ Pat Cahalan,

Long time no hear, hope you are well?

With regards,

“Also to be fair, we have plenty of anecdotes to bring into question the efficacy of these silly things.”

The problem with them (apart from the “naughty pics” that are realy not needed by unskilled operators) is, that they mearly give an indistinct indication of something. And thus rely on the operator to “make something of it” (Radar operators very very rarely see raw displays, they are processed for noise, clutter and many other things before they get to the operators eye).

Now if you regard the backscater / millimetric / IR / etc as being individual sensor types for a tomograph you can in theory (and in practice I suspect) hitch three or four diferent types together in a single unit and let a computer crunch the numbers quite rapidly.

The result should be considerably greater than the sum of it’s parts, and at thus actually start proving more usefull.

However the big failing of many of these systems is time. They just take way to long to be of any real use for general scanning. Unlike a walkthrough metal / radiation detector which can atleast keep up with walking pace.

The second is they often lack “volume” or “depth” information. For instance if I take thin lead foil sheet and cut a shadow of a hand gun out of it and put it in the inside cover of a large book and drop it on the X-Ray scanner belt it should (hopefully) be spotted, incorrectly as a gun. With a volumetric tomograph the computer would realise it had no depth and as such could indicate that additional information (thus reducing the oportunity of DoS attacks).

The computer should also be able to render the object on an outline in 3D and rotate it automaticaly to the three optimal plain views for easy recognition.

There most definatly, has to be a smarter way to do it, and my view is use orthagonal systems to do broad searches and crossover set reduction down to a sensible alarm level. And use computers to do the number crunching not 10hour shift workers who’s brains have turned to just so much burger filling due to tedium etc.

For instance just millimetric EM reflection tomography and IR transmission tomograhy with appropriate computer technology would tell us one heck of a lot about objects.

We know all of this is possible (at a price) but the real question is, is it realy worth it?

To which I suspect the answer would be no…

As others have noted determind terrorists will,

“Simply change their tactics”.

At the moment the “smart terrorist” has one heck of a lot going in their favour and we need to start fighting them and stop trying to stop the “Walter Mitty” types they point in our direction.

From my perspective I would say that your smart terrorist will “Observe”, “hypotosise”, “test” and “refine” in the Newtonian Science methodology simply because the cost is quite reasonable and the penalty non existant.

That is a terrorist organisation arranges for the performance of the machine to be “observed”. They then come up with “ideas” of how to get around the system like an 8ounce plastic or glass hip flask in a pocket. Then they send a smart and clean terrorist who they have laundered into a role out to “test” the idea.

If it gets through it’s a success, but if it does not it just ends up in those bins you see at the side and the smart terorist tester is free to try again a little later without penalty. Next time you see those overflowing bins ask yourself “could one of those be from a terrorist test?”

We now know that is what the 9/11 terrorists did. They identified a way by observation or previous experiance, tested it and built their plans accordingly (this is not something you would see the likes of Cptn Underpants or Cpl Hotfoot doing successfully).

Currently there is effectivly no penalty that is going to stop the smart terrorist enumerating the system to their hearts content. Which just makes a smart terrorist smarter (by experiance).

However the work involved with recruiting, training, identity laundering, etc is a very very resourse expensive activity and a major weekness in any terrorist organisation.

Thus IF there where penalties to be paid like first offence “you don’t fly on the day and all your bio-metrics are recorded”, second offence you are banned from flying in US airspace for a year etc. This would quite heavily attack the one realy vital resourse that terrorist organisations have which is smart experianced personel.

There should be a few other graduated safe guards but you get the general idea.

The next trick is to make the observation stage of little relavance.

Let us say a heirachy of tests exist for various asspects.

1, Walk through metal detector.
2, Wanding down by operator.
3, Patting down by operator
4, Thorough search by operator.

etc,etc. Importantly if a person fails at any point and a cause is found don’t as in some places let them procead send them back through the previous stage again with a delay as this upsets a number of potential attack vectors.

However to limit the usefullness of the observation stage If in the initial two stages you put in a “random fail” on individuals set at some significant percentage (10% or more). Then if it is done properly neither the terrorist observer or equipment operator knows if the alarm is true or false and thus pushes them through to the next stage. The trick is to make the uncertainty sufficiently high that many of what the 9/11 terrorists did would not be possable.

It has several advantages which I’m sure you will realise takes the cost of “enumerating” a flight departure quite expensive for terrorists.

However even though it is still just “Security Theater” it will have a significant effect on how the terrorists behave and that hopefully will open up other avenues of enqiry etc.

Clive Robinson • January 23, 2010 2:23 PM

@ Jason,

“The other part is a metal detector. Thermite has IRON oxide (which is metal) in it and would of lit up a metal detector like the presidental christmas tree.”

Err no that depends.

1) First off not all thermites are an oxide of iron and aluminium powder, there are other mixes.

2) Not all metal powders or metal oxide powders that can be used in thermites are conductive.

3) Most metal detectors don’t actually detect metal they detect field effects caused by conductors (which are mainly metal)

So the 64K question – is it possible to make a thermite that does not get picked up by a metal detector?

I’ve never tried but yup I think you might well be able to.

Oh and an interesting thought for those of a realy unplesant mind is “flare material” which has a high content of PTFE set that of with a berilium to form airborn micro particulates in the aircraft, and you would not need to do much damage if any. All the passengers sentanced to death of cancer or emphasima should create enough of a scare…

Which is maybe why the US considered it as part of the load for “bunker busting” bombs to be used in Afganistan.

Clive Robinson • January 24, 2010 5:57 AM

@ anon,

“why aren’t we using a simple, known effective technique – bomb sniffing dogs.”

It appears to be a simple and cheapish (apart from the training) so what is wrong with it,

1, As drug smuglers know a dogs nose has a dynamic range limitation so the drug smell can be masked.

2, As drug smuglers know drugs can have their “smell” profile altered so the dog may not recognise the drug at all.

3, As a number of drug smuglers apear to know there are ways of “packaging” drugs to make them nearly inert.

4, There are some drugs that sniffer dogs don’t smell.

5, As drug smuglers know there are tricks that can be used to make the dog appear unreliable (DoS type attacks).

Drugs are in the main simple organic chemicals. So for that matter are the more common explosives. And the above problems with drug sniffer dogs apply as much to explosive sniffer dogs.

Some of these problems can be seen for example,

It is now fairly well known that nearly all US citizens carry cocain around on them most of the time, as do residents of other nations.

Drug sniffer dogs ignore these people…

Chemical Agent Monitoring (CAM) “sniffer/puffer” machiens however do pick up peoples wallets etc.

(BTW please be clear I’m not saying all US etc citizens are drugs users or anything like that. The citizens don’t have any real choice as cocain is embeded in most US bank notes and as it’s quite volatile it only takes body heat etc to cause it to spread to adjacent notes in your back pocket etc).

This simple observation can then be further tested to show what some of the limitations of drug sniffer dogs are (which smart criminals have done).

It also needs to be noted that where as we smell “paterns of chemicals” dogs tend to smell “individual chemicals”.

Thus the human smells pizza and the dog smells wheat, oil, whey, lactic protiens, licopiens…

This is another area where a smart criminal can investigate a dogs behaviour.

Then there is the problem of the dogs health fatigue etc and that of it’s operator. Belive it or not sniffer dogs have a very intense relationship with their operator and want very much to please they will appear to be ready for work to the casual eye even if they could not smell a ripe cheese and fresh onion filled bread roll a foot from their nose. The operator thus needs to spot if the dog is upto the job or not (thankfully most can). This makes not just the dog but the operator highly skilled and they come as a matched pair.

So there is the issue of training etc to keep the dog and operator “highly skilled”. It is complex and time intensive and may be as much as half an explosive sniffer dogs working life (less so for drug sniffing dogs).

There is another issue which is backup. A dog handler has to get close in and thus cannot be armed, they are also watching the dog more than the suspect. The team that backs up a dog handler has to be very very on the ball as they have to know and understand the handler and the dog and how it plays out. Also terrorists normally don’t operate alone (another reason to belive Cptn Underpants and Cpl Hotfoot where patsies).

Thus you need two more highly trained people who again need to be closely acossiated with the dog and handler team…

Then there is the minor issue of, you need atleast 6 working teams to cover 1 area 24*365.25. Thus the dog and the operator are rare and expensive, as well as the backup personel and thus highly desirable to outside interests (comercial sector) etc. All of which means the running costs are very very large.

Further, training and high skill levels some believe is “anathma for the TSA”. And the TSA’s own figures tend to support this. So it starts to become clear why the TSA prefers contract trainers and machines with their own selected operators that are not smart enough to see what is the reality of their training (ie pointless) in the greater scheme of things.

There are other problems which a dog and machine share.

For instance it’s a “Go / No Go” tester. It cannot tell you how much explosive is there, how it’s packaged or what type it is. Or importantly if it’s there at all.

Which is also the problem with CAM “sniffer” machines. Worse the “puffers” cannot even give a general localisation as to where a person may or may not have the chemicals about their body.

Most social drugs are not normal in the every day environment and thus the prescence at any level would indicate to most that a criminal is present (however as I noted above that is a false assumption for cocaine).

Explosives or their common components are a natural part of our environment and in some cases in very high quantities.

The dogs and the CAM machines have a problem in common in that they sense the components not the composits. Explosives are like pizza a very specific combination of very common componets with a charecteristic smell.

Thus a dog like the current CAM’s tend to indicate that individual components are present. Which is ok when the background level of those components is vanishing to nothing. But when people buy in the components and store and use them around their homes on an almost daily basis you have a real problem.

The abcensse of such components is the exception rather than the rule. Even having all the required components there is actually not an indicator of explosives.

Thus you have to look for some extra chemical signiture that says pizza not flour, tommatoes, cheese. The human unlike the dog tends to sense smell in this more sophisticated manner and a limited number of CAMs are starting to work that way.

However there is a problem there is more than one way to come up with the pizza smell as those working for food marketting agencies know.

That is you can take the main components away and just leave some of the rare signiture components and the human brain says pizza. Unfortunatly for explosives those signiture components are volatil components from the break down of the explosive and are thus like the smell of toast due to the burning process.

Thus a clever criminal will makes these combustion by products and put them around the place to falsely trigger the CAM.

The simple fact that nobody wants to own up to is that as far as explosives go CAM has gone as far as it usefully can.

That is making it either more sensitive or more specialised is not going to improve it for this particular requirment just increase it’s cost exponentialy.

What is needed is for CAM to be just an indicator nothing more. The fact that it says components of explosives are present is not an indicator that explosives are present. Or if they are they are not their for legitimate reasons (TNG spray of heart patients etc).

Oh and the final point. Not all substances have a measurable smell under normal conditions.

Fresh money has a compleatly different smell to used money dur to the initial processing smells wearing off and the amalgamation of human and other detritus that works into the fibers of the note.

What we smell is due to surface contaminates when the object has low volitility in our environment.

Some stable explosives have very low volitility in the environment humans prefere and thus may not release sufficient molecules to be detected by CAM or dog and thus like money they could only detect the volatile processing components or the surface reaction to contamnates…

All of which is compleatly pointless anyway in the working life of these sniffers be they canine or machine they will not come across a terrorist bearing an explosive they are going to detect any more than humans come into contact with moon dust.