Schneier on Security
A blog covering security and security technology.
« NIST Announces SHA-3 Finalists (Skein is One of Them) |
| Friday Squid Blogging: Glowing Squid »
December 10, 2010
New TSA Security Test
I experienced a new TSA security check at Phoenix Airport last Thursday. The agent took my over-three-ounce bottle of saline, put a drop of it on a white cardboard strip, and then put a drop of another liquid on top of that. Nothing changed color, and she let me go.
Anyone know what the test is, and what it's testing for?
Posted on December 10, 2010 at 2:11 PM
• 72 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Hydrogen peroxide. They seem to have escalated their attack on 3% concentration hydrogen peroxide; for the same reason they are banning Clear Care contact lens solution, even if the bottle size is 3.4 oz or smaller.
Here's an exchange on the TSA blog in which Blogger Bob does not answer the question directly, and his answer is disturbingly arrogant and condescending:
Poster's question: What issues does TSA have with "Clear Care" brand contact lens solution?
The TSO's response: The answer is on the label of the product. Take a moment and read it.
They've done a similar test on my prescription anti-inflamatory gel (voltaren gel)
I don't know. A few weeks ago they tested both my multipurpose solution and my disinfecting solutions when I went through. The disinfecting solution tested positive for whatever it was they were testing for. The supervisor was called over. He told me that it failed and that I could either take it back to my car or they would throw it out for me. Wow. If something failing a chemical test doesn't warrant further investigation, what does?
Testing for booze?
I was recently thinking that a 'saline' bottle filled with gin would make my Xmas flight a little easier.
They are making sure nobody has tried to date rape you with Rohypnol, or GHB, or that somebody hasn't spiked your 'saline' with viagra.
Yes, it's hydrogen peroxide, and it's not a new test. I ran into this 2+ years ago flying out of El Paso. I was attempting to use the exemption to carry on my contact solution (Clear Care, as the previous poster mentioned). They did the test strip, it went pink, they took the bottle. Interestingly, I had several fights with the TSA about carrying on contact solution (all 2-4 years ago), and this was the only time I encountered the test strips.
After a while I gave up on trying to carry the solution legitimately and started putting it into smaller unlabeled bottles. Clearly a security win for TSA. That's great if they're going to start testing the
Seriously - what can you possibly do with 3% hydrogen peroxide? I'm this diluted stuff is completely useless for any sort of dangerous chemical reaction.
I have a feeling the TSA is going to wind up as the worst government act in my life. Is there any indication that this is anything other than more theater, just "CSI" theater instead of "Edward Penishands" theater?
I live in Phoenix. PLEASE tell me I didn't miss you speaking in Phoenix.
I think it means you're not pregnant
"I live in Phoenix. PLEASE tell me I didn't miss you speaking in Phoenix."
It was a BT customer event.
"I think it means you're not pregnant."
Good, because I would hate to be carrying the TSA's baby.
If they're only testing the large bottles, at least it feels respectably within limits. I think "you can bring an oversized bottle of saline along, but we may make you test it, and throw it out if it doesn't pass our test" is pretty darn reasonable. (Similar to the programming rule: make the 90% easy and the 10% possible). The only thing I'd like is if they explained the test better (same question you're having)
Perhaps they're getting gun-shy after the porno-scanner revolt, and actually thinking the rules through.
On the other hand, this could be an extremely effective test. If I were a *really* smart TSA agent, I would do get a Machine That Goes Ping, and use it to 'test' random stuff (e.g., place a random bag every now and then in the Machine That Goes Ping. Brilliantly effective at confusing Stupid Terrorists (tm).
Then again, this *would* require smarts.
Then again, this might be the very point behind the new scanner. Put something not very effective out there, confuse people, *and* make a bunch-a money for scanner-makers.
Isn't this a classic case of false-positive/false-negative in testing?
I mean, you could test everyone's hands for explosives residue and then detain for further investigation those that come up positive. You could do this at a "secure" event, like a political speech or rally. The problem is that anyone who has handled a firearm, ammunition, fireworks or a hundred other things will come up as a "positive" even when they don't have anything dangerous on them even though they're somewhere they could possibly want to endanger others. And, if the government did this, it would be an obvious 4th amendment violation, since the false positive rate means there isn't an articulable suspicion, right? How is this any different?
TSA should test for STDs after they probe you.
"TSA should test for STDs after they probe you."
I think they should be tested BEFORE they probe you.
RE: Clear Care
Certainly the two things you would need to test for are hydrogen peroxide and nitrogen-based compounds such as nitric acid, nitroglycerin, nitro methane, etc.
I'm not convinced that the color indicator drop test is for hydrogen peroxide. According to the thread at http://blog.tsa.gov/2010/05/... , the FIDO "sniffer" picks up hydrogen peroxide. (I imagine FIDO picks up nitrogen compounds, too.). The TSA rep specifically said however that if FIDO alarms on Clear Care, it should pass the TSA's other liquids test. That would indicate to me that the other test is more likely for nitrogen compounds.
In addition, I was subject to a "swab test" one time at an airport. This test involved rubbing a cotton-looking pad on the handle of my carry-on and then placing a drop of liquid indicator solution on the pad. During friendly banter the TSA agent told me that the test detected nitrogen-compounds and worked by changing color. He also said that the test sometimes false alarmed if the passenger had recently handled fertilizer.
None of this is conclusive, but it is more likely that the test Bruce is asking about detects nitrogen compounds, or possibly (but to me less likely), its a combined nitrogen and hydrogen peroxide test that only responds to peroxide at high concentrations.
My bags got swabbed and the swap placed into some machine flying out of OKC in 2003. Came back clean, which was a little alarming since I was flying home from artillery school where I had spent the last month handling high explosives every day.
The only person who can make a dangerous product starting with 3% hydrogen peroxide is a sorcerer. Since magic isn't real, no such person exists.
The TSA worry is that one can make an explosive out of 6% hydrogen peroxide, hexamethylenetetramine solid fuel tablets, and citric acid. The worry is foolish, because the process requires refrigeration (to get precipitation in less than 12 hours), filtration, and drying. (How would a terrorist dry the precipitate on an airplane?) Once dried, the powder is a weak explosive. To bring down an airliner, the powder would have to be put into some type of shaped-charge container, rigged with a detonator, and placed against an especially vulnerable spot on the plane. It is unlikely that a top chemist/explosives expert could manage this on an 18 hour flight.
Clinton has sought some of your DNA.
I was always under the impression he was more of a donor ...
"... I was flying home from artillery school where I had spent the last month handling high explosives every day."
The test is only for explosives (you know, the stuff that Bad People use).
In Artillery School they only use Freedom Chemicals that joyfully liberate energy in the fight against Evil.
They're actually not testing for anything. It's just a sham, complete with occasional confiscations of random bottles. It's meant to convince the public that the TSA is providing thorough, effective protection against unspecified threats by testing for unspecified dangerous substances.
As with everything else the TSA does, the secrecy, arbitrariness, and random frustration of innocent travelers are key to the effectiveness of this layer. Besides enhancing public confidence in the TSA, it may have an unspecified deterrent effect on terrorists.
I imagine even if the operation couldn't be completed in the timespan of a single flight, it could be completed on the sterile side of the checkpoint by handing the project off between travelers if necessary.
I wonder how long one could keep a handicap stall in a bathroom occupied before arousing suspicion? Or perhaps in a closed area of the terminal that is under renovation.
Much of the time in the process you are describing is just waiting time. One person could set it up, let it sit, and it could be picked up where they left off 12 hours later.
Granted this is far fetched and even if this is a serious threat, scanning 3 oz bottles for low concentration of hydrogen peroxide certainly isn't an efficient solution.
I can guarantee you that those strips are sensitive to hydrogen peroxide, and I can guarantee you that they're sensitive enough to trigger on 3% contact solution. (They may be sensitive to other things in addition) I ran into this at least 2 years ago and my contact solution made the strip change color.
Of course, even though I had supposedly been caught trying to bring something they considered dangerous onto the plane, they just threw it away and sent me on my way. Clearly it couldn't have been much of a threat.
I have to believe that their trace detector swab machines could detect hydrogen peroxide. That seems like a much more effective test, and it would be capable of discriminating between regular 3% peroxide and more concentrated versions that you could (theoretically) cause trouble with.
Am I going to have to get a doctor's note now just to carry my contact solution onto a plane? Sheesh.
I believe what you're referring to is called FIDO by ICx Technologies & initially was done in a few locations; however, it was expanded.
This article is from 22MAY2007.
I assume they are not testing for anything. I went flying around 12 hours after firing a rifle from my carry on bag (using it as a rest to stabilize it). The bag was slightly gunpowdery /smelling/ at close range.
The pad wiping test thingy was done on it, pretty thoroughly (I was right there), which is supposed to check for explosives, specifically including gunpowder for those old-school mad bombers, came back negative. Um... how? I presume because it's useless.
Makes me feel safer.
When they test solutions, do they use a single-use sterile dropper? If not, then wouldn't you need to throw it away anyway (who knows what they dipped it in before)?
If all they do with it is throw it away, then it's not dangerous to begin with. What's the point of this exercise?
fROM THE LINK "technology capable of screening sealed bottled liquids for explosives"
If they're taking samples, it's not sealed container testing.
What is it about the TSA and CPAP (continuous positive airway pressure) machines? They always pull mine out and give it the swab test. What do they think they are looking for?
Phoenix airport, you say? Probably testing for illegal Mexicans.
This is far fetched, but someone who works on the secure side of the terminal (in one of the many restaurants perhaps) could potentially use the kitchen of a closed restaurant to combine and cook up explosives from ingredients brought through security in small quantities. Then fill a large carry-on bag with it. You can put anything you want in your bag within the terminal, and nobody knows about it (I've brought on booze this way). Then again, if kitchen workers are involved, who's to say that they don't swap a bag of frozen mashed potatoes for a bag of PETN?
The only way to eliminate all threats is to anesthetize all passengers and handle them as cargo.
And despite all the screening:
N.C. teen’s body probably fell from jet
“It appears more likely than not that Mr. Tisdale was able to breach airport security and hide in the wheel well of a commercial jet airliner without being detected by airport security,’’ Keating [Norfolk District Attorney and U.S. Representative Elect] said during a press conference....“There is great concern that with all of our efforts for security and the almost invasive type of efforts that are occurring right now, that something like this could happen,’’
Hey Hoober, its only gunpowder before is fired, after fireing, its not even explosive any more,
They are really seaching for people smuggling liquid concentrat reboneulators, like extenze cialis or boneiva
> its only gunpowder before is fired, after fireing, its not even explosive any more
Well, yes and no. There are traces of stuff that looks chemically like explosives after burning gunpowder of any kind. Besides, firing a gun doesn't burn 100% of the powder and 0.1% residue can be enough to trigger a sensitive detector.
Besides that, I like your second theory better. :-)
I'm sorry, I'm a middle aged woman who can't always remember what necessary liquids I have in my purse when I travel. I'm sure I always have a small bottle of eye drops and some lens cleaner, maybe some lipgloss and some hand cleanser as well. I have forgotten to take them out on recent flights, I just plain forgot. I didn't have any problem at the security check point, I wasn't guilty of anything and I didn't get hassled.
@ Steven Hoober
A friend of mine had a similar experience with a cased rifle. He's a police officer and was returning home from firearms training. The case was swabbed, with negative results.
"Wow, you must have cleaned it really well"
"No, I came right to the airport from the range. I didn't clean the rifle"
A supervisor was called. He swabbed the rifle's magazine. Again, the test came out negative.
My friend was sent on his way as the supervisor got out the analyzer's manual and began a recalibration.
So contact lens solution is a forbidden thing to carry...
I wonder would linen oil be allowed in those under 3.4 oz containers? :)
"What is it about the TSA and CPAP (continuou positive airway pressure) machines?"
Have you ever picked it u pa and thought "WTF do they put in CPAPs to make them so heavy?"
A CPAP usually has a big lump of metal in it either as a "dead weight" or as a "big old iron transformer" and a handfull of electro-mechanical components and a microprocessor controler with battery backed up memory.
The weight is there to stop the CPAP sliding of the bedside table and smashing on the floor when you turn over in your sleep. Which is a quite reasonable design choice. Especialy when you consider those with built in nebulisers (water and mains electricity tend not to mix to well when accidentaly mixed in a device falling and breaking).
Now consider a CPAP and making and hiding a nail bomb or other kinetic energy weapon (which unlike plain old explosive realy does do serious damage at considerable range from an explosion...
I could go on to describe the detailed advantages of a CPAP in this respect but after a little thought you might think of a few yourself.
None : Clinton has sought some of your DNA
I propose we use a variation of a technique popular in Salem around the 1690s.
Set fire to the passenger.
If they explode, then they're a witch^Wterrorist.
If they simply burn then they were innocent and their ashes can safely be loaded on the plane.
I think the test is trying to mix the right combination of your contact lens solution with their super-detergent that removes the hot dog grease stains these goons drip in the airport food-court during their terrorism "strategery" meetings.
>Good, because I would hate to be carrying the TSA's baby.
Luckily you can't get pregnant from being buggered by the TSA. If you could, the US would be experiencing a major baby boom.
>The problem is that anyone who has handled a firearm, ammunition, fireworks
>or a hundred other things will come up as a "positive" even when they don't have
>anything dangerous on them even though they're somewhere they could possibly
>want to endanger others.
I've always been tempted to dress in maintenance overalls (to look like a cleaner) and spray nitromethane (used in high-performance model engines) onto plastic seats in airport lounges and then stand back and watch as their explosives scanners get hit with a 100% false positive rate.
I think it was the "cool test." Surprisingly you passed. :-) When they did it to me, the agent simply said, "Says here you ain't cool."
It was the Schneier's identity test.
No color = you are Bruce Schneier.
Any color = you are not Bruce Schneier.
No, it was the "Not Bruce Schneier" identity test. Everyone knows Bruce Schneier is undetectable, so they look for someone who isn't there.
Refers to revelations that the State Department has been trying to obtain DNA profiles of UN members.
It's not just in the US. I had my toothpaste similarly tested flying out of London a couple of years ago (I think it was Gatwick, but could have been Heathrow, I forget).
Cepacol is pretty much the same color as gold tequila and is available in carry on, checked luggage and sea cruise sizes.
The TSA may be frustratingly wacko, but I have to wonder why so many here would rather talk big than write to the TSA or Congress, or just stay quiet and quietly thwart the stupidity.
How many of you actually put your stuff in plastic bags??? I think that is just crazy. You want my stuff, find it and id it.
My sister in law had a really bad experience a year ago--she had just bought some very expensive Mary Kay products and then been forced to fly because of a death in our family--the TSA threw her stuff away. Costly Costly issue, we've never forgotten what it pained her. She was not a frequent flyer. I know her well, I can vouch for her that she wasn't carrying a bomb. Good thing we got rid of her expensive skin creams though, God knows what would have happened if a simple woman from Georgia had been able to fly with her skin creams to Arizona.
They keep this up, and we'll all start doubting security in the US.
How screwed up does it have to get before we fight back?
Fuck you, I'm packing skin cream.
You're more likely to be wrongly killed by the police than you are by a terrorist.
In 10 years we've had 3,000 Americans killed by terrorism and 450,000 killed by auto accidents.
PS - more children die from pools than from guns.
In light of recent events, the probability of carrying the TSA's baby is pretty good. First it's the groping, then one thing leads to another.....
@Fluids folks, I have written to my Congressman and Senators. The form letters I got back invariably defended the TSA and basically told me that I needed to be a good sheep and accept the "security."
The problem is that members of Congress are even more sheepish than the public, since they're deathly afraid that their opponents in the next election will exploit any action on the issue as "weak on security." Their self-preservation instincts require them to defend the TSA and keep handing them blank checks to run an unaccountable bureaucracy.
That's why I think we're stuck with a secretive, unaccountable TSA empowered to do whatever it wants. There might have been an opportunity in the early days when Bush, Cheney, and Ashcroft were designing the DHS. But it's too late now. Any attempt to control them or hold them accountable would require a Congressional majority willing to sacrifice their careers for the good of the country. And unless Messiah arrives and commands them to do that, it's just not going to happen.
The unfortunate and now immutable reality is that if you choose to fly, you choose to surrender your rights, privacy, and basic human dignity and submit to whatever pointless and humiliating security theatre the TSA chooses to inflict at that moment. The only available recourse is refusing to fly. Unfortunately, that's often not a practical option.
@George: While I am sympathetic to the logic of your statement, I flatly refuse to accept its defeatist conclusions. If we frame our letters to members of Congress and the airlines and the USTA and the hotels so that we present them with sound logical and emotional (necessary to convince many people) arguments, we are doing our due diligence to maintain our vigilance and our liberty. But we have to give them ideas for ways that they can show leadership and propose alternatives without being tarred with the "soft on terror" moniker. Criticizing the TSA's procedures is necessary but not sufficient; they have to hear options that they see as feasible.
No need to smuggle liquor in other containers. I just take airline bottles, put them in the clear zip-loc with the other liquids, and put it through the xray under a coat or something to be more discreet. I don't think they care, and I'm not sure it's even disallowed. You aren't allowed to drink in public but if you're over 21 I don't think there's any law against carrying sealed bottles with you is there? Anyhow I have passed layovers in this manner.
Okay, points taken. But like ikkinetic says, it's horrible to just give in to the decay of our culture and future.
Most of us with a pulse and a mind can't give up that easily.
So what's next? Protests at the Airport? Protests on the Mall?
I actually am too modest to do this, but I was so angry about the scanners/patdowns during Thanksgiving that I considered wearing something that I could pull off completely, like a kind of 'naked' protest, knowing it would shock everyone in sight, and hopefully the poor TSA groper as well.
I didn't want an $11,000 fine for disrupting air travel. :) and I felt cowed too, into following rules, however stupid.
So what can we do, if Congress is painfully lame and unable to represent us? I think writing and protesting and voting(?) are our only options. Both writing and protesting have changed history before.
Keep writing, and post their dumb form responses online. What do the Cables say?
Thanks for your response.
I think they weren't testing for anything. It's just a ploy to scare "induhviduals" out of the line for further investigation.
Nah, nah.. You guys have got it all wrong. The peroxide test is just a cover; what they're actually doing is an ancient form of divination. (Didn't you guys see the TSA job posting last year calling for high priests of black magic?)
They take two drops of fluid - one which has been blessed by the seer, and the other must be any fluid which has some association with the person being scrutinized.
The skilled seer combines these two liquids and stares into the mixture to know your entire past, present and future.
And, of course, I can always bring white solid carbamide peroxide, which can substitute for H2O2 in most reactions.
Most liquids that can be held in by plastic film can be stored in 90% of a saline squeeze bottle, with a flexible barrier heat-sealed to the bottle and a small amount of regular saline on top for the TSA to squeeze out and test. It would be fun to try that with genuine high-test peroxide.
It's fun theater, guys, but there's a difference between appearance and reality: we keep coming up against the fact that your sets are only painted on one side.
@Eric and others:
After you land, stop by the screening line at the destination airport and see if they'll let you have one of the many bottles of Clear Care that they have confiscated. It'll be like Blue Rhino gas canisters... drop one off when you leave, and pick a new one up when you arrive.
Nitrates are old school. And fertilizer and angina meds spoof them.
Organic Peroxides are the new wave. Acne meds spoof them.
At rocket-fuel concentrations, 90% and above, peroxide and anything (eg sawdust) is explosive. Check the patents. You can gel this with a few percent of standard gellling agents.
Chlorates are pretty cool too.
Folks in glass empires shouldn't fly drones.
@majorvariola What do you mean by "Folks in glass empires shouldn't fly drones" I've seen that in a few places but i don't understand what it means
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.