Schneier on Security
A blog covering security and security technology.
« Surviving a Terrorist's Nuclear Attack |
| Me on Airport Security »
January 14, 2011
Loaded Gun Slips Past TSA
I'm not really worried about mistakes like this. Sure, a gun slips through occasionally, and a knife slips through even more often. (I'm sure the TSA doesn't catch 100% of all bombs in tests, either.) But these items are caught by the TSA often enough, and when the TSA does catch someone, they're going to call the police and totally ruin his day. A terrorist can't build a plot around succeeding.
It's things like liquids that are the real problem. Because there are no consequences to trying -- the bottle of water just gets thrown into the trash -- a terrorist can repeatedly try until he succeeds in slipping it through.
I asked then-TSA Administrator Kip Hawley about this in 2007. He didn't answer.
Posted on January 14, 2011 at 11:03 AM
• 36 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
He answers the question; it just isn't very convincing:
"...we have begun using hand-held devices that can recognize threat liquids through factory-sealed containers (we will increase their number through the rest of the year) and we have different test strips that are effective when a bottle is opened. Right now, we're using them on exempt items like medicines, as well as undeclared liquids TSOs find in bags. This will help close the vulnerability and strengthen the deterrent."
And based on what he says immediately before this quote, he seems to be suggest that they give you a bad day if they get a positive in just the same way as they would if you had a gun or a knife.
However, everything he says seems to boil down magical technologies that are impractical to implement. So the bottle of liquid just gets thrown into the trash.
Making the detection of contraband liquids have consequences beyond throwing the container in the trash would be impractical. The fact that the screeners currently put (supposedly-dangerous) liquids in ordinary trash cans, to accumulate in full view of and proximity to screeners and the public, reflects the reality that effectively all "voluntarily abandoned" liquids are completely innocuous. Subjecting passengers who violate the restrictions to anything more than "voluntary abandonment" would create a level of hassle unacceptable even to an agency that defines security as synonymous with intrusive hassle. It would also provide no benefit to actual security.
Liquids are probably a real threat, though most likely not enough of a threat to justify all the difficulties the TSA's "War on Liquids" causes millions of people every day. That puts the TSA in an impossible situation. They need to wage the "War," and to continually insist that the associated restrictions are necessary to protect us from a horrible threat. Backing down at this point would undermine their entire security theatre production, based as it is on demonstrating their commitment to reacting decisively after a threat occurs.
But as even the TSA bloggers admit, the "War on Liquids" is probably the biggest "pain point" for passengers. And those trash cans, along with the inconsistent enforcement and "interpretation" of the restrictions, are surely a major contributor to the low credibility and respect much of the traveling public have for the agency (and particularly for the "War on Liquids").
The TSA has apparently decided to address all these problems by ignoring and denying them. If they respond at all to questions or complaints about liquids, it's with the same claims that it's all justified by classified information and tests. And they attribute the lack of credibility to an ignorant and ungrateful public that has failed in its duty to have blind unquestioning faith in any government agency with "Security" in its name.
I'm sure Blogger Bob and his fellow propagandists are hard at work putting the appropriate spin on this latest embarrassment.
Only problem with that is that liquid explosives are almost wholly useless as a terrorist weapon.
One thing I was thinking of was about the red-team exercises. These are professionals, likely, and run no real risk of getting into trouble for smuggling a fake bomb through a TSA checkpoint. How does that measure up to a wet-behind-the-ears 20 year old Al Qaida or Hamas operative, who is very likely doing this for the first time? To me, it seems to put a lot of emphasis on the technical side of the checkpoint, and too little on the individual skills possessed by the TSA personnel on site.
In a world where we would be much better served by skillful, well-motivated screeners doing good old fashioned detective work, it seems that these tests focus too much on the technology, which we already know can be woefully inadequate, even in proficient hands, and not enough on a good pair of eyes and some deductive reasoning.
How much panic would one produce if one would create a fairly innocent, small explosion in the garbage container with discarded liquids?
How hard is it to create a bang and some smoke?
Tell me about it.
I pack five or six tubes of toothpaste when I fly through Colorado so I can be sure I will have at least one when I get to my hotel.
No consequence other than the cost of doing business travel.
Not sure why Colorado is so fixated on toothpaste. No other airports have given me any trouble. I mean Grand Junction Airport was the most proud out of any place I have ever been about taking my tubes. They literally held up one tube and showed it to everyone and then made a grand (junction?) gesture of throwing it with a big arc into the trash.
I try to explain why I'm not violating the rule, but they won't accept any discussion. That and they say things like "I can see by lookin' at you that you don't carry no razor or shave cream in there, ha ha ha".
I'd guess bubba hasn't heard of how the money to provide the Nobel Prize was made....
This is all so bogus! 10 terrorists w/ 3 3oz bottles of liquid explosive disguised as toiletries in their 1qt baggie to be scanned. That's 90oz of liquid high explosive. Now, once through security, they purchase a few large bottles of water, empty the water, fill with the HE, and you have 4-6 very destructive bombs. All that is missing is the detonators, but there are ways to get those through security as well.
So, what does all this security theater buy us? Safer flying? I think not. Trouble for terrorists? Not so much I think. Big buck$ in the pocket of unethical scanner manufacturers? Absolutely!
A couple of times in the past few years, I have accidentally carried throwing knives through security, on to and off of planes. Its shocking to be unpacking at your destination and find something like that in your bag and realize that the security scanning process completely missed it. I resolved to be more careful when packing, and in particular, to search all pockets and compartments of my bags and make sure they are empty *before* starting to pack other stuff into it.
I have personally, accidentally, carried a knife through ATL airport and onto a plane. I didn't know the knife was in my bag until it was found on my return trip from DBN to ATL. I am totally not surprised at the TSA's effectiveness. :(
Notice that the person who's gun made it through was a law abiding American citizen, not a terrorist. TSA's effectiveness at catching liquids, knives, guns, and ruining someones day is moot. Their effectiveness at catching terrorists is what should be debated. They suck at catching terrorists, excel at ruining folks days, and their methods and organization should be eliminated.
Should the question be reproposed to Pistole?
"But these items are caught by the TSA often enough, and when the TSA does catch someone, they're going to call the police and totally ruin his day. A terrorist can't build a plot around succeeding."
This isn't true at all. The TSA seems able to catch - again, except in some cases - a fully assembled firearm which was not being deliberately concealed - by definition since the citizen involved was NOT a terrorist.
We have ZERO statistics on how many times a terrorist - or even some other criminal NOT intent on using the gun or knife on the plane - has actually been able to smuggle a disassembled or otherwise deliberately concealed weapon on a plane. The only statistic we know is that it hasn't been successfully used to attack a plane HERE since 9/11.
What about ceramic knives? Do we KNOW how many times the TSA has missed those?
I remember ex-Navy SEAL Richard Marcinko revealing to his superiors that he traveled on a plane with brass knuckles, knives and God knows what - albeit this was before 9/11. A professional trained in smuggling techniques probably knows very well how to get a weapon on a plane if they have to.
Also, given the problem with badges in an earlier post, how unlikely is it that someone with a fake Federal Air Marshall's badge gets a gun on a plane?
Finally - here, throw my bottle of nitroglycerine with the lid holding friction sensitive explosive in the trash can, please. And while you're all ducking and covering, my associates behind me in the line will just whip out their P90's and clean all your clocks. By the time backup arrives, fifty people will be dead, and we'll be across town enjoying cocktails.
Rinse and repeat at ten more airports to shut down air travel across the US indefinitely until the National Guard can be deployed at each and every airport in the country.
Then shift to the Amtrak train stations.
"Security"? You don't have any.
The good guys outnumber the terrorists several million to one, yes?
So why not set up a screening system where passengers are essentially screening each other?
The systems would have to be more complex to allow for preventing conspiracy to get through the system and/or abuses, and a two person rule would have to be implemented, plus some online training for all participants and uniformed fully backgrounded supervisors to keep an eye on the processes.
Who is going to do a better job at starting at the X-ray machine? A bored person doing it every day for eight hours a day, or an eager and inexperienced person constantly asking "Is that one? Is that one?" For that matter, set up the displays so that passengers before and after the passenger being screened can see the display. This puts more eyeballs on the problem.
Passengers could 'opt out' and go through the slower but fully TSA-manned line, if it really bothers them for other passengers to see their underwear.
We already have people acting as their own cashier in the self checkout lanes. How different is this, really?
Why do you go to so much trouble to transport full-size tubes of toothpaste to your hotel?
Why not just fill your "Quart plastic bag" with as many 3 oz tubes as you can?
You can forget about the ceramic knives. There are numerous plastic compounds which if correctly molded and pre-stressed will form a flat plastic sheet suitable as a bottom liner for a carry-on bag yet will snap cleanly and reliably with a razor sharp edge. Add another equally innocuous-seeming thing or even a handkerchief as a handle and you have quite a fine shiv.
But this makes little difference in the era of the locked cockpit. The next wave of air terror will focus on attacking the avionics perhaps with an EMP device, or disabling the cockpit personnel with an airborne poison which can be introduced around the cockpit door.
Yes, good point but they were 100ml tubes of "Hapee Explosive Menthol Red".
I was told the 100ml were over the 3oz rule, so they were confiscated. I wrote it off as a rounding error. It could also have been the name.
Davi: You might have better luck getting the "complete plus whitening" through. I can imagine the look on the TSA agent's face as he sees a tube of "Explosive Menthol Red" coming through. I'd venture to say the "mandarin Orange Blast" wouldn't fare too well either. :)
In related news, what of the Jet Blue pilot who misplaced his bag with a gun and a passenger accidently mistook it for his?
While it would be difficult for someone to form a plot around this, remember one of the number one bag warnings is to never take your hand off it or let it out of your sight, since someone could swipe it from you. Perhaps pilots with guns isn't such a hot idea, unless you can ensure they will all maintain proper control of their weapon at all times. Otherwise someone could follow pilots around to see if they get "lucky".
Janet Napolitano on the embarrassingly poor "Red Team" study results and the
airports that failed:
"Many of them are very old and out of date and there were all kinds of methodology issues with them. Let's set those aside," she said on "State of the Union" on CNN. "We pick up more contraband with the new procedures and the new machinery."
So the top official overseeing the TSA disregards their own objective data, and follows it up with a completely unsupported statement, and no one calls her on it. The alleged journalists at CNN were unable to think of any follow up questions in response, such as:
1. Would you care to give details on how the test methodologies were flawed and how the flaws have been corrected in subsequent tests? Has there been any subsequent testing?
2. If the methodologies of these studies are flawed and the results will be discarded, why is money being spent on them?
3. Now that airports with out of date equipment have been identified, what, specifically has been done to improve those airports?
4. If we set aside tests that measure screening effectiveness, what evidence do you have for your second statement regarding increased effectiveness of the new equipment? You have "set aside" the data you would compare the new methods to.
But no, the highest officials in this country are allowed to present blatant intellectual dishonesty and no one in the media bats an eye.
Even worse, does that mean all one has to do to get a gun through is use a "flawed methodology". Her remark deserves a nationwide face palm. It doesnt matter what the methodology used, if an attacker gets a gun through THEY GET THE FREAKIN GUN THROUGH! I'm sure this was true about every head of this dept but Napolitano needs to resign with her head bowed in shame. Every statement in response to vulnerabilities and rights issues have been one clusters
f*** after another.
Having just been through this...
We were on a trip this holiday season, from Tampa to San Diego.
Outbound, they took a long look at my contact lens solutions (one plain saline, one 3% H2O2. Allergan Oxysept). They used some sort of scanner on both bottles, smiled and sent me on my way.
On the return trip we waited through a >1 hr line (SAN sucks. period.) and got to the scanning part again. This time, they got a hit (on *both* bottles), and decided they had to test with a test strip. No idea what they are looking for. Both bottles turned the strips blue. At that point, we were asked to have a seat. (That's something you *never* want to hear.) Then they had to get the *one* guy in the entire San Diego airport who could clear us.
He shows up (flight - 15 minutes) looks at everything, takes some pictures with his handy Nikon P+S (really sweet holster he has), and tells us he'll let us go (but the liquids don't fly). We just made the plane.
Huh? One of those bottles had nothing but salt water in it. And if 3% H2O2 won't fly, what about the scan in Tampa?
I feel so much safer now.
According to a "TSA Sanction Guidelines" document from 2004 ( http://www.tsa.gov/assets/pdf/... ), it appears that different categories of prohibited items are subject to somewhat different penalties. There is an Executive Travel SkyGuide article ( http://www.eskyguide.com/articles/200402/... ) which also talks about the issue. In particular, firearms and high explosives lead to to civil penalties and a "criminal referral." Other weapons (including sharp and/or club-like items) are subject to smaller civil penalties (US$250-US$1,5000) and there is no mention of a criminal referral. (Less significant explosives such as fireworks, flares, and gunpowder (in a volume no greater than 10 ounces) appear to be treated in a similar manner to non-firearm weapons.) From what is implied, the actual penalty for an offense may also be affected by other factors. Also, the mentioned penalties may be merely guidelines (as opposed to mandates.)
Make the person with the bottle take a drink before it is disposed of. I'm guessing that explosives are not good for you.
"Outbound, they took a long look at my contact lens solutions (one plain saline, one 3% H2O2. Allergan Oxysept). They used some sort of scanner on both bottles, smiled and sent me on my way."
I've experienced that chemical test too. I don't know the details.
Short of stripping everyone naked, providing them with orange jumpsuits and sneekers, then banning all carry-on items except for their wallets and boarding pass, there is just no way to obtain full security at the passenger level. It could be argued that some parts of the general public would even accept that, but probably not enough to prevent the industry from being ruined. Which IMHO is the only reason why the idea is not being actively pursued. It would be far more efficient and also much cheaper than what we are seeing today.
For all practical purposes, it's deterring only the most stupid of terrorists at best, but at the expense of being a gigantic nuisance for all travellers while in the meantime not even being able to ensure a 100% detection rate of loaded guns passing through. That's a joke, really.
You'd leave them their wallets? What are you some sort of Commie Liberal?
Airline security has denigrated into a particularly vile joke. Government throws millions at questionable risks while millions of real holes remain.
Making the whole matter even more entertaining is security's complete lack of common sense. Consider this story (out of Calgary, Canada), in which a four year old girl was horribly mistreated by CATSA!
Heavens knows that tired four year olds are a serious threat to their parents' sanity, though I somewhat doubt they make effective terrorists. ;-)
I wish it were that simple. Typically, I'm being considered a left-wing libertarian in the US. In China and India, I'm a subvert. Over here, most people think of me as leaning to the right of the political spectrum. It's confusing at best, while all I'm actually trying to achieve is making a cool impression on the really cute Polish girls at our local pub. I really should be focussing more on French poetry and my bass guitar than bothering with security issues.
One thing I have learned recently is that terms like "liberal" "conservative" and "libertarian" in the US mean very different things than I would have thought.
As a result, I have given up trying to understand political labels...
I'm more concerned about this bit at the bottom of the first page:
"According to one report, undercover TSA agents testing security at a Newark airport terminal on one day in 2006 found that TSA screeners failed to detect concealed bombs and guns 20 out of 22 times. A 2007 government audit leaked to USA Today revealed that undercover agents were successful slipping simulated explosives and bomb parts through Los Angeles's LAX airport in 50 out of 70 attempts, and at Chicago's O'Hare airport agents made 75 attempts and succeeded in getting through undetected 45 times."
I've read similar numbers elsewhere and even claims that some (unnamed) major airports have failure rates as high as 100% in audits.
Considering how much money keeps getting spent on plugging the ever-growing number of gaps in the TSA system, I am shocked and angry that the burden placed by TSA is acceptable given these dismal numbers.
I'm with edgarj on this. When they're missing 20 out of 22, that's not 'occasionally'.
And consider: Present-day hijackers are thinking it's the end of their life as they knew it anyhow. Whether they get to be in heaven with houris or a cell with a thug is more up to fate than anything else.
They're trying to do an impossible job they've been assigned as well as they can do it, which ultimately isn't too well. The numbers are so unfavorable for them (less than one passenger screening per billion is a terrorist trying to slip a bomb onto the plane), the range of possible weapons so large, and the time and resources available for the screening so limited (if you took five minutes per passenger on average, air travel would grind to a halt and all the airlines would go bankrupt).
The real post-9/11 requirement is that we make sure nobody is ever again able to take over an airplane and crash it into something. Re-enforcing the cockpit door, having fighter jets ready to escort the plane (and shoot it down if necessary), arming the pilots--all those probably make it almost impossible in practice to repeat the novel and most destructive bit of 9/11. Probably the no-fly list helps a little here, as it makes it harder to get a team of hijackers all on the plane, though the attacker can certainly have all his team fly a few times before the attack to find out if they're on the list. But I suspect the extra post-9/11 screening has no real effect on this threat.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.