Schneier on Security
A blog covering security and security technology.
« Friday Squid Blogging: New Book on Squid |
| U.S. Exports Terrorism Fears »
May 14, 2012
The Trouble with Airport Profiling
Why do otherwise rational people think it's a good idea to profile people at airports? Recently, neuroscientist and best-selling author Sam Harris related a story of an elderly couple being given the twice-over by the TSA, pointed out how these two were obviously not a threat, and recommended that the TSA focus on the actual threat: "Muslims, or anyone who looks like he or she could conceivably be Muslim."
This is a bad idea. It doesn’t make us any safer -- and it actually puts us all at risk.
The right way to look at security is in terms of cost-benefit trade-offs. If adding profiling to airport checkpoints allowed us to detect more threats at a lower cost, than we should implement it. If it didn't, we'd be foolish to do so. Sometimes profiling works. Consider a sheep in a meadow, happily munching on grass. When he spies a wolf, he's going to judge that individual wolf based on a bunch of assumptions related to the past behavior of its species. In short, that sheep is going to profile...and then run away. This makes perfect sense, and is why evolution produced sheep -- and other animals -- that react this way. But this sort of profiling doesn't work with humans at airports, for several reasons.
First, in the sheep's case the profile is accurate, in that all wolves are out to eat sheep. Maybe a particular wolf isn't hungry at the moment, but enough wolves are hungry enough of the time to justify the occasional false alarm. However, it isn't true that almost all Muslims are out to blow up airplanes. In fact, almost none of them are. Post 9/11, we’ve had 2 Muslim terrorists on U.S airplanes: the shoe bomber and the underwear bomber. If you assume 0.8% (that’s one estimate of the percentage of Muslim Americans) of the 630 million annual airplane fliers are Muslim and triple it to account for others who look Semitic, then the chances any profiled flier will be a Muslim terrorist is 1 in 80 million. Add the 19 9/11 terrorists -- arguably a singular event -- that number drops to 1 in 8 million. Either way, because the number of actual terrorists is so low, almost everyone selected by the profile will be innocent. This is called the "base rate fallacy," and dooms any type of broad terrorist profiling, including the TSA’s behavioral profiling.
Second, sheep can safely ignore animals that don't look like the few predators they know. On the other hand, to assume that only Arab-appearing people are terrorists is dangerously naive. Muslims are black, white, Asian, and everything else -- most Muslims are not Arab. Recent terrorists have been European, Asian, African, Hispanic, and Middle Eastern; male and female; young and old. Underwear bomber Umar Farouk Abdul Mutallab was Nigerian. Shoe bomber Richard Reid was British with a Jamaican father. One of the London subway bombers, Germaine Lindsay, was Afro-Caribbean. Dirty bomb suspect Jose Padilla was Hispanic-American. The 2002 Bali terrorists were Indonesian. Both Timothy McVeigh and the Unabomber were white Americans. The Chechen terrorists who blew up two Russian planes in 2004 were female. Focusing on a profile increases the risk that TSA agents will miss those who don't match it.
Third, wolves can't deliberately try to evade the profile. A wolf in sheep’s clothing is just a story, but humans are smart and adaptable enough to put the concept into practice. Once the TSA establishes a profile, terrorists will take steps to avoid it. The Chechens deliberately chose female suicide bombers because Russian security was less thorough with women. Al Qaeda has tried to recruit non-Muslims. And terrorists have given bombs to innocent -- and innocent-looking -- travelers. Randomized secondary screening is more effective, especially since the goal isn't to catch every plot but to create enough uncertainty that terrorists don’t even try.
And fourth, sheep don't care if they offend innocent wolves; the two species are never going to be friends. At airports, though, there is an enormous social and political cost to the millions of false alarms. Beyond the societal harms of deliberately harassing a minority group, singling out Muslims alienates the very people who are in the best position to discover and alert authorities about Muslim plots before the terrorists even get to the airport. This alone is reason enough not to profile.
I too am incensed -- but not surprised -- when the TSA singles out four-year old girls, children with cerebral palsy, pretty women, the elderly, and wheelchair users for humiliation, abuse, and sometimes theft. Any bureaucracy that processes 630 million people per year will generate stories like this. When people propose profiling, they are really asking for a security system that can apply judgment. Unfortunately, that's really hard. Rules are easier to explain and train. Zero tolerance is easier to justify and defend. Judgment requires better-educated, more expert, and much-higher-paid screeners. And the personal career risks to a TSA agent of being wrong when exercising judgment far outweigh any benefits from being sensible.
The proper reaction to screening horror stories isn't to subject only "those people" to it; it's to subject no one to it. (Can anyone even explain what hypothetical terrorist plot could successfully evade normal security, but would be discovered during secondary screening?) Invasive TSA screening is nothing more than security theater. It doesn't make us safer, and it's not worth the cost. Even more strongly, security isn't our society's only value. Do we really want the full power of government to act out our stereotypes and prejudices? Have we Americans ever done something like this and not been ashamed later? This is what we have a Constitution for: to help us live up to our values and not down to our fears.
This essay previously appeared on Forbes.com and Sam Harris's blog.
Posted on May 14, 2012 at 6:19 AM
• 85 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
It seems that El Al Airlines is pretty successful in preventing terrorist attacks using racial profiling. You would think that of any airports in the world Isreali airports would be the most threatened and yet they have few incidents of successful attacks.
@ZG: El Al doesn't do racial profiling (that would be idiotic). They have well-trained screeners and they look for *behavioral* clues. And oh, everybody gets the scrutiny.
From Wikipedia (which may not be a reliable source):
As stated by Ariel Merari, an Israeli terrorism expert, "it would be foolish not to use profiling when everyone knows that most terrorists come from certain ethnic groups. They are likely to be Muslim and young, and the potential threat justifies inconveniencing a certain ethnic group."
"This is what we have a Constitution for: to help us live up to our values and not down to our fears."
This may be the single most important thing that Bruce has ever written.
This sounds a lot like the torture debate during the Bush administration - too much talk about whether it works or not, and not enough talk about whether it's morally the right thing to do.
Well, the first question posed is "Why do otherwise rational people think it's a good idea to profile people at airports?"
The answer may be that it has the appearance of working in some pretty high profile places, like Isreal.
"This is what we have a Constitution for: to help us live up to our values and not down to our fears."
Indeed. Sadly and almost to the point of being criminal, the US Government has abdicated far too many of the values this document guarantees us.
Secondly, this same government has and continues to do its utmost to foment the fears in order to keep citizens from questioning the farcical and non-existent GWOT.
@ZG: "...El Al Airlines is pretty successful."
I would assume that some of Bruce's "Judgment requires better-educated, more expert, and much-higher-paid screeners." applies to El Al.
@ZG: Last time I checked, Israel had a rather long list of attacks committed by Israelian people. Good luck with profiling those, based on ethnic features...
rs. Randomized secondary screening is more effective, especially since the goal isn't to catch every plot but to create enough uncertainty that terrorists don’t even try
Does not work because the system can be "gamed".
The reason for this is a lack of resources and unknown peak demand for those resources.
Without going into the boring details, as a terrorist if you know screening is randomised you know it's only persudo random because you cannot have the worst case time (100% of people get 100% screaning) and meet time deadlines.
That is with a surge in passenger numbers the screening resources cannot meet the demand and thus the probability of being picked goes down. Further observation will show the maximum group size that can be picked. Thus if you know that no more than two adjacent in the que people get selected together then none for another three or four you have a working window to aim for.
But how to ensure you hit the window, well actually fairly easily, you just place a number of stoggies in the line in front of you who create a "block" on the flow. The human nature of the TSA and their rules and requlations kick in and the system ceases to be random.
Now there are ways you could deal with this but none of the methods are realy going to be possible in the current setup.
Whilst one throw of a dice might be random, there is only so fast you can through a dice before things go wrong, and "dropping a monkey wrench in the works" is almost by definition what humans specialise in...
appart from the fact there have been incidents with El Al security it is majorly different to just about every major western country.
Firstly the majority of El Al passengers are from quite a limited number of places in Israel due to the unusual demographics. Secondly many of the screeners are University students paying their way etc, therefor they originate from all over those places. Thus there is a very high probability that a passenger is going to talk to a screener who knows a lot about where they live, who they served with and a whole load of other low level every day details that would be very difficult to build a convincing "back cover" for.
Thirdly for various reasons Israel is not realy a "transport hub" compared to other countries.
There are quite a few other differences but just these alone make Israel and the Continental US more different than an orange and a grape, so you just cannot compare them in any way that is meaningfull.
We have been this numerous times on this blog and the result remains unchanged.
There is the old test that shows an idiot, form a simpleton and an imbecile from an idiot.
The Doctor puts a lit candle infront of the person being tested and puts a valuable coin in the flame. The Doctor on feeling heat offers the hot edge of the coin to the person. By the definition of the test,
A simpleton will take the coin once.
An idiot will take the coin twice or three times.
And an imbecile will keep reaching for the coin and get burnt each time.
If you come back with an asbestos argument it will be listened to but if it's crashed and burned as they have in the past...
Interesting topic that has been with me for over 30+ years. One point to mention is that the terrorist will use ALL that is available to him/her and that means taking peoples families as hostage in order to carryout any form of attack, so profiling is a false sense of security. You are absolutely correct in that people need to be trained in all layers of the security. From basic airport awareness training (should be done with all security personel) not only looking for left luggage. There are MANY experts in this field so there is no excuse for such ignorance to suspect someone by their religion or color. Bad and very dangerous mind concept in regard to security! Without getting off the subject too much, you are correct also in that the unfortunate people who have to suffer in embarrassing searches should be if proven correct, sufficiently reimbursed and those who abused their power be adequately punished. Not only that, there should also be adequate training in this profession, which makes me think of other blogs here, where training was once again none existant or of limited capacity.
While we're all busy arguing about screening, the smart terrorist will simply bribe a baggage handler or mechanic, hand them a couple of kilos of "cocaine", and collect their explosives on the other side of the checkpoint.
The only reason this hasn't happened yet is because there are very few terrorists, and even fewer smart ones. As Bruce has noted before, some screening is needed to filter out the stupid attackers. Everything else is a waste.
I'm trying to find the logic in relying on high school drop outs to use the psychological expertise required for profiling ...
What however do people think would happen if there was no profiling? I personally feel there would be more attacks. Having said that...you don't need to get to the departure lounge in order to make an effective attack.
Israel's new airport had security built in at design stage, including the access road to the terminal. The security is multi-layered with several different roles and responsibilities. The profilers, for the most part, will question people arriving and departing, not just because of the potential of an immediate threat, but to detect and deter intelligence gathering.
But as Clive says, Israel is not a hub and doesn't have a fraction of the traffic of a main international airport. It is smaller and easier to control.
As was mentioned by a previous poster, there is definitely way too much talk about racial/religious profiling WORKING or not and not enough about whether it's morally right. Even if 100% of terrorists fit into a particular racial or religious group, and even if TSA screeners could identify that group with no false negatives, subjecting the people who fit the profile to extra inconvenience is pretty morally questionable. As Bruce pointed out, security isn't our only value. And of course there are the practical problems as well. Alienating innocent Muslims is a pretty bad idea all by itself.
I'm not all that surprised that people think racial or religious profiling would actually work. It intuitively sounds reasonable, and most people don't think about things much farther than that...particularly when the intuitive solution is also an emotionally satisfying one, as this one seems to be for a lot of people. What I *AM* surprised about (but maybe I shouldn't be) is the number of people who think it's practically and morally a good thing to do even if it DID work. That's the kind of thinking that leads to internment camps like we herded all the Japanese Americans into during WWII...
The most important and widespread error that this "essay" is based on is that "profiling", the way it's supposed to be done, is based on any kind of race or religion.
Profiling works. Racial profiling doesn't. Profiling? Works. Religious profiling? Nope. Behavioral profiling is the only profiling worth even considering, and it is extremely effective when done properly. Remember that El Al once discovered a bomb in the suitcase of a female, Caucasian traveler who did not even know herself that she was carrying the bomb.
he discovery was based solely on questioning the woman, analyzing the answers and her behavior and taking action on what was discovered from that method.
Racial and religious profiling is insane. It just doesn't work. Behavioral profiling and analysis does work. The problem? El Al's system isn't at all transferrable to high-traffic airports. It just takes absolutely too long. The TSA has put it into their heads that they can train officers to "spot" a terrorist just by watching people and referencing a set profile. This is a mistake. El Al's method (the only one that really works) is really based on the premise that there is no profile. Anyone could have a bomb in their backpack, so to speak, and they find them, unerringly.
Profiling works. It just isn't possible to do it El Al style in high traffic airports. But profiling most certainly does, indeed, work.
Bruce: You have written many times about the failure of profiling, but this may be your best ever. Excellent piece!
Great article, and great community comments.
@freddie as to your 1st point, there is no profiling. If you are trying to ask what would happen if the current system wasn't in place, I would say everything was fine until 9/10/2001. The subsequent plots made it through screening, which has been proven to be just "security theater". The current system is just a show to say that the government is doing something. Congress blocks funding, training, career paths for the workers. They will not hire qualified intelligent people because the agency isn't structured to deal with them in terms of pay or career.
As to your second point, Russia demonstrated that massive damage can be inflicted outside the security screening process.
This leads to a greater question (one I have never seen adequately answered), as to why there hasn't been another attack on US soil. It has been shown and discussed for 10 years how porus and vulnerable we are, yet there as been no attack. This raises all sorts of questions about the strength of Al Qaida, and how much influence they really have, infrastructure etc..
I do agree with "This is what we have a Constitution for: to help us live up to our values and not down to our fears." It is what makes me critical of the country that I love.
@SnallaBolaget It may appear that the essay is putting up a straw man version of profiling but, as far as I'm aware, it was partly in response to Sam Harris's recent post. These try to make the case for the more flawed types of profiling you mention.
"A simpleton will take the coin once.
An idiot will take the coin twice or three times.
And an imbecile will keep reaching for the coin and get burnt each time."
So the smart person uses the candle to burn the doctor's hand. The doctor drops the coin, which cools on the table and may be picked up.
The really smart person grabs the doctor's hand and threatens to burn them with the candle unless they turn out all the change in their pocket.
I suppose the terrorist just sets fire to the doctor.
Excellent reasoning, well presented. I wish more people would read and heed it.
Lets not forget one of the purposes of department of homeland security and the TSA: intimidation and control.
The obscene standard is being set at airports and they are branching out to other travel locations (bus depots, train depots, highways). The "your papers please" aspect is being tested in Arizona, while libraries and intellectual property are also being explored, including gaining data about U.S. citizens abroad and any foreigh travelers coming to the U.S. There are even aspects to make U.S. citizens subject to laws in foreign countries (ACTA) even if one never goes to such countries. We already make foreign citizens subject to U.S. laws having extradited some of them to our country.
I often go to the end game, when there is nobody left to intimidate and control. That is where the powers that be get to turn on one another, having no common enemy left but themselves.
I think now after "Let's Roll" security, Terrorists would have a harder time if we went back to pre-911. The cockpit doors are solid and there are air marshals. In the case of one getting through, the more options the OTHER passengers have (pocket knife, can I borrow your knitting needles?) the less likely any terrorist is to get more than a few feet. Maybe they can by surprise hurt a few passengers, but it is no longer sheep and wolves, but an apex predator v.s. some animal that has a very good defense and can make the wolves attack uneconomic.
As far as "profiling", El Al's is not profiling as such - everyone goes through it. His point about any rule they set is simply something to be routed around in a terrorist attack is spot on. Woz was (and maybe still is) able to consistently get (ceramic) knives through the security.
If they came up with an "evil" detector, most senators and congressmen would have to take the train or bus.
El Al does not treat all passengers the same. I went to Israel for on a business trip some years ago, and two of us had a full-time escort from the El Al security checkpoint to the airplane... even into the bathroom. I didn't notice any of the other passengers with such an escort. (I'm a white-bread American; the other fellow looked similar.)
It was actually kind of nice to have somebody to chat with about the country I was visiting, but it wasn't a scheme that would scale.
The name of the problem in statistics or machine learning is over-fitting. Profiling is over-fitting. It's a problem in scientific modeling where there probably isn't an intelligence adversary but a huge and exploitable weakness when there is one.
I happened to be a passenger on El Al in the summer of 1973, and I later learned my specific flight was under threat of attack. I learned this only later. Along with an 8.5 hour departure delay (without explanation) from JFK, at the scheduled stop at ORY all passengers were deplaned with all carry on, and were individually screened by security, which took several additional hours. I wonder to this day if the first delay was for logistics coordination of the screening team in France.
Judgment requires better-educated, more expert, and much-higher-paid screeners. And the personal career risks to a TSA agent of being wrong when exercising judgment far outweigh any benefits from being sensible.
Although "security theatre" demands that the TSA maintain the pretense that they're a highly effective security force capable of identifying and stopping terrorists, their leadership are well aware that it's impossible to identify the extremely rare individual in the airport crowd who is carrying out a terrorist plot. So the only possible approach is to assume that everyone is a terrorist until screening presumes them innocent. That approach informs everything the TSA does. Equating security with harassment that's as intrusive and visible as possible is essential to "security theatre," but underlying it is the institutional belief that all passengers are "the enemy."
Some screeners are intelligent enough to recognize that essentially none of the thousands of people they screen each day are "enemies." They apply their judgment and common sense to interpreting the rules and restrictions. They do their job with the professional courtesy and respect for passengers that Propaganda Master Bob Burns continually insists is the standard the TSA demands of all screeners.
Unfortunately, too many screeners lack intelligence or common sense. They do their job like robots, arrogantly enforcing with zero tolerance whatever "interpretation" of the rules they decide to apply at that moment. Because they've fully internalized the institutional belief that passengers are enemies, they generate too many embarrassing "incidents" that make the news and require defensive action from the TSA.
Unfortunately, that defensive action reveals one of the TSA's many major problems. They apparently believe that "security" requires them to maintain the pretense of being infallible and incapable of any error, presumably because that would show unacceptable weakness. So when an "incident" occurs, they always stand behind the screener. Even when the screener's conduct was clearly unacceptable and outrageous, they justify the conduct and defend the screener, insisting that "proper procedures were followed." The passenger was either fully to blame for what happened, or was lying about what happened. That unvarying approach has destroyed whatever credibility the TSA has with the public. But since the public is "the enemy," there's no need for credibility. The public doesn't need to believe or trust the TSA, only to fear them.
The message the TSA sends to screeners is that they can do anything they want, even if it's incompetent, stupid, or just plain wrong. If a passenger gets upset enough to complain, they know their leadership will always back them up and justify their conduct. Pretending to be infallible is part of the TSA's "security theatre." But it also reflects the institutional belief that it's entirely fine-- and perhaps even a sign of "good security"-- if passengers (i.e., "the enemy") feel upset, abused, and even humiliated after their encounter with the TSA.
That's the only possible explanation for what I've observed. And I find the very concept of a government agency waging war on the public far more frightening than terrorism.
@Clive ... sometimes its fun to watch the Dr's reaction as you reach for the coin again.
I don't think the base rate fallacy argument is very strong. The pro-profiling people generally aren't arguing for sending every Muslim who tries to get on a plane to prison; they're arguing for making it more likely they get a secondary screening. At present, in theory, everybody gets an equal chance to be screened by the TSA. If we could guarantee that every terrorist has blue eyes, I wouldn't have a problem getting extra screening when I flew. The alternative is randomly harassing the 85% of the population we know can't be terrorists just to bother everyone equally.
The second and third points are the reason it makes no sense. Even if we only excluded elderly couples and people with preschoolers, that tells would-be terrorists that they need to recruit and/or stick their materiel on elderly couples and people with preschoolers.
I agree that random sampling is better, though I do wish TSA sampling was actually random. I'm almost certain that a thorough observation of sampling patterns of TSA employees (particularly if you follow a specific screener) will find patterns of undersampling, with some employees to the point of not sampling some set of characteristics at all. Humans have always been bad at "random". If we're going to randomly sample, the metal detector should have an RNG to pick who gets secondary screening. I also agree that a lot of the current secondary screening is total theater and should be gotten rid of entirely (as well as most of the item restrictions).
A wolf must not be a terrorist in your history, a sheep acting suicide surely will be a terrorist because no one in their specie will suspect from she. So it will be a lot more difficult to distinguish a terrorist sheep than a wolf. We human beings surely will run away from a lion.
"Muslims, or anyone who looks like he or she could conceivably be Muslim." - isn't that everyone?
Why not write a book on your vision for airport screening - it seems like a topic for which you have endless passion and ideas.
As someone who's neither young nor Muslim (nor a terrorist) -- and yet was hassled for 2-1/2 hours by Israeli security in Tel Aviv-- methinks sometimes they do punitive screening just for the heck of it.
Bruce - Why not write a book on your vision for airport screening - it seems like a topic for which you have endless passion and ideas.
Better yet, start a petition for Bruce to be hired as Director of the TSA under the new administration. He certainly cannot do any worse (other than increasing unemployment when he fires some portion of their 58,000 employees.)
@Nobody: "As someone who's neither young nor Muslim (nor a terrorist) -- and yet was hassled for 2-1/2 hours by Israeli security in Tel Aviv"
That is because it is completely false that they use ethnic or racial profiling. The fact that you're neither young or Muslim has nothing to do with why they stopped you.
@ZG, re: As stated by Ariel Merari, an Israeli terrorism expert...
El Al doesn't racially or ethnically profile. So some 'expert' says its good idea - that doesn't mean a thing.
I don't know where you live, but as an American, I can find you a dozen policy 'experts' at my local university that no-one ever listens to.
@Nobody - yes they do profile - just try getting through Isreali security as a pharoah!
@Clive,ZG, P Friday
...Or the cheeky person intentionally grabs the coin again and again to make the doctor write down he is an imbecile..in disguise.. "check that moron off the profiling list" :)
On a more serious note good points bruce and commenters.
I think any well thought out terrorist attack on air-travel systems would begin with targeting the employees and hiring process of the TSA. It would be an operation spanning different sectors of the "air-travel experience" (check-in, baggage screeners, airport security, management, etc.). If people aren't necessarily fit for security and underpaid, that is a gaping hole in security. It would take years to develop rapport, perhaps rise up the ranks a bit. Not a novel or easy-to-carry-out plan, but one where high emphasis should be placed, as there are currently many many new TSO jobs available...
We are not seeing attacks on the scale or frequency that makes these security-policies justifiable. I'm still waiting patiently on "the big one" that catches everyone with their pants down and will make these current procedures seem like "the good 'ole days"...
@zg - that is presumably why El-Al secuirty wouldn't pay much attention to a five-month pregnant Irishwoman ( Anne-Marie Murphy)
Well, the first thing you do as a sheep, is make sure that there are A LOT of other sheep around, thereby greatly lowering your personal risk. This is exactly what a herd is. And it is exactly what the situation today is-- if we reverted to pre 9-11 security levels, sufficient to screen out the stupid and impulsive, given the VAST numbers of people flying, we would all be much much safer from terrorists on airplanes than we are from drunks driving down our own street.
Arguing about which level of security is effective is kind of like wondering whether or not you should buy tidal wave insurance in Kansas. Absolute security is impossible, and anything beyond minimal has staggering cost-benefit & diminishing returns problems.
And of course the ultimate question is, why would a terrorist want to attack a plane? Once you understand that, you become FAR better able to assess the actual risks. But that is a Topic that Shall Not Be Raised.
"Absolute security is impossible, and anything beyond minimal has staggering cost-benefit & diminishing returns problems."
Yep. Which is why I like Bruce's idea of putting additional funding into services such as police that can yield benefits when terrorists do NOT strike. But can also help when terrorists DO strike.
"And of course the ultimate question is, why would a terrorist want to attack a plane?"
With a bomb? Because it is the easiest way to take out some Americans on American soil. But only if the terrorist got on the plane outside of the USofA.
If the terrorist has to negotiate airport security inside the USofA that is a different issue. And at that point it would probably be easier for the terrorist to start a random shooting spree in a city. Or to drive a car bomb into the airport. Or bribe a TSA person to let the "drugs" past. Or a thousand other options. All of which could be ameliorated or mitigated by having additional spending on police and such.
Regardless of whether El Al's techniques are or are not effective at detecting and blocking potential terrorists, it seems to me that the tactics and strategies employed by Israel, in general, cannot be seen as anything other than a dismal failure in achieving peace and security for the population. As has been pointed out, it's not a particularly good example for our situation in the US. And if it is a good example, maybe it's an example of what NOT to do.
If terrorists want to disrupt travel they will blow up a busy security line with a suicide bomber who looks like everyone else. End of travel industry.
I would rather not travel where passengers or bags are screened, and yet I want to be safe. Profiling on the basis of race, age, gender and nationality seems irrational. However, I wonder about religious profiling that enables the followers of a given ideology to be segregated from persons of another given ideology. Would it necessarily be "living down to our fears", or would rational religious profiling become the agent of positive change in that community, and therefore outweigh the negatives? As I understand it, it is unConstitutional to discriminate against a religious group whose ideology has no direct bearing upon its behavior, but it is not clear to me that it is unConsitutional to discriminate against a religious group whose members have demonstrated a notorious danger and whose ideology, which is identifiable through religious profiling, appears to cause that dangerous behavior.
Absolutely splendid essay that should be a mandatory read for anyone involved in airport security. This is the kind of stuff for which I keep coming back to this blog.
Personally, I believe that efficient, behavioural profiling can be a useful control in a defense-in-depth approach, but given the history of the TSA it is far more likely to be turned into an expensive travesty as they have done with most of their security theatre. It has already been argued on several occasions here that El Al profiling does not scale well to the US. That is of course unless the military-security-industrial complex can convince US Congress to fork out even more tax dollars at the expense of healthcare, welfare and education budgets.
OT @ Clive
The Greek approach to the coin problem would probably be to smooth talk the doctor into lending him the coin and then have him burn his fingers on it.
I think you could argue that the base rate fallacy is still important because even if the legal consequences to being singled out in airport security aren't very high, there are still social consequences to suggesting innocent people could be terrorists based on their skin color, facial features or religion.
Extra screening at random might make you mad at the TSA, but extra screening because you're in the wrong ethnic/religious group separates you from the rest of society based on a trait that has caused a lot of division in the past and continues to do so today. Screening based on some other trait like "blue eyes" just doesn't feel the same, either to those being pulled aside or those watching.
Imagine going through airport security where you (assuming you don't fit the profile) just breeze through. And off to the side, in a roped off area, you see the TSA giving more intensive screening to people who look like they're Muslim. I can't imagine such a scenario wouldn't feel pretty humiliating for the people pulled aside, and I also can't imagine it wouldn't damage the social relationship between the people who fit the profile and those who don't. Separating society into "us" and "them" is rarely a good idea.
The problem with profiling based on religion is it assumes you can tell someone's religion by looking at them. But religion exists only in your head. You can no more tell someone's religion by looking at them than you can tell their favorite color.
You can ask someone their religion, but if it's clear that everyone who answer's "Muslim" gets stopped, no one will answer "Muslim".
So you end up profiling based on skin color, accent, nationality, etc.
"Even if 100% of terrorists
fit into a particular racial or religious group," race = human.
"and even if TSA screeners could identify a group
with no false negatives," = those found on being searched to have bombs.
"subjecting the people who fit the profile to extra inconvenience
is pretty morally questionable."
Amost Everyone wants a personal argument exemption.
Does anyone bother with reasoning anymore?
Bruce is largely right about Security Theater,
but suipport with weak and/or false logic undermines his position.
What we all need is to rigorously articulate
sound logic in his support.
@ Peter E Retep - it's not only "morally questionable" it's incredibly efficient way of breeding terrorists.
You are constantly singled out by the police you don't go to the police for any other crime. You go to some neighbours of the same religion who will sort it out, then in return they might want you to store a package, or let some 'friends' stay with you in London, or provide an alibi for someone.
Add in a few police shootings of people who were the wrong religion and within a couple of decades you can turn an ancient religous argument into a civil war.
On the positive side you do end up with an anti-terrorist squad that is even better than the Isrealis
From what one remembers, it was once mentioned at stupidsecurity(dot)com that it is harder for a person to change their race than for a group or organization to utilize persons of different races. As such, the usefulness of including race when describing a specific criminal suspect or fugitive does not mean that it is useful to include racial profiling when trying to pick unidentified criminals or terrorists out of the general public. Also, if someone is more likely to turn criminal of their own accord as opposed to being recruited by a group or organization to act criminally, profiling by gender or race might work better. For instance, there is the advice that a lost child should look for a woman with children (as opposed a man with children) or even possibly just a woman, and one can imagine persons having concerns about specifically hiring a male babysitter.
Although the plural of anecdotes is not necessarily data, there was an incident in August 1972 involving El Al and security and non-Arab threats. Two Palestinian individuals, Adnam Ali Hasham and Ahmed Zaid, gave a tape recorder to a pair of young English women who were going to travel to Israel. The women did not know that the recorder was rigged with a barometric-triggered explosive charge. As the recorder went in the womens' checked baggage, the resulting explosion was contained by the plane's armored baggage hold and the plane landed safely. (Source: One Day in September: The Full Story of the 1972 Munich Olympics Massacre and the Israeli Revenge Operation "Wrath of God" (Arcade Publishing, 2000), p. 38.) (It could be argued that being asked to carry an item by someone else is a cause for suspicion, but it is possible that such advice came about later on.)
Everyone who thinks Israeli airport security relies on racial (or ethnic) profiling, or that it ought to, should first read up about the 1972 Lod Airport massacre.
Airport profiling isn't about catching 1 in 80m terrorists, it's about selling 80m airline tickets.
There already *IS* racial profiling in US flight security, so presumably it has been shown to work.
Some nationalities need visas to fly to the USA (which leads to additional security checks, including an interview in person) and some do not.
Is there any hard evidence that this is counterproductive, in the way that Bruce's argument would suggest?
@ Peter Austin
... so presumably it has been shown to work.
This is what I call the elephant powder fallacy, Peter.
A farmer walks up to his neighbour who on a daily basis is dispersing huge quantities of a strange looking, pink powder and asks him what it is for. "To keep elephants away from my land", he replies. In utter disbelief, the farmer tells him that there are no elephants anywhere in the region. To which the neighbour replies: "I know. This is really terrific powder."
@Dr. I. Needtob Athe:
Asking whether something is morally right is often nowhere near a black-and-white issue. Asking whether something works or not is usually much closer to black-and-white. Therefore, if we can rule something out on the grounds that it doesn't work we don't have to get into a grey area argument.
"Muslims, or anyone who looks like he or she could conceivably be Muslim."
Oh man, the Balkans would really freak Mr. Harris out.
@"If terrorists want to ..."
What terrorists want is to cause the United States to spend so much money and piss so many citizens off that they have to change their political policies.
To that end they are still milking 9/11 and succeeding beyond their wildest dreams at "administrative jiu-jitsu"; ie causing us to use our own money against ourselves.
At the current rate of intelligence drift they wont need another attack on US soil for probably 15 more years and will still be bleeding us dry the entire time without lifting a finger.
The biggest threat the TSA is to AQ is to cause them to injure themselves through laughing too hard at our antics.
@Christopher: Don't the metal detectors at the US have such an RNG? The ones here in Germany do (at least the most common model). If you walk through them and quickly look back,you will see your "score" (one to three green asterisks -- fine -- or four red asterisks -- pat-down), or in case the RNG hit you, "QUOT" -- for a pat-down.
That way you know it wasn't (necessarily) your fault for forgetting some piece of metal in your pocket.
Perv scanners are not used here as a field-test in Hamburg has found them to be useless.
I think you overlook one point, which is not the central point of Sam Harris' narrative, but very much follows from his writing and is an important one.
If you enumerate the number of children who can very safely be determined to be non-Muslim, it will be a large percentage of children passing through security every day. The name and identity of his or her parents who are accompanying the child gives a huge discriminatory signal. Similarly, if you enumerate the number of physically disabled people and older women who are most clearly non-Muslim (color of skin, features, plus name on identification) passing through security, you are bound to find the number is an appreciable majority. It makes no sense to screen these people beyond the basic non-nudie-machine hand luggage screening and obvious metal-object-carried-on-person detection.
For a start, we can reduce the number of people put through this extensive screening procedure greatly. Once this starts happening, the security personnel can make exceptions for people not in those groups based on judgement and behavior.
No system can be perfect. This approach introduces both enough theater and enough basic screening all around that it will save huge amounts of money and resources while not being any worse. It is too much to expect a digital change to pre 9-11 security in the secure areas of airports, and this explicitly discriminatory system gets the best of both worlds: paranoid, non-highly-analytical satiated-by-security-theater on one hand and the Muslims-asked-for-it-and-need-to-deal-with-it Sam Harris and me types on the other.
This could be a transitionary step towards what you suggest.
Israel can not use racial profiling, even if it wanted to. The average Palestinian terrorist looks and acts pretty much like the average Israeli. They're all Semites, and a good portion of Israeli Jews are descended from those living in Arab countries. Not to mention all the Israeli Arabs who are also citizens.
The only way it could profile would be not inspecting foreign looking people as closely, and they won't make that mistake again.
I enjoyed reading this article, and the comments that followed. Thank you.
Here's an observation: A good chunk of the TSA workforce are multi-ethnic. At oen point, I could have sworn that 90% of the ones I came across at this one airport (would rather not say) were Ethiopian. While many Ethiopians/Eriterians are not Muslims, they fit the "profile."
Now here's my question: What if a Muslim who cleared all background checks wanted to be a TSA agent? I'm baffled by the whole notion of being afraid of what one doesn't know; but I don't want to get preachy here. But seriously ... go and learn about Islam. Don't just listen to the media. Islam & Muslims will always be under attack. They hold the key to the start of all civilizations as we know it. And they are at the heart of the World geographically. And most of all, they control the World's wealth (oil). Of course, they're going to be under attack. I guarantee you if that part of the World was all that religion/culture would still experience the same crap.
Back to my point ... Muslim as a TSA agent. I'm going to guess that many [intelligent] individuals said "no problem." Let's go with that. What if that Muslim TSA agent was a woman who's exercising her choice to wear a Hijab (head scarf)?
Let the prejudice out. If YOU are OK with it, imagine the reactions she's likely to get to stop non-Muslims based on behavioral profiling; as it was suggested by many.
Let's take this farther a bit ...
How is a Muslim TSA woman agent with a Hijab on doing her job wanting to inspect a nun (I want you to imagine this at an airport in the South) different from a white biker all-tattooed-up white TSA man doing his job wanting to inspect a Muslim woman wearing her Hijab? Don't imagine a physical inspection, but the scrutiny, questioning and/or inquiry itself.
What's my point? It's out prejudice wrapped tightly in ignorance that's causing a problem. Combine all that with a hint of foreign policy positions/stands we take and we're going to be attacked by those of equal intelligence (or lack thereof).
I almost think of it as dumbass on dumbass war. Unfortunately, many of the rest of us are caught in the cross fire.
Correction to last post ...
I guarantee you if that part of the World was [insert religion of choice], all that area's now that religion & culture would still experience the same crap.
Sam Harris and Bruce Schneier are two of my favorite writers, so a debate between them is a very large treat. Bruce nails it here. Screenings must be random, because that is the only method which cannot be gamed by attackers. It's analogous to creating a one-time pad for encryption.
Sam Harris is a great writer and thinker, but he seems obsessed by the threat one religion poses, not the overall threats irrational behaviors of all kinds pose. And proper threat assessment is Bruce's area of expertise, as we all know.
I thank both of them for having this discussion in public for us.
. Screenings must be random, because that is the only method which cannot be gamed by attackers.
Sorry but that's not true.
All practical random systems can be gamed due to bias and constraints, which gives rise to the question of the resources required to game the system and the benifit derived.
The constraints on an airline checkin are the closure time of the departure gate and the available screening resources and the time it takes to screen an individual through each one.
Screening resources are finite in number and take a certain minimum time to process an individual this provides a basic threashold of passenger numbers that can fully randomly be dealt with.
The threshold is fairly easy to work out as it's the throughput at 100% screening thuss if you have five machines and it takes two minutes to process each person five people can be fully screened in two minutes or one person every 24 seconds. At a rate higher than this some people can not be screened, the greater the rate the larger the number of people who cannot be screened.
There is a time based deadline by which the passengers must be screened otherwise the flight will not take off (there is the requirment that checked luggage must have the passenger on the flight to prevent other types of terrorism).
Thus there is a finite time between lugage being checked and the passengers being checked for the flight to happen.
The resources for checking passengers are very very expensive and are thus rationed to a point chosen by the checking authorities concerned. The minimum resource level to work would be that of 100% passenger checking at the rate of full passenger occupancy on all the flights leaving in the given time frame of airport operation.
You thus have two conflicting requirments, the airport and airline operators make profit by large passenger flows thus having high numbers of plane departures. The checking authorities want to minimise expenditure on expensive resources.
The result at best is "critical resourcing" more normal is "under resourcing".
Now the airport has busy and quiet times so at busy times the checking system is going to be very much under resourced.
This means it is not possible to 100% check all passengers therefore a finite number must go un checked. Thus a fully random system which can only work with critical or above resourcing is not going to work. The more under resourced it is the more determanistic in nature it becomes thus the easier it is to game.
One way to game the system is to pick a time to travel when way above average passengers are expected (thanksgiving / christmas) then throw a monky wrench in the system by creating extra delays in the que. By having two or three "stogies" (accomplices) ahead of the bomb carrier causing significant blocking of the resources the bomb carrier gets a very increased probability of getting through un checked. This works because the checking authorities cannot have more than a very tiny number of people missing their flights because the whole system would colapse as airplanes have to have luggage removed etc.
The question then becomes how many resources (stogies) does the terrorist need to use to increase the odds to near certainty of being unchecked?
We know from 9/11 they had planed for four teams of five people or 20 people willing to die on aircraft that day.
Thus it could be argued that 20 more could be found to die on a single plane flying within the US and that this would be sufficient to game the system to get one bomb carrier through.
Only we can be reasonably certain there are not that many suicied terrorists available in the US currently because they would have attacked by now.
In fact it could also be reasonably argued that if there were suicide bombers available in the US they would be waisting their effort to attack planes they would get better returns on blowing them selves up in city metros etc because this would cause the cry for TSA style screaning to be put in metro stations. The result obviously would be more devistating than an increase in airport screening. New York for instance would come to a stand still as there is probably not the "sidewalk" space to allow everybody to walk to work...
Most Caucasians are Muslim (Chechnya is the caucasian heartland). Caucasians are people from the Caucaus mountains and this is how the term is used in most of the world (including and most definitely, Russia, who have huge ethnic fights with Caucasians).
Secondly, the average American has no clue as to race, and is much more ignorant of say the different races in Europe, then the Europeans themselves. Moving on to the middle east, Moving on, "Indo" refers to India and even within India, the Aryans of India (all 600 million of them in the North) are entirely different, racially, than the 500 million or so Dravidians in South India. Semites are entirely different than Indo-European people and Semites can be Christian, Muslim or Jewish.
The average American is totally lost and cannot tell the difference between any of these groups, so racial profiling, even if it was the best idea in the word, is totally doomed. It is ridiculous in a country like the USA which doesn't have any deep seated racial boundaries like the rest of the world and a complete inability to identify people from various races, let alone a blonde lebanese woman (christian, muslim?), blue eyed caucasian muslim, green eyed afghan muslim or a darker looking Indo-European hindu.
Just read Sam Harris' post.
It is extremely telling that Sam Harris associates "dark skinned" with Muslim. Really!
That goes to show how ignorant about any racial categorization he really is. He's even got a picture of an old woman (as an example of who *not* to racially profile) who could easily be a Muslim from one of over 20 counties, including the balkans, lebanon, turkey, chechnya, russian, afghanistan, etc.
One last post on this topic, that says it all:
China has more Muslims than Syria, while Russia is home to more Muslims than Jordan and Libya combined.
Your claims are mostly based on the number of random screenings being large enough to exhaust the capacity of the screening system. There's no need to screen that many travelers, especially if the persons so screened are truly at random. That's the reason public opinion polls are very accurate, despite sampling a minute fraction of the electorate.
As for the rest of your claims:
"We know from 9/11 they had planed for four teams of five people or 20 people willing to die on aircraft that day."
They had also planned on the non-response of the other passengers, because that is what airline passengers (at least those of us in the US) had been told to do: do not resist, let the authorities handle it. That assumption is no longer valid, and everyone knows it.
"Thus it could be argued that 20 more could be found to die on a single plane flying within the US and that this would be sufficient to game the system to get one bomb carrier through."
While I disagree with your claim here, I ask you to perform the combinatorial analysis for having 20 (!) terrorists aboard an airplane the size of a Boeing 767 (or Airbus A330). How many random screenings would it take to find a terrorist in that case? Not many.
They had also planned on the non-response of the other passengers... ...That assumption is no longer valid, and everyone knows it.
And is compleatly irrelevant to the argument as is,
I ask you to perform the combinatorial analysis for having 20(!) terrorists... ...How many random screenings would it take to find a terrorist in that case?
Perhaps I did not make it clear,
The purpose of the (19) stogies is to do nothing more than to engineer the position of the bomb carrier in the que by gaming the system in various ways. They don't carry weapons or explosives or anything else that would pull them up as terrorists.
They game the system by silly things such as having a small coin forgoton in a back pocket or a chewing gum wrapper in their jacket pocket, by being slow tripping up or falling over by being rude complaining or argumentitive etc or even starting an argument / fight in the que.
It does not matter if they don't make the flight there sole purpose is to put a monkey wrench in the system to get the sole bomb carrier through the check point without being enhanced screened. and they do this by playing on the TSA's known behavioural responses.
As I said in my first post to you,
"All practical random systems can be gamed due to bias and constraints, which gives rise to the question of the resources required to game the system and the benifit derived".
From the terrorist point of view the "benifit derived" is getting a single bomb carrier through the checkin without being searched in a way that will reveal the bomb parts. The "resources required" are the number of stogies to achive that.
The hard part is working out the best time to have tickets for, how many stogies are needed and the methodology by which they are applied to the process of gaming the que to identify where slots will occur and how to time their disruptive behaviour to achive the "benifit".
Process and JIT designers have done quite a bit of assessment and theory on 'feeder stock" issues on ques relating to mechanical and chemical production and assembly and packaging of items from sub assemblies and component parts in a "just in time" system. The idea being primarily to minimise "on hand" stock costs.
Likewise there has been research done on "scheaduling" in "Real Time OS's" and this shows some very nonlinear results come up frequently and become critical and then at fault very very rapidly. One finding is the closer you get to full utilisation the more likely you are to get serious fails. The solution in RTOS's is usually to well over resource, that is have "normal loading" be less than one third of availab£llllllllllllllllllllllllllllllllll spare capacity for normal
Sorry about the abrupt and odd end of my previous post to you above, it was not intended the phone I use does this occasional when I'm traveling in and out of poor signal areas or the keyboard driver takes a walk in the park.
So to backup a little and continue,
The solution in RTOS's is usually to well over resource, that is to have "normal loading" be less than one third of available system capacity in critical systems. That is spare capacity for normal operation is twice that of used capacity. This is seen as gross over specifing in just about every other field of endevor as the costs are ludicrously high and it appears to be grossely inefficient.
Why is it over specified well it's to deal with "random" behaviour of the inputs to the RTOS, if the inputs arive in a certain order in a certain time frame then the system cannot deal with the load and a critical input is missed and does not get responded to when it should. This is not the sort of thing you want in say your cars brakes and as the CPU/memory resources have near negligable cost compared to the rest of the system significant over resourcing is a negligable cost.
However we also know it happens in real life we see it happening all the time in the medical proffession. Mostly it gives rise to people with canncer and the like being seen to late and thus becoming terminal, but we also see it where patients get left on trollies in corridors and sometimes die of neglect. Not because the doctors and nurses are incompetent or callous but because they don't have the reesources to deal with cases in a timely fashion (it's something I'm accutly aware of because it very nearly killed me back in 2000).
Now as I've already said the TSA don't criticaly resource for normal loading they under resourse badly, this means that their systems regularly fail to function in a way that would support a truely random selection process. Thus the process ceases to be random and starts to be determanistic, it only looks random to a casual observer because different people take slightly different periods of time going through the various screening methods. What happens is only one person in ten can be fully screened, and the person who gets selected is the next person in the que not a random person from the next ten people at the head of the que. As Bruce has admitted in the past he has become quite adept at avoiding the scanners, and he is not the only high mileage passenger to do this, either conciously or sub conciously he is "gaming the system".
Thus at some point of overloading the system the determanistic pattern will become sufficiently easily visable and at which point it's game over for security.
An intelligently adversary (terrorist or smuggler) will be able to use the stogies to keep the pattern in place sufficiently long to ensure the carrier (of the bomb or contraband) gets through minimal screening.
We have actually seen this and worse happen with the TSA, there have been one or two reported cases of passengers who have triggered the detectors disappearing into the crowd air side because of other disturbances in the que side.
The chances are if two people started arguing, shoving or even fighting the TSA screeners would be "human" and become spectators or protagonists to the argument, thus another person could probably just walk through minimal screening without the TSA being aware they had. And as such would have bypassed any "random selection" process...
But the thing is a carrier does not of necessity need many (if any) cognizant stogies, they can "snow the system" with innocent and unknowing people. As an example the carrier has a single accomplice who quietly goes around the area of where the que end is covertly sparaying people with a week solution of drugs or nitrates etc as the people join the que. The result is the detectors start to show a lot of positives and the process starts to block. If done the right way then the overload on the insufficient resources will cause ordinary human responses from the TSA staff at which point you are back to pre 9/11 screening at best...
With regards this "out of place activity" of the sparyer is not easily seen by humans with short attention spans. However it has the same or sufficiently simillar charecteristics as a pick pocket or other type of criminal on platforms etc of public transsport and various systems have been designed and some tested to spot the re-occuring face in the crowd and then track it (mind you I've heard very little on the results of the tests which suggests they were not what was hoped for).
"Why do otherwise rational people think it's a good idea to profile people at airports?"
Because most people, even rational ones, want simple answers.
The context for Harris's views on racial profiling of Muslims is Harris's toxic opinions on preemptive nuclear bombing of Muslims, torturing Muslims, being at war with Islam, and Islam being the world's greatest threat, and so forth.
Harris's own words, in context:
We are at war with Islam. It may not serve our immediate foreign policy objectives for our political leaders to openly acknowledge this fact, but it is unambiguously so. —The End of Faith, p. 109
there is no set of beliefs … more imperiling of the future than the beliefs of martyrdom or jihad in the Muslim world which are central to the doctrine of Islam. —http://www.youtube.com/watch?v=j0pxN0DuMAE
I am one of the few people I know of who has argued in print that torture may be an ethical necessity in our war on terror.
Given what many of us believe about the exigencies of our war on terrorism, the practice of torture, in certain circumstances, would seem to be not only permissible, but necessary. —The End of Faith, p. 199
There is little possibility of our having a cold war with an Islamist regime armed regime … What will we do if an Islamist regime, which grows dewy-eyed at the mere mention of paradise, ever acquires long-range nuclear weaponry? If history is any guide, we will not be sure about where the offending warheads are or what their state of readiness is, and so we will be unable to rely on targeted, conventional weapons to destroy them. In such a situation, the only thing likely to ensure our survival may be a nuclear first strike of our own. Needless to say, this would be an unthinkable crime—as it would kill tens of millions of innocent civilians in a single day—but it may be the only course of action available to us, given what Islamists believe.
Whenever confronted with the irrationality of his arguments, Harris has back away from the controversy, but not his own words. Racial profiling will be no different. Though it is commendable that Harris gave Bruce an opportunity to respond at his own site, if Harris's past history is any guide, Harris cannot be expected to change his mind no matter what Bruce's arguments are.
What else can one conclude that Harris is a willfully ignorant and hateful bigot?
"The right way to look at security is in terms of cost-benefit trade-offs."
While this statement holds good in a general context, this discussion is specifically about the security of human life. A few thoughts..
1) Human life is perceived to have the highest level of importance to justify 'zero threat tolerance'. This probably explains the paranoia behind the need to protect it 'at all costs', specifically in the context of the transportation sector where it makes big news. All trade-offs are therefore insignicant.
2) An alternative risk assessment model for the protection of human life will always be ignored unless there is a change in the perception of the value of human life.. I don't think that's going to happen any time soon..
3) No government agency, particularly the TSA, is going to risk being seen as not doing 'everything they can' to protect human life. While their protective measures may amount to being 'security theatre', my guess is they will have to be seen as striving for 'absolute security'.. I sincerely doubt there will ever be a directive that accepts the ocassional loss of human lives in favour of reduced costs of protection.
The risk of not catching a terrorist, if 'randomized secondary screening' is approved, will be considered way too high to justify implementing that model.
Have I misunderstood this in anyway?
"1) Human life is perceived to have the highest level of importance to justify 'zero threat tolerance'. This probably explains the paranoia behind the need to protect it 'at all costs', specifically in the context of the transportation sector where it makes big news. All trade-offs are therefore insignicant."
No, that is incorrect. To take a specific example *from*the*transportation*sector*, improvements to roads in many nations are in part explicitly decided on the basis of the number of lives saved, where each life is costed at so many thousands (or hundred of thousands) of dollars per life. If the dollar value of the lives saved exceeds the costs of the roading improvement, the project gets a tick. If the value and cost are about even it might get a tick. If the costs are far in excess of the savings, it probably won't go ahead.
Which makes sense.
If there are three possible projects which will each cost about the same but you can only afford to fund one of them, which do you choose? The one that'll save one life, the one that'll save 10 lives, or the one that'll save 100 lives?
In this life-saving decision the cost-benefit isn't insignificant, it is *everything*.
I'd like to second what @James said a few dozen comments above. I'd love to know what I, a common traveler, would experience if Bruce were in charge of airport security. What would I experience and why?
I'd also like to have a discussion about Mayor Bloomberg's defense of the stop and frisk policies in NY. Is that more like El Al security (applying the stop and frisk in a limited area where there is a high probability of crime) or is it security theatre? Crime is down in NY, does that justify frisking 700,000 people?
@ anti-inertia: you hit the nail on the neck, but very close to the head :)
I propose that dice are introduced as part of airport security. Each traveller rolls a standard D20 and if it comes up 20 they get searched.
I was recently invited by my airline to join the TSA's Pre-Check program. As a frequent traveler and as a loather of anything that impedes my rapid progression through an airport, I immediately enrolled. Ever since then, I have *every single time* been Pre-Check cleared at my home airport, and at all other airports where my airline participates.
The warning that I "will not always be cleared" appears to be yet another example of security theater, perhaps to lower my expectations. Well, my experience has so far proven otherwise.
Furthermore, it's completely silly to impose the notion of randomness on a person like myself who's been determined not to be a risk. If I wasn't a risk when I departed three days ago, I remain not a risk when I'm returning home. I should enjoy Pre-Check everywhere, all the time. To believe anything else ignores reality.
Bruce, your ideas and writings have influenced my career in many ways. But in this specific instance, I must disagree with you. My IDS, my IPS, and my firewall do not randomly select individual datagrams for enhanced screening. They look for patterns. Pattern matching is imperfect, but it works most of the time. Sam Harris is on the right side of this argument: pattern matching is the only way to make aviation security work. You often allude that the science of security applies regardless of what the object of protection is. So why in this particular instance do you deviate from your own positions?
Maybe I should've been more specific about the context being 'human lives lost in an airline incident'. I guess what I'm trying to say is that a cost-benefit analysis which potentially lets a terrorist through the gates, which will therefore lead to a loss of human lives, will never see the light of day.
Hypothetically, if an airplane incident kills all 200 people on board, could this absolute number not be achieved on other mass transport systems? Trains, buses, ships etc.. Is an incident necessary for society to snap forward and demand paranoid TSA type checks for each of these mass transport systems?
Is it possible that we place too much premium on human lives lost in an airplane incident? Could we lower the perceived value of human life or equate the risk of air travel to other forms of mass transportation?
Pattern matching from an IT perspective is much easier that human behaviour.. My reasoning is that in the IT world, with just a few logged events (correlated) you have enough data to suggest a possible pattern.. The prediction models have obviously been tuned with enough events to justify a probable pattern.. However, human behaviour being so unpredictable (innumerable variables to factor) and the number of sample events being so few, the prediction models are infantile at best.. This is not to say that we should stop the effort, but it's early days still and the common air traveller is the guinea pig being used to improve the model..
The argument, I suppose, is that given hindsight and experience, could we slow down and think about how this should be done and implement a well thought out mechanism instead of jumping into action and implementing a poorly thought out mechanism. This brings us back to Cost-benefit tradeoffs. If the poorly implemented mechanism is capable of preventing/detecting all incidents, regardless of the cost, would society prefer to have this in place while the intellectuals work out a well thought out mechanism which will produce the same outcome, but at a lower cost?
My hypothesis is that society will bicker, but will happily cough up to support a zero incident solution, even though it's not the most elegant or best thought out..
So another view that was provided to me on this topic is that society is significantly interested in trying to prevent 'spectacular' incidents and those that 'media tends to dig its fangs into'.. and the fact that air travel incidents tend to be super spectacular is what's driving TSA to implement badly thought out zero-incident solutions..
How does this view add to the whole cost-benefit tradeoff discussion?
Don't take this as criticism.
I agree TSA is security theater and should be abolished. However, any manager that you approach with a proposal that eliminates a bad solution will respond, 'Okay then, what do we replace it with?"
Like the Net, competent adversaries exist. They want to blow up planes and kill Westerners. They don't respect life in the traditional Judeo-Christian manner. We, as security people, must combat the real threat. So tell me - how?
Screen Muslims? You're right - won't work - too many people, too much time, money etc. Like IDS, too easy to evade.
Mandatory military training for all American citizens? Might work - be a lot more challenging to take over a plane loaded with passengers trained in hand to hand combat etc. Still might lose a few plane loads of people
Enforce existing immigration laws? Don't hold your breath - at least not with this administration.
You're a smart guy - sure, let's all get behind Rand Paul and kick the lame TSA screeners to the curb (and increase the unemployment rate by half a percent). I'm all in.
Now, what do we replace them with?
How does 630 million * 0.8% * 3 = 80 million? And if it's absurd to catch one among 15 million, it's dramatically more absurd you'll catch one among 630 million.
The base fallacy rate doesn't go up because you profile; it goes down.
Profiling doesn't mean to ignore others, but to provide a way to winnow the large pool to a more managable size.
The fact you say you can't profile "Muslims" is fine and no doubt true. You wouldn't always know. But young males are more criminally minded in general. Was the underwear bomber really hard to detect: young male, traveling alone with no luggage and a one-way ticket. Better check on grandma instead! Seriously?
@ David Wall,
But young males are more criminally minded in general. Was the underwear bomber really hard to detect: young male, traveling alone with no luggage and a one-way ticket. Better check on grandma instead! Seriously?
The real problem is "what you are testing" we are not talking about finding defects in tins of beans, which in theory are all made the same way, but humans. Who are all not only made differently they also unlike the tins of beans have the freedom to behave differently. That is a tin of beans cannot "chose" to look like a tin of carrots, but a human can "chose" if they wish to look how they please. So they can stop behaving in the way used by the testers for the profiling and behave in a different way.
The problem with profiling is, in effect it is based on statistical information from past behaviour either real or perceived. This perceived behaviour is only used by the tester because at some point in the past somebody who did not understand what they were doing decided it was the way to go...
Humans if they have to, will always be able to game the system, it's true not just of profiling but random security checks and CCTV or any other "static" security technique.
That is they will always end up failing against a test subject that can evolve in some way, irrespective of initial success.
We see this with CCTV systems initialy they work and criminals get arrested in high numbers. Then the "honeymoon period" ends with the smart criminals evolving their crimanal techniques to negate the advantage the CCTV gives the authorities. The less smart ones just move to another area and carry on in the same old way untill they run out of areas without CCTV. The stupid ones carry on the same old way in the same place and end up having their wings clipped in some way, untill they either wise up or die out.So on mass we see a fairly normal "under damped first order" response to a step change.
However nearly all terrorist acts can be divided into two types "one offs" such as 9/11 and "repeats" such as roadside IEDs. Reactive security systems are generaly of no use against "one offs" and only of limited benifit against some "repeats".
All static and quite a few dynamic security systems are "reactive" and thus will generaly fail with time. Reactive systems are basically "feed back systems" and in most cases (negative feedback) tend to be stable as they return to "zero". Non reactive or "predictive" systems are basically "feed forward" the problem with predictive systems are that they are inherantly unstable irespective of if the feed forward is negative or positive and except in very well bounded and known cases tend to "crash the rails/end stops".
As we have seen with "profiling" when you try to deal with rare cases that evolve you go from a reactive system to a predictive systems and errors get amplified quite quickly and you get them "crashing into the rails" with people "kicking back" with provable claims of "racism" etc.
With all control systems you also have to consider "delay" or "response time" it is fairly easy to realise that the systems the DHS-TSA employ have a very slow response time. Now consider the terrorist "one off" they usually have a very rapid response time thus they end up as a fast control loop within a slow control loop. They will thus always "self correct" much faster thus appear "normal" within the slower loop...
The result is they can "test the system" in various harmless ways and work out the DHS-TSA control loop conditions and stay within them.
We actually saw this with 9/11 where they tested and found out the only penalty for carrying box cutters was they were confiscated, but would normaly get through...
Provided terrorists can "game the system" and they normaly can (because they have "choice" and it's a simple "numbers game") then you cannot beat them with the sort of systems the DHS-TSA will put in place...
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.