Schneier on Security
A blog covering security and security technology.
« Sensible Security from New Zealand |
| Phishing by Cell Phone »
December 6, 2004
Airline Security and the TSA
Recently I received this e-mail from an anonymous Transportation Security Association employee -- those are the guys that screen you at airports -- about something I wrote about airline security:
I was going through my email archives and found a link to a story. Apparently you enjoy attacking TSA, and relish in stories where others will do it for you. I work for TSA, and understand that a lot of what they do is little more than "window dressing" (your words). However, very few can argue that they are a lot more effective than the rent-a-cop agencies that were supposed to be securing the airports pre-9/11.
Specifically to the story, it has all the overtones of Urban Legend: overly emotional, details about the event but only giving names of self and "pet," overly verbose, etc. Bottom line, that the TSA screener and supervisor told our storyteller that the fish was "in no way... allowed to pass through security" is in direct violation of publicly accessible TSA policy. Fish may be unusual, but they're certainly not forbidden.
I'm disappointed, Bruce. Usually you're well researched. Your articles and books are very well documented and cross-referenced. However, when it comes to attacking TSA, you seem to take some stories at face value without verifying the facts and TSA policies. I'm also disappointed that you would popularize a story that implicitly tells people to hide their "prohibited items" from security. I have personally witnessed people get arrested for thinking they were clever in hiding something they shouldn't be carrying anyway.
For those who don't want to follow the story, it's about a college student who was told by TSA employees that she could not take her fish on the airplane for security reasons. She then smuggled the fish aboard by hiding it in her carry-on luggage. Final score: fish 1, TSA 0.
To the points in the letter:
1. You may be right that the story is an urban legend. But it did appear in a respectable newspaper, and I hope the newspaper did at least some fact-checking. I may have been overly optimistic.
2. You are certainly right that pets are allowed on board airplanes. But just because something is official TSA policy doesn't mean it's necessarily followed in the field. There have been many instances of TSA employees inventing rules. It doesn't surprise me in the least that one of them refused to allow a fish on an airplane.
3. I am happy to popularize a story that implicitly tells people to hide prohibited items from airline security. I'm even happy to explicitly tell people to hide prohibited items from airline security. A friend of mine recently figured out how to reliably sneak her needlepoint scissors through security -- they're the foldable kind, and she slips them against a loose leaf binder -- and I am pleased to publicize that. Hell, I've even explained how to fly on someone else's airline ticket and make your own knife on board an airplane [Beyond Fear, page 85].
4. I think airline passenger screening is inane. It's invasive, expensive, time-consuming, and doesn't make us safer. I think that civil disobedience is a perfectly reasonable reaction.
5. Honestly, you won't get arrested if you simply play dumb when caught. Unless, that is, you're smuggling an actual gun or bomb aboard an aircraft, in which case you probably deserve to get arrested.
Posted on December 6, 2004 at 9:15 AM
• 28 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
I find it ironic that your anonymous TSA informant says "very few can argue" that the TSA is "a lot more effective than the rent-a-cop agencies that were supposed to be securing airports".
More "effective" at what? Roughing up passengers? I agree with most that this guy, and the whole TSA initiative, is missing the point entirely.
First of all, the TSA is no shining star of consistency or even logic. I recommend reading Jay Boehmer's November 8th, 2004 article in the Business Traveller News "TSA to Allow Private Airport Screening Cos" (http://www.btnmag.com/businesstravelnews/magazine/article_display.jsp?vnu_content_id=1000707209):
"While DHS highlighted internal deficiencies that have stymied consistencies in airport security, travel managers and travelers have noted ongoing problems with screening processes."
But more to the point, the "TSA is better than before" argument is specious. It is not clear that air travel is significantly safer due TSA screening procedures. Nor is it clear that the TSA is interested in finding the MOST effective means of securing airports. Israel has always employed extremely strict security measures for their airlines, yet to my knowledge they never felt it a matter of "national security" to confiscate nail-clippers or knitting needles.
Thank you Bruce for posting your opinion on this issue.
Actually, I can argue that the TSA is no better than the private agencies that proceeded it. My source? The TSA's own inspector general.
In April, 2003, "Homeland Security Department Inspector General Clark Kent Ervin told lawmakers that the TSA screeners and privately contracted airport workers "performed about the same, which is to say, equally poorly." (From http://www.newsmax.com/archives/articles/2004/4/...
So, if few can argue the point, its because the TSA classifies its own self-assessments, not because TSA is doing any better.
> I think that civil disobedience is a perfectly reasonable reaction.
So let me see if I follow you. Anytime I find a law I don't like and can justify to myself why it's bad or dumb or annoying or whatever, I can break the law. That about right? Follow this through to it's logical conclusion and you arrive at total anarchy. Your position, Bruce, is irresponsible at best.
That's a caricature of civil disobedience, not a definition. This is well beyond the scope of my blog, but it's worth reading some of the philosophical and political literature on the topic.
I completely agree with Bruce - civil disobedience is exactly the reasonable action, and yes, any time a law (that is, a prohibition by mere edict of a non-violent act) is annoying or "whatever", you should break that law by whatever non-violent, disobedient means available. Adam, you simply feel that if a law exists, it must be obeyed -- an extremely dangerous series of beliefs that result in tryanny (see Germany's experience). Anarchy is not chaos, Bruce, though that is very commonly inferred. Anarchy simply challenges your view - that is, what right does someone have to prohibit your non-violent actions?
Thanks, Bruce, for publically reinforcing non-violent resistance to TSA and it's international copy-cats. They detract from real security issues and replace it with mush tactics that merely reduce our freedom - and that is a doubly dangerous situation - a reduction of real security traded for less freedom.
Sorry, Bruce, your name was mistakenly used in that sentence --- I meant to reference the comment to "Adam".....
"Adam, you simply feel that if a law exists, it must be obeyed -- an extremely dangerous series of beliefs that result in tryanny"
Huh? Did you mean to address James there? I simply commented that the anonymous TSA author's claim was wrong--that TSA does no better at the hand luggage screening than the rent-a-cops they replace.
Heh, the format of the website makes it hard to know which name goes with the comment. Might be good to insert a line between each comment, Bruce.
Are there reasons to disobey laws? Sure, see the founding of our country. Because it's annoying? No. If you don't like the law, work to change it.
Honestly, I've found far superior screening at courthouses than airports, both pre- and post-9/11.
On a recent international trip, I had no problem flying with both a smaller blade and non-bladed weapon (think tactical baton, though that wasn't it). With the TSA, if you're a top-tier frequent flier, you're about scot-free (short of carrying something VERY obvious, like a firearm or large combat knife).
>So let me see if I follow you. Anytime I find a law I don't like and can justify to myself why it's bad or dumb or annoying or whatever, I can break the law.
You can *always* break a law, the question is if you are willing to accept the consequences.
As a crewmember who endures "security theatre" sometimes as much as three times a day, your thoughts are a respite from the idiotic policies purporting to protect ourselves.
While, initially, the TSA was a consistent and relatively more polite form of the non-governmental foolishness of before, I see many signs where reversion, while resisted by some well-meaning TSA people, is slowly returning to the arrogant pissant status enjoyed prior to.
What I would love to see is government agents PAID to smuggle (fake) bombs on board planes. Why should it only be the bad guys who try? At least if we try we get know how we failed and design against that failure.
We'd also get the added bonus of being able to identify policies that don't have any effect and remove them from the system.
This "war on terror" is a waste of our security dollars. For every man, woman and child killed on September 11th, ten times as many died in car accidents .
Where's the multi-billion dollar road saftey campaign?
 - http://www.detnews.com/2004/commuting/0405/02/...
Bruce Schneier writes, "I think airline passenger screening is inane. It's invasive, expensive, time-consuming, and doesn't make us safer. I think that civil disobedience is a perfectly reasonable reaction."
Just so I understand you fully, you advocate no screening at all. No metal detectors, no bomb-sniffing dogs, nothing. If someone wants to smuggle a loaded gun on board, even though it may remain illegal, you would but little to nothing in his/her way. Is that what you're advocating?
There are two separate dangers to be
considered in airline security. One
is someone slipping a bomb on the
plane. But since this just kills a
group of people, no different from
a bomb in a stadium, in a church,
in a subway, etc. You don't really
want to take off your shoes and be
scanned whenever you go anywhere
there are a few hundred people in
one place, do you? There should
be no airline security related to
bomb detection, since it's not a
threat unique to airlines.
The second danger is taking control
of the plane and using it as a
weapon, as in 9/11. The best way
to prevent this is to isolate the
pilots with hardened cockpit doors,
some kind of security system they
can engage in a crisis, and perhaps
weapons of their own. A lot of
this has already been done. It's
the only part of TSA worth having
Simon, we have auditors doing just that. And apparently they are quite successful at getting the bombs and weapons past security. So successful that the results are classifed. I wrote about it here:
And Eric I., that is exactly what I advocate. It's not much different than any other large gathering of people. And since our security measures are so ineffective they only prevent the victims from defending themselves we would be better off if the victims were allowed a fighting chance. See this web page for a much more detailed view of the possible options available to us:
Regarding the posting by Mike, it's ridiculous to suggest that the only 2 "threats" related to airline security, bombing the plane and using it as a missile. Pre-9/11, I'm sure people thought there was only one, essentially destroying the plane through bomb or crashing. It's this sort of limited thinking which aided the 9/11 hijackers. This sort of mindset is also my biggest complaint about TSA security. This idea of "let's guard against box cutters and shoe bombs and we'll all be safe". Surely a bottle of wine can be easily turned into a dangerous weapon as can numerous other examples, and an jumbo can be used in a multitude of highly deadly ways.
I agree with Bruce that the best line of defense is astute agents asking the right questions. I recently flew out of Sydney and was randomly asked to have my shoes etc swabbed. What I was impressed with though was the line of non-invasive yet effective questions the agent asked me. It would have been very easy to detect if I was not legitimately doing what I purported to be.
Eric I stated...
"Just so I understand you fully, you advocate no screening at all. No metal detectors, no bomb-sniffing dogs, nothing. If someone wants to smuggle a loaded gun on board, even though it may remain illegal, you would but little to nothing in his/her way. Is that what you're advocating?"
I don't think that that was what Bruce was saying...
but I can't speak for him...
My personal opinion is... Get rid of most of the screening process. Just have all passengers go through a metal detector, X-ray all baggage and use bomb sniffing dogs on the baggage going in the hold.
Don't single out individuals for different attention (either better or worse) unless one of the other tests shows something worth looking at.
Don't "profile" everyone because that means that you'll ignore those that don't fit the profile of a "terrorist".
The metal detector can be used to find knives and guns. The X-rays and dogs can be used to find other things.
The current system is over the top, doesn't work and is way too arbitrary. My TSA "horror" story is that despite the TSA website stating "you do not have to remove your shoes" I was told to remove my shoes by a TSA agent. I said that I couldn't be bothered removing them, and that I would take the risk of the metal detector going off. He repeated that I should remove my shoes at which point I told him that the TSA website states that I don't have to remove my shoes. He let me go through the metal detector at that point. It didn't go off, but he sent me on for secondary screening anyway, including a swab of the deadly shoes. I had several hours to wait for my flight so the extra few minutes I spent wasn't an issue, but it seemed to be a purely vindictive act on his part because I had dared to question his authority.
"But just because something is official TSA policy doesn't mean it's necessarily followed in the field."
This is so true. I recall seeing surveillance video of TSA employees stealing valuable items from luggage recently. I'm 100% certain that this is not TSA policy.
I don't advocate zero screening. I advocate a basic level of cursory screening. More screening might be more effective, but it quickly reaches the point of diminishing returns in cost-effectiveness.
Screening is meant to deter the idiot copycats, not the smart ones. And a cursory screening will do that.
I find the term "rent-a-cop" an amusing choice of pejorative in this context. Just because TSA employees work for the government doesn't mean they aren't rent-a-cops as well. They're often the same people as before, albeit with different uniforms and more power, and a slightly modified form of fake "security" training.
The TSA seems to have an exaggerated view of its own importance and effectiveness, and no understanding at all of its negative side effects.
First off, it is obvious to everyone except the TSA that hijacking a passenger plane and flying it into a target has been impossible since about 20 minutes after the second one hit the Trade Center. The Pennsylvania plane proved this. Now that all potential passengers know what's at stake they will certainly respond to any attempt just as they did aboard that plane. Therefore, TSA's efforts are nothing more than "locking the barn door after the horse was stolen."
Second, the vast majority of passengers have been made less safe, not more safe, by the law preventing them from carrying weapons aboard. More than 30 states now have "shall issue" laws allowing any adult without a criminal record to carry concealed weapons pretty much everywhere else, and to my knowledge no one packing under these licenses has committed a crime with their weapons -- but quite a few of them have been able to prevent crimes because they were present and the police were not. Only a federal bureaucrat could fail to see that this same logic would apply aboard aircraft. The record of Israel's airline El Al against hijacking attempts bears this out.
Third, replacing airport "rent-a-cop" screeners (who could be fired for misconduct) with federal agents (who, for all practical purposes, cannot, and have "sovereign immunity" against lawsuits as well) has created a huge wave of theft from luggage.
And finally, TSA is known for performing ridiculously intrusive searches, often in public; for keeping a secret "no-fly list" with lots of false positives; for denying boarding to anyone whose attitude they dislike; and for seizing and destroying any high-tech gadget in someone's luggage merely because they don't understand it. All protected by the same immunity as the thefts from luggage.
The TSA can disclaim responsibility for all of these abuses by saying that mistakes or individual "rogue" agents are to blame, but I don't buy it, since TSA's creation with unconstitutional powers clearly created the problems. As long as their rules and their checkpoints are in place, we might as well be living in Red China.
Against that peril, give me back the dangers of 9/11 any day. I want our constitutional form of government back.
In partial response to John David Galt's post about hand guns, although he does not say he would like them on aircraft reading his post you might be forgiven for concluding it.
I most certainly would not like to see guns carried on aircraft by anybody, especially Air Marshals. They are just to dangerous. It is the same as saying it's ok to strike a match any time any place, but would you do it while putting gas in your car tank ?
Hand guns even in the hands of experts are at best inacurate wepons especially if the target is moving and the shooter is not in a braced position (forget the movies you just cannot hit a croswise moving target with a hand gun except by luck). The avarage person with say 20 hours training, would know how to load a gun unload it, clean it, and perform basic maintanence, but shoot acuratly not likley.
Put simply a gun does not shoot where you point it, it moves as the bullet travels down the gun, the amount varies with the load and dynamics of the gun and the strength of the shooter and position they are in. The usuall solution to this for target pistols is to use a small caliber light load, put a lot of mass on the gun and use inertia to minimise the movement, and for the shooter to adopt a braced position, that likewise uses the bodies inertia to minimise movement.
Experts are usually taught to aim low of CBM (center body Mass) ie around the liver or breast bone area, never a head shot, and invariably using a two handed shooting stance.
Although most of us do not like the idea an aircraft is an extreamly fragile thing, your chance of surviving decompression at +35,000 feet is very very small indead, irespective of if it is explosive or not. The oxygen mask is not likley to save you at all, I have seen arguments that it might actually cause more harm in some circumstances. And they are only on aircraft because the law requires it (otherwise the airlines would have taken them off to reduce costs).
Any gun that has a load sufficiently light not to put a hole in the aircraft is not going to stop a person wearing a "stab proof" vest, any person pulling a gun out on an aircraft these days is likley to get attacked by fellow pasengers before they have had the chance of bracing up and taking aim. Given this the most likley result is a fellow pasanger getting killed or injured, or a hole in the aircraft.
There is no easy answer to aircraft security, and guns are most definatly not it at any time now or in the future, forget "Air Marshals" they are not going to get the training they need to be anything other than a liability that none of us need.
I agree that the TSA is going over the edge, especially how you get the stare down which, I don't know about you guys, but it makes me feel like I'm guilty of something just by the looks you get. however it has not become too bothersome yet to me anyways. What really bothers me is customs coming into the US. It is a royal pain to have them pull you away before you have even had a chance to get in line. Do I have a sign that says stupid on my forehead or what? I don't understand why they keep choosing to harass me but it really is putting a damper on my view of customs. I have traveled to the same place many times, and as a women traveling alone, maybe they think that I am stupid enough to bring something dumb into the country. I think that 9/11 was a horrible thing- but they are going at fixing things the wrong way. They are taking away freedom and our trust in our own government. Now I'm considering bringing my friends fish to him in Mexico but I'm mortified that TSA would break their own rules and force me to kill a pet. Why say it's okay just to change their mind at their leisure- it takes a lot of time and planning to travel following all these guidelines, and for them to decide in a second that your betta fish is a threat to national security is ridiculous. That's just stupid and cruel- all because they want to "protect us", or maybe just control us more...
Has anyone had a problem with ticket agents "getting even" with you after they screw up your travel plans by flagging you so you get pat down searched and wiped by TSA when they otherwise would not look at you twice.
This just happened to me and I am doing some research into how often it happens and why. When I went through the security point the SECOND time, after I missed by first flight because it left earlier than the boarding pass said it would, my NEW boarding pass for the next flight had marks and letters on it the first one did not have. I think this was how the disgruntled airline clerks who screwed up the first flight flagged me for intense scrutiny by TSA to get even for my complaining and arguing with them about their srew up.
Why are they 90% "Afro-American"? Don't you think that's 90% of the problem? C'mon! I know that's what you're thinking too!
Mr. Bruce Schneier:
You mention "civil disobedience", yet no mention of the fact that "civil disobedience" involving TSA can lead to a false arrest, torture, incarceration and a fine up to $50,000.00, without trial, with little or no publicity of the event.
Your blog makes no mention of these facts. For effective civil resistence, action at the core of civil disobedience, it comes to naught without wide on-going publicity of the abusive reaction of TSA administrators.
To focus on TSA lower administrative level personnel, though necessary to some degree, will not lead to success unless and until the focus shifts to those in who usurp authority from WE THE PEOPLE, beginning with the President, members of Congress, and the members of the Federal judiciary along with those writ large in the corporate media.
We need to organize for non-violent civil resistence. Anyone of good will with me? Feel free to contact me if so, but please only those wishing to lend support, or otherwise become part of the movement.
Where do you stand Mr. Schneier?
This is kind of an old topic and subsequently might not be read. However, I just wanted to add that I agree with Bruce about how absurd the TSA's theatrics are. My father, who is now 70, has been disabled for the past 17 years after being hit by a drunk driver. He suffered from a traumatic brain injury, resulting in impaired judgement and walking. My parents like to travel, and fortunately his injuries arent so severe as to prevent travel; however he needs to have a wheelchair when he is in airports because he cant walk long distances. I should also add that he wears a leg brace. Anyway, TSA spends literally 15 minutes on my father each time he hits the x-ray machines. They make him remove the brace - which is extremely time consuming - and get up out of the wheelchair, and then hand wand him with a metal detector. The man can barely walk, for Gods sakes. I should add that the TSA is always very good with him, very professional, but that is not the point. If the TSA is able to pre-screen frequent flyers etc, why cant he get a "disabled" card that allows him to not have to go thru the 15 minutes of examination that he has to endure every time he travels? Its not like he is ever going to get better.
Another thing - is it just me, or has anyone else noticed how the TSA employees walk around the airports like they own the place? Watch them the next time you are waiting for your flight...when they are walking around....they walk around like they are the Gestapo. Pure arrogance. Thats why I believe the fish story. When you give someone a position where they have power over others, after a while, some of them change; not all, but some. And the TSA has extreme powers these days.
Ive been reading this blog for a while - Im a security engineer - but the whole reason I found this post tonite was because I saw a post in a security listserv I belong to about someone who was going thru the metal detectors at the airport, and was pulled out of line and asked by TSA why they had a harddrive in their bag....the man mistakenly said something about an investigation at work....after which the TSA attempted to confiscate the hard drive. How does the TSA have jurisdiction over any type of internal corporate computer security investigation? And since when did it become illegal to carry a hard disk drive in a carry on bag on an airplane? Why would that get you pulled out of line in the first place? I know customs can search media when travelers return to the US from abroad, but I didnt know the TSA was empowered to bother people about internal company problems at private companies, or bother people about carrying perfectly legal items???
Unbelievable. As Bruce says, how does this make flying safer in any way?
"I know customs can search media when travelers return to the US from abroad, but I didnt know the TSA was empowered to bother people..."
The juresdiction at most airports that have international flights world wide is complicated in the extream and varies from place to place (just to make life more interesting).
Very roughly as a passenger you have three areas to consider,
1, Souls On Board (SOBs) on aircraft with doors shut and locked "onboard".
2, "Airside" that is not "onboard" and not "landside" it's kind of like being in limbo.
3, "Landside" That is once through the various stages of arrivals.
Just to make life fun these areas change their covarage from country to country and in the case of "onboard" is further complicated by if you are at you point of departure, arival, or some intemeduary point...
You have people "onboard" (SOBs) who are covered by international law and in theory the law of the country they have flown from (if that country has laws to that effect) and sometimes the country of the carrier. And occasionaly due to your nationality...
Then you have people who are "airside" which usually means they are covered by international law or by the laws of the country they are now in, but as you will have noted the US feel they can pick and chose over this...
Then when you have gone through either customs or immigration (and it varies which one applies) you are on "landside" which usually means you are covered by the laws of the country you are in. Unless of course you are a US, UK, Russian or from one or two other countries that have laws that they regard as applying at any point in the world (/Universe ;) irespective of who's juresdiction or who's citizen you are.
So in theory, if you cross from land side to airside even on a domestic journy then you could have crossed into the area that the TSA/Customs regard as being "border crossing" and yes they can then search your HD etc. And again it might depend on if the airport had seperate departure areas for domestic/non domestic flights or not...
Due to this "mix-n-match" hodgpodge of "cut the cloth to suit" half baked legislation the whole thing has more holes than a second hand pair of string underpants.
And as none of it has been realisticaly tested in a court of law it is not possible to realy say what is and is not legal for DHS employees or passengers to do etc.
One thing of note if the DHS employee did take the hard disk and copy it etc then the chain of custody would have been broken which would be realy good for the defense and bad for the prosecution.
One way of dealing with it is to tell the TSA employee it is "legaly privaledge evidence" and althought they may wish to "take it away" the individual bares the legal "burden" and will be supeanered etc to court as a "hostile witness" for the prosecution.
As the last thing the DHS wants is legal rulings being made (especialy in cases they have not brought) then the chances are after a few phone calls they will back right off.
The thing is the HD would have to look the part by being in an appropriate (looking) evidence bag with case number and signiture panels filled in etc (surprisingly these bags are very easily available in the US due to the number of small police forces etc).
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.