Schneier on Security
A blog covering security and security technology.
« Most Stolen Identities Never Used |
| FBI Speaks Sense on Cyberterrorism »
December 12, 2005
A Pilot on Airline Security
Good comments from Salon's pilot-in-residence on airline security:
In the days ahead, you can expect sharp debate on whether the killing was justified, and whether the nation's several thousand air marshals -- their exact number is a tightly guarded secret -- undergo sufficient training. How are they taught to deal with mentally ill individuals who might be unpredictable and unstable, but not necessarily dangerous? Are the rules of engagement overly aggressive?
Those are fair questions, but not the most important ones.
Wednesday's incident fulfills what many of us predicted ever since the Federal Air Marshals Service was widely expanded following the 2001 terror attacks in New York, Pennsylvania and Washington: The first person killed by a sky marshal, whether through accident or misunderstanding, would not be a terrorist. In a lot of ways, Alpizar is the latest casualty of Sept. 11. He is not the victim of a trigger-happy federal marshal but of our own, now fully metastasized security mania.
Terrorists, meanwhile, won't waste their time on schemes with such an extreme likelihood of failure.
Unfortunately, the same cannot be said for us. In America, reasoned debate and clear thinking aren't the useful currencies they once were, and backlash to the TSA's announcement has come from a host of unexpected sources -- members of Congress, flight attendants unions and families of Sept. 11 victims.
"The Bush administration proposal is just asking the next Mohammed Atta to move from box cutters to scissors," said Rep. Markey.
Actually, that Atta and his henchmen used box cutters to commandeer four aircraft means very little. Just as effectively, they could have employed snapped-off pieces of plastic, shattered bottles or, for that matter, their own bare fists and some clever wile. Sept. 11 had nothing to do with exploiting airport security and everything to do with exploiting our mindset at the time. What weapons the terrorists had or didn't have is essentially irrelevant. Hijackings, to that point in history, were perpetrated mainly through bluff, and while occasionally deadly, they seldom resulted in more than a temporary inconvenience -- diversions to Cuba or cities in the Middle East. The moment American flight 11 collided with the north tower of the World Trade Center, everything changed; good luck to the next skyjacker stupid enough to attempt the same stunt with anything less than a flamethrower in his hand.
This is almost acceptable, if only there weren't so many hours of squandered time and manpower in the balance. Nobody wants weapons on a jetliner. But, more critical, neither do we want to bog down the system. The longer we fuss at the metal detectors over low-threat objects, the greater we expose ourselves to the very serious dangers of bombs and explosives. TSA is not in need of more screeners; it's in need of reallocation of personnel and resources.
It was, we shouldn't forget, 17 years ago this month that Pan Am flight 103 was destroyed over Lockerbie, Scotland by a stash of Semtex hidden inside a Toshiba radio in a piece of checked luggage. Then as now, and perhaps for years to come, explosives were the most serious high-level threat facing commercial aviation. European authorities were quick to implement a sweeping revision of luggage-screening protocols designed to thwart another Lockerbie. It took almost 15 years, and the catastrophe of Sept. 11, before America began to do the same -- and a comprehensive system still isn't fully in place.
Flying was and remains exceptionally safe, but whether that's because or in spite of the system is tough to tell. The "war on terror" has left us fighting many enemies -- some real, many imagined. We'll figure things out at some point, maybe. Until then, dead in Miami, Rigoberto Alpizar is yet more collateral damage.
Posted on December 12, 2005 at 1:21 PM
• 40 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Regarding Rigoberto Alpizar, the thing I keep coming back to is that the "plane was on the ground!"
His behavior did not require immediate action as he was not a threat to cause catastrophic damage.
Seems to me that the air marshal lacked training...
The conclusion seems to be that the metastasized security fears will end up paralyzing (destroying?) the system and kill innocents -- all without further "terrorist" action required.
He's absolutely correct about our mindset changing...
"The moment American flight 11 collided with the north tower of the World Trade Center, everything changed; good luck to the next skyjacker stupid enough to attempt the same stunt with anything less than a flamethrower in his hand."
As long as we don't forget, we are very unlikely to see them use this technique again.
when unarmed people are being killed by the guards (both in London and Miami) the terror has been fully integrated into the system. There is no need for outside action by the 'actual' terrorist. It is a self licking ice cream cone.
Yes the plane was on the ground and everyone involved was outside of the place. If the guy was at a bank, started acting funny, claimed to have a bomb and was shot by uniformed police the hype would be about ZERO.
As far as I can tell this situation was SOP for most LEO organizations in the US today. Most of the hype seems to come from people who could do some simple checks and find out what the use of force rules are for most departments.
It was a sad thing that this guy was killed. But a LEO just wants to go home at the end of the day. Give him or her a reason to think that won't happen and the results are very standard.
It is of course possible that the FAMs reacted outside of their use of force rules. If that was the case then what they did was wrong period.
In my view the return of the FAM program, along with locked doors, new procedures and arming pilots is a valuable way to prevent another airplane from becoming a missle into a populated area.
The locked doors along with new procedures (don't give in) solve the bulk of the problem. The FAM and armed pilots add a layer against most of the issues of being able to defeat the doors over time (strenght in depth).
In 1994 one man armed with hammers, knives, and a spear gun tried to hijack Fed Ex flight 705, and crash it into the FedEx HQ in Memphis. He was subdued by an unarmed crew of 3, because he made it clear he was trying to kill them. The crew was gravely injured, and never flew again, but the 'terrorist' attack was stopped.
Though horrific and tragic, the incident does show how 9/11 could have been different, and will be different today.
I'm very surprised that the incident it isn't discussed more then it is today.
Just a question. How do we know he actually screamed or shouted about having a bomb? How do we know it is not a cover up for a major fuckup? It happened on the London shooting (it took several weeks of investigation and a lot of willpower to uncover the truth about Jean de Menezes' death). It could happen in the US. Unfortunatelly the media nowadays has little credibility regarding such sort of incidents, and this is also valid for the goverments around the world trying to hide their errors.
"His behavior did not require immediate action as he was not a threat to cause catastrophic damage."
He claimed to have a bomb, and he was running around. According to articles I have read, he reached into the bag after being given an order by someone with a gun pointed at him by an officer not only equipped, but empowered to give such orders.
Unless there is a gross error in the reporting of the situation (which is a significant possibility), the air marshall did his job. Second-guessing his actions is a necessary component of the checks and balances to authorizing people to use lethal force, but bear in mind that you have one *crucial* piece of information the air marshall did not.
Lets list some of the details of the scenario:
- Does he have a bomb?
---> He claims to!
- Can I see the bomb?
---> No, but he is running around with a backpack!
- Is he following directions?
---> No! He is running around!
- His wife claims he is mentally ill; is that relevant?
---> Yes! A person who has mental health issues is more likely to be the sort of person to smuggle a bomb on board a plane and detonate it!
- He is reaching into the backpack he is carrying. What do I do?
--> A. Allow him to reach into the backpack.
--> B. Stop him from reaching into the backpack.
Some other unknowns:
- If he does have a bomb:
Does it release a pathogen, a chemical attack, or simply detonate on activation?
If it is any of the above, what is the area it will affect?
The air marshall has a clearly designed responsibility.
"Federal Air Marshals (FAMs) respond to criminal incidents aboard U.S. air carriers, as well as other in-flight emergencies. FAMs are authorized to carry firearms and make arrests, while preserving the safety of aircraft, crew, and passengers."
The air marshall was operating within this mandate. The mandate is not to deal with terrorism; that would be a flawed approach. The mandate is to deal with criminal incidents. The incident started, and escalated rapidly, and within the purview of the marshalls responsibility, he took action.
Wait for reliable information before you pass a judgement.
Thank you, Bruce, this was very good.
Here is what Air Marshalls did in 2003:
How many more unpublicised cases have there been?
There is not one single witness to corroborate a verbal threat or confirm him reaching into his backpack. A bipolar man was spooked, and ran out. He was shot dead.
I suggest a market solution to airline security.
As an example, in southern California, a smaller airport such as Ontario could offer no-security service -- no lines, no searches, no air marshals, going back to the security level of about 1960 -- while the larger airports like LAX could continue offering full-security, with, of course, the entire cost of security borne by the secure-flight services.
Anyone wanting to wait hours, have valuables pilfered from their luggage, submit to searches, drop their pants, take off their shoes, endure martinets, and spend the flight worrying about air marshals going postal would be welcome to pay for it.
Those willing to risk the no-security service would save the cost of security and save a lot of time. Anyone intent on inflight trouble would know there would be nobody to protect them from the passsengers.
"Those willing to risk the no-security service would save the cost of security and save a lot of time. Anyone intent on inflight trouble would know there would be nobody to protect them from the passsengers."
As illustrated by September 11, hijackings are not just a threat to those aboard the aircraft, but to people on the ground as well. You propose giving airline passengers a choice between the hassle of security versus the chances of a terrorist attack. Who makes the choice for the people in the Sears Tower, or the Capitol building, or downwind of a nuclear power plant?
The lives of people on the ground are an externality to airline passengers, so the market isn't going to do a good job in this case.
The problem with Roy Owens's "market solution" is that the people making the decisions aren't the only ones at risk. The market is not a useful mechanism for controlling what are called "externalities".
Most of the people who died in the 9/11 attacks were not on airplanes. The idea that, say, Islip MacArthur Airport could attract business away from LaGuardia or Kennedy by increasing the safety risk to non-fliers in the New York City area does not increase my confidence or my sense of safety. To put it bluntly: I can spare an hour on line from time to time. I can cope with the possibility that, if I go the wrong kind of crazy, I could be shot by a law enforcement officer on an airplane. (That risk exists when I'm not flying, as well.) We can't spare 343 firefighters dead in one morning, or the far greater number we lost to injury and retirement in the year thereafter.
Also, a pilot or flight attendant may not have the choice of which airports to fly out of--but is at much as risk as any passenger if the plane is hijacked.
We have had a number of flights where the passengers overwhelmed troublesome passengers, which takes the aircraft off the table of potential weapons. Recall that the cockpit door is locked and pilots can carry guns.
At present there is no rational discussion about the cost of 'security' (the definition of which suffers from aggravated mission creep) againt the benefits.
Various factions ranting at each other solves nothing.
The market is the place to shake out the flimsy from the sturdy, the lame from the fleet.
Here's the new reality - the passengers are no longer willing hijackees. Just this weekend some guy flipped out, tried to use a cellphone charger cord as a strangulation weapon (to be banned next week...) in announcing his intentions to kill a baby, then headed for the cockpit.
The passengers took him down.
So the only thing you need to keep out of baggage at this point is automatic weapons and bombs. And the bombs only if you care about losing a plane. At this point it's probably still a concern only for fear of what could happen to a disabled plane over a population center, not to the passengers.
Wasn't the issue in 9/11 actually because a passenger used a priviledge escalation attack to gain piloting control of an aircraft? The fact they used sharp items in doing so is somewhat besides the point.
I'd like to think that even if a team of attackers boarded an aircraft, they still wouldn't be able to go from passengers to pilots.
Taxicabs and policecars have this feature... why don't planes?
I agree that there should not be two levels of airport "security", but...
> I can cope with the possibility that, if I go the wrong kind of crazy, I could be shot by a law
> enforcement officer on an airplane.
Unless you have a family history of going the "wrong" kind of crazy, this is unlikely to occur, which means that your willingness to be shot for acting bonkers doesn't really mean all that much - it's another kind of externality.
You're unlikely to act crazy, and therefore you don't consider people being shot for acting crazy to be that big of a deal. People who are more likely to act crazy may not be willing to make this trade off.
FWIW, I have no history of mental illness and I still think this is a lousy tradeoff.
> We can't spare 343 firefighters dead in one morning...
As opposed to what? I'm not sure what you're saying here, please clarify. If you're saying something like this: Someone acting crazy may cause another 9/11 event. The consequences of another 9/11 event are horrible. Therefore, the *much* more likely event that someone innocent is going to be shot, is regrettably allowable.
If that's what you're saying, I'm sorry, I'm going to have to disagree with you.
Put another way, since everyone started getting trigger jumpy, there have been two innocent people shot, a mentally ill person and a brazilian electrician. There have been zero terrorists shot. If this sort of activity continues to get the same sort of "oh, well, it's required to prevent terrorism" reaction, in five or ten years we'll be looking at not one or two but dozens or hundreds of innocent people shot, and still no terrorists events prevented.
The probability of an otherwise successful terrorist incident being circumvented by a "shoot to kill" policy is so negligible the only reason it's credible at all to the public is because people watch too many movies like Die Hard. The false positive rate is so high in this event that it doesn't warrant this response.
You're just going to wind up with a lot of mentally ill or sick or just misidentified people killed (as well as a large number of petty criminals summarily executed for non-terrorist events like smuggling drugs -> they appear nervous, run when challenged, and bang!)
Did the FAM have access to non-lethal methods? FAMs shouldn't be restricted to a kill/don't kill decision. They should have access to methods to subdue someone in a non-terminal way.
: Lets list some of the details of the scenario:
: - Does he have a bomb?
: ---> He claims to!
: - Can I see the bomb?
: ---> No, but he is running around with a backpack!
: - Is he following directions?
: ---> No! He is running around!
Or possibly not... in contradicting reports, he may have been trying to lie down on his stomach, in response to just such an order.
: - His wife claims he is mentally ill; is that relevant?
: ---> Yes! A person who has mental health issues is more likely to be the
: sort of person to smuggle a bomb on board a plane and detonate it!
Do you know anyone with bipolar disorder? Or any mental health issues, for that matter?
These people are the least well equipped to organise such an expedition. Even if the man was in a manic phase for _long enough_ to procure a bomb and get it onto the plane, someone in a manic phase would be completely unable to maintain close to sufficient concentration for the duration of the task.
Someone with a paranoid disorder _might_ be capable of such an organisational act, but I doubt any person with a diagnosed mental health condition would be any more likely to do such a thing as a "normal" person who has snapped under the pressure of the "system".
On the other hand, a radical extremist would be much more likely to do such a thing, but radical extremism isn't a recognised mental health condition.
: - He is reaching into the backpack he is carrying. What do I do?
: --> A. Allow him to reach into the backpack.
: --> B. Stop him from reaching into the backpack.
: Some other unknowns:
: - If he does have a bomb:
: Does it release a pathogen, a chemical attack, or simply detonate on
At least as important, if he does have a bomb:
- What is the detonation trigger?
It doesn't take much planning to organise a bomb that will detonate without a manual trigger... a simple timer being most obvious (!), even before other kind of "dead man's handle" mechanisms.
To rephrase, if you are working on the assumption that a bomb is present, then it is criminally negligent to take any action that might trigger the bomb, without knowledge of what trigger mechanism(s) are in play.
Even if an air marshal managed to shoot a terrorist, that's just another log added on to the anti-western fire of the wrongs perpetrated against the "true believers" (or similar - you get the picture).
You've hit the nail squarely on the head. Aircraft designs have barely been updated to counter new security threats. Creating a new blueprint for future aircraft with an emphasis on security should be the top aviation security priority. Keeping terorrorists and weapons off aircraft has proven to be extremely difficult. Designing aircraft to physically prevent hijackers from reaching the flight deck is much easier and doesn't require erasing everyone's civil rights in the name of 'security.'
O, it's really interesting to read everything this with comments... You, professionals, can discuss here a lot of interesting thing on different news =). Thnaks =)
"everything can be a weapon"
"Fear is the mind killer"
What scares me is the way the US govt has encouraged a counter-terrorism pscyche seemingly based on Judge Roy Bean "The only law west of the Pecos". If the security teams don't have crew cuts and anonymous shiney Judge Dredd uniforms then they are given "men of action" titles like Air Marshals - with all of the Hollywood cowboy connotations.
Has anyone stepped back to think what subliminal message is being given to them?
Actually, "out the FAM" has become quite the game on some flights -- to the extent that people have been reminded that it is a criminal offense to identify a FAM on a commercial flight. They are very easy to spot -- simply look for someone who has 'the look' -- perfect suit, perfect haircut, either no facial hair or a perfectly trimmed mustache.
This actually puts the FAMs in jeopardy, as the terrorists would target them up front. However, when asked to loosen the dress/grooming code, the REMFs in charge said no, since "the taxpayers expect FAMs to look professional."
So, I am not so concerned about the subliminal messages (if any) -- I am more concerned that they board that aircraft thinking "I am a big fat juicy target, standing out like a sore thumb, so the first sucker to look at me cross-eyed is gonna get a case of lead poisoning."
While not a huge fan of Salon, this article appears to be very well thought out. Maybe, Bruce, you should hire this pilot as an airline security consultant?
What would happen if a passenger would disarm an Air Marshall and gain possession of his gun? How should I know whether the "previously armed" person was an Air Marshall or a terrorist? Why should I follow orders from a random "passenger" while in a plane?
I have the feeling that Air Marshalls run significant risks from passengers interfering with their actions, because they are not identifiable as Law Enforcement.
@MathFox "How should I know whether the "previously armed" person was an Air Marshall or a terrorist? Why should I follow orders from a random "passenger" while in a plane?"
A FAM is known to the flight crew. When they say "it's a FAM" follow his orders, otherwise waste him if you can.
Unless, of course, you're in a 'film scenario' and the flight crew is in cahoots with the hijackers. In this case you have bigger problems than a terrorist impersonating a FAM...
Did he really claim to have a bomb? According to AP articles none of the passengers who were interviewed heard him claim this.
How would he get a bomb through security?
If he was a real terrorist with a bomb he managed to get through security would he be drawing attention to himself this way?
I think it is much more likely the FAMs made up the story to cover their own ass.
I think the main problem with armed air marshalls is that they are quite inefficient by design. All that a suicide bomber now has to do is to avoid yelling out loud the words "I have a bomb" before detonating it. Since he may not care too much if there is panic in the airplane before the explosion, this is not a big restriction.
So the air marshalls seem limited to cases like the present one, where someone acts strangely. I would argue that these cases are almost always harmless. With the changed state of mind of the passengers and crew, these could be almost always handled by them without the need of arms.
We have to accept that there is no other way to prevent someone from detonating a bomb in an air plane than making sure that he won't get into the plane. This problem is not solved by air marshalls.
Either way, the terrorists back on 9-11 succeeded: they induced terror on society and we can still see it.
"Either way, the terrorists back on 9-11 succeeded: they induced terror on society and we can still see it."
I think their attack succeeded beyond their wildest dreams.
Yes, our mindset in response to hijackers changed after September 11th, but it should not have taken this kind of tragedy to change. Years ago, it was considered valiant to stand up to criminals and defend yourself, even though of course you risked injury or death. But for the past few decades, the so-called security "experts" all advised victims to save themselves at all costs, cooperate with criminals and give them what they want, that your life isn't worth a few material possessions. Even banks now hand over cash to criminals who walk in armed with nothing more than a note.
But this selfish attitude is and has always been immoral and socially irresponsible. Allowing yourself to be robbed or terrorized simply encourages criminals to continue to rob others. People should always have been willing to resist criminals and terrorists at all costs rather than trying to save their own skins first and foremost. It's sad that it took 3000 dead for us to relearn this age-old lesson.
"Allowing yourself to be robbed or terrorized simply encourages criminals to continue to rob others"
I don't think anyone has learned the lesson of not allowing to be terrorized -- quite the opposite in fact.
Regarding banks attacked only with a note, perhaps they've learned response is more effective as a deterrent. The ability to be able to put less resources (such as your life) into upfront prevention and instead into detection and response is certainly a smart decision many times.
My feeling is that pretty soon now we will see that you need to file a psychological report before travelling to/from/inside the U.S. Or carry a sertificate that you are sane, and that there is no previous history of "mental disorders" in the family.
(Well... There seems to be only one escape. Hint: "So long, and thanks for all the fish")
The morning news carried a blurb that air marshals are now going to spread to buses, trains, subways, and ferries. The interviewees all thought it was a wonderful idea.
Here in California 'laying in wait' qualifies a murder as 'special circumstances', making the convict eligible for 'the needle'.
Most likely this is nothing more than a coincident, but there's a new story out about FAMs testing out a new program to patrol train stations, bus stations, and other forms of mass transit than aircraft.
One comment from the article by an American Airlines pilot particularly caught my attention:
"American Airlines pilot Denis Breslin, spokesman for the airline's pilots' union, said air marshals ought to stick to airplanes.
'I don't think there's enough air marshals to cover commercial aviation as it is,' Breslin said. 'That's what transit police are for.'"
I don't know if there aren't enough FAMs to cover commercial aviation, but I do believe transit police are the right people to cover local area transportation like bus and train stations.
The full article is at http://news.yahoo.com/s/ap/20051214/...
"The morning news carried a blurb that air marshals are now going to spread to buses, trains, subways, and ferries. The interviewees all thought it was a wonderful idea."
So, this is the question: how many innocents have to die before public opinion starts turning against this idea? My guess is quite a few, even more if Americans can convince themselves that only "those people" are being shot because of false alarms.
Hey, they do have a k3wl name for them -- "Viper" teams. Hey, if they have thought up a k3wl name this must mean it's good for security ;-)
Better yet, the news reports detail where these nests of snakes will be stationed -- so the terrorists (and those innocent bystanders who don't relish becoming target practice for FAMs) can use other transit systems.
Have you seen 24? the product placement is obvious. Also the fact that he makes you doubt if it´s eticall to kill a bad guy or torture him to get info and save millions of lives.
Now people doubt if it's eticall to kill someone who says he has a bomb regardless of circumstances.
Life must be getting cheap...
Well, sadly, here's an idea. You can buy a used 727, sitting in the desert gathering dust, for about $250,000. You can then fill it with any sort of low-tech explosive in bulk you feel like (say it's cargo), file a flight plan to EWR, IAD, or LAX, and fly the airplane ALMOST all the way to your destination... before you make a slight turn. Poof.
Tons of advantages - no pesky air marshals, hostile pilots, passengers, hardened cockpit door or other nuisances to slow you down, nor do you need a team - one man will do (forget the technicality that a 727 is certificated for 2 pilots and an FE). The only disadvantage? The $250,000. But don't you think at LEAST that much was spent training the 9-11 hijackers?
I have two points here. One is that commercial aircraft are still probably the most effective way to deliver large quantities of high-explosive with guaranteed ignition built-in rapidly to a target, with no realistic chance of intercept. The second point is that we have very limited counter-terrorism resources; I think screening passengers is a fairly wasteful way to close the barn door after the fact. Tracking the purchasers of large aircraft closely MIGHT be more productive and certainly a lot cheaper and less threatening to our civil liberties than insisting on violating the privacy of everyone who just wants to ride on one.
As for air marshals being expanded - we are really talking about a national undercover police force here. Paraphrasing, "To protect the freedoms, we had to destroy them?" Wasn't part of the reason for Congress prohibiting using the military for domestic police duties (Posse Commitus act? 1895ish?) because they didn't want a national police force under the control of the executive? Isn't this just an end run around that intent?
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.