Schneier on Security
A blog covering security and security technology.
« NSA Backdoors in Crypto AG Ciphering Machines |
| Friday Squid Blogging: Large Mechanical Squid »
January 11, 2008
Patrick Smith on Aviation Security
Excellent essay from The New York Times:
In the end, I'm not sure which is more troubling, the inanity of the existing regulations, or the average American's acceptance of them and willingness to be humiliated. These wasteful and tedious protocols have solidified into what appears to be indefinite policy, with little or no opposition. There ought to be a tide of protest rising up against this mania. Where is it? At its loudest, the voice of the traveling public is one of grumbled resignation. The op-ed pages are silent, the pundits have nothing meaningful to say.
The airlines, for their part, are in something of a bind. The willingness of our carriers to allow flying to become an increasingly unpleasant experience suggests a business sense of masochistic capitulation. On the other hand, imagine the outrage among security zealots should airlines be caught lobbying for what is perceived to be a dangerous abrogation of security and responsibility -- even if it's not. Carriers caught plenty of flack, almost all of it unfair, in the aftermath of September 11th. Understandably, they no longer want that liability.
As for Americans themselves, I suppose that it's less than realistic to expect street protests or airport sit-ins from citizen fliers, and maybe we shouldn't expect too much from a press and media that have had no trouble letting countless other injustices slip to the wayside. And rather than rethink our policies, the best we've come up with is a way to skirt them -- for a fee, naturally -- via schemes like Registered Traveler. Americans can now pay to have their personal information put on file just to avoid the hassle of airport security. As cynical as George Orwell ever was, I doubt he imagined the idea of citizens offering up money for their own subjugation.
How we got to this point is an interesting study in reactionary politics, fear-mongering and a disconcerting willingness of the American public to accept almost anything in the name of "security." Conned and frightened, our nation demands not actual security, but security spectacle. And although a reasonable percentage of passengers, along with most security experts, would concur such theater serves no useful purpose, there has been surprisingly little outrage. In that regard, maybe we've gotten exactly the system we deserve.
Posted on January 11, 2008 at 1:47 PM
• 55 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
"...which is more troubling, the inanity of the existing regulations, or the average American's acceptance of them and willingness to be humiliated."
Inane regulations are what you get from regulatory agencies. Instead of letting customers choose which features and benefits they want to pay for, and letting competing businesses vie for the customers' business, politicians impose bureaucracies which limit choice and force companies to slow product and service development.
He's right on one point: we've gotten exactly the system we deserve.
When I'm forced to fly I don't do much besides grumble because I'm pretty much convinced that any noticable objections to the policies will result in one or more of - getting "detained" until I miss my flight, getting put on the no-fly list, getting arrested, getting branded as a terrorist sympathizer. There is also the fact that there is simply no recourse - you play along or you (at best) don't fly.
It's far easier simply to not fly. Spending two days in a car (one way) with a six year old is now less stressful than flying.
"...the average American's acceptance of them and willingness to be humiliated..."
This average American chose to drive the family of 4 from PA to FL for the holidays. Judging by the traffic, we weren't the only ones. The experience was less stressful than the airlines, more dignified, more flexible, and WAY less expensive.
I also know several non-average citizens with pilots licenses who now only fly private airplanes for vacations rather than suffer the indignity of commercial airlines.
But for most people, there really isn't a choice...
Yesterday I shredded an application I received for a miles card. Not unusual behavior for me, but my thinking as I did it was "Why would I want to spend more time at the airport?"
"In the end, I'm not sure which is more troubling, the inanity of the existing regulations, or the average American's acceptance of them and willingness to be humiliated"
I'm not trying to troll, I genuinely want to know... What is the proper response to being singled out in a TSA line and humiliated, having your bottled water confiscated, etc? From previous posts on this blog and others, it sounds like anyone who protests is singling themselves out for being put in a windowless room and interrogated for hours -- not because you are a security threat, but because you are a threat to TSA authority.
How do I complain about TSA policies and procedures in a way that won't get my name on some kind of list that ensures that I get "special treatment" every time I go through a security checkpoint? I'm far more afraid of the petty tyrants in the TSA than I am of a terrorist takeover of my flight.
I don't see much in the way of a public clamoring for security so much as there is a massive reactive CYA by government agencies, airlines, etc. No one wants to be the one 'soft on security' when and if the next attack happens.
According to DHS, you will need a shiny new RealID to fly by Dec. 1, 2014, but only if you are under 50 years old. Terrorists over 50 apparently are too busy looking forward to their AARP rewards. Seems odd since current elderly passengers are still strip searched and their medications and finger nail clippers stolen and ebayed...err..."confiscated".
The proper response would be to vote Homeland Security First scoundrels out of the office - every single one of them.
But, instead, what we see is the public adoration for the likes of McCain, Romney, Huckabee, Obama and Hillary.
The nation of sheep, indeed.
@averros: "The nation of sheep, indeed."
While I wholeheartedly agree with the essay - as I've agreed wholeheartedly with every essay I've ever seen on this topic - the question remains: what can people do about it?
As has been observed, complaints on-site just result in worse persecution/humiliation. I can't imagine going higher up the food chain would have any different effect. But the TSA, under Homeland Security, isn't under the direct jurisdiction of our legislators, either, so petitioning our congressmen wouldn't get us very far, either.
It's truly become an organization unto itself, neither responsive nor answerable to We the People. It might be a presidential issue, but it's not considered a "key point" and so isn't addressed by the candidates.
And so we become a people who don't raise a fuss about this - not out of acceptance, or even apathy, but impotence.
I would very much like to ask the current crop of Presidential candidates this question:
What will you do to ensure that the TSA operates an effective and sensible airport security program instead of the intrusive, humiliating, and ineffective "security theater" to which it now subjects passengers?
The reason they do not complain is because they know if they do they will get added to the "no fly list".
Civil disobedience is still disobedience.
@Mike: I _fully_ agree. Everytime I fly (which is quite a lot), I think to myself: "Stay quiet, because they will only make your life even more miserable if you don't".
There are a few more points which were severely lacking from that article:
- there is _no_ competition, i.e. there is no airline (or other similarly fast way of transport) where you could state your preferrence by your feet.
- the most visible sign how reasonable or sensible things would be after Sept. 11, 2001, was that _no_ airline was allowed to fly in the United States for some time, and then only _American_ airlines (yes, exactly those airlines which were affected in the first place) were allowed to fly again. Go figure.
>> What is the proper response to being singled out in a TSA line and humiliated, having your bottled water confiscated, etc?
1) Don't be humiliated or embarrassed. The TSA employee who is being an ass, and their supervisor, is obvious to everyone present.
When I was accused of having a below the waist piercing, I immediately offered to drop trou in front of everyone. Then started to. Offer hastily declined.
They then decided to put me in a closet with a guard to check. I pointed out, "Is that safe?" This got me two guards, neither of whom enjoyed being in a small closet with me, or looking at my junk. Win.
If they'd listened when I told them the hand wand was low on battery and was giving false alerts when inverted, much smirk would have been saved. No, doing screening for X number of years does NOT give you a free pass at TSA.
2) Keep your cool. Smile a lot.
3) Politely and calmly, keeping your hands in plain sight and obeying commands, assert yourself.
4) Speak truth to power.
5) Document, document, DOCUMENT!
Buddies with cameras, cell phones and a number for your lawyer are always helpful.
I'm reacting by staying out of America, and the tourist numbers indicate that many people are doing the same thing. But I'm not American.
The major purpose of increasingly invasive TSA screening is not security. It is to convince the rubes from places like Iowa and Kansas that the world is a very dangerous place.
In the eyes of America's millions of flyover state hicks, the government wouldn't be strip searching grandma, confiscating water bottles and forbidding batteries unless there was enough of a risk to American lives to require this level of intrusion. Convince the hicks that the world is extremely dangerous and they will reciprocate by supporting otherwise irrational policies such as institutionalized torture and military spending greater than that of every other country on the planet combined.
Business as usual will continue at the TSA as long as security theater continues to serve a useful role in furthering the security establishment's interests. It's not security, it's propaganda.
So what's the alternative? Americans give up their right to sue anyone they like? We can start establishing no-sue lists: you're not allowed to sue American Airlines for "not caring about [your] security," because that's how the papers filed at court are going to look. They'll contain words like "gross neglegence" and "failure to discharge duties" of common carriers.
It's all fine and well to say that we need to accept that there's inherent risk in the world. Coming up with a way to represent that legally is a much harder task. Also, should we take a national referendum to see who wants to accept certain risk ("your son or daughter may be killed") and who doesn't? Who am I, or Bruce, or anyone who posts here, to decide what's an "acceptable" level of risk for anyone other than myself? The government tries, but apparently infosponge (just above) has absorbed enough knowledge to have a more correct opinion than the majority of the country who live in "flyover states."
Until we're ready to give up some inalienable rights, we're going to have a hard time deciding what level of risk is acceptable. The Internet serves only to make the task more difficult.
I am not a US citizen but I frequently fly between Europe and Canada. At first I was bothered by US airport security, but not anymore: I just avoid all flights with a connection inside the US; also, I don't want to visit the US anymore (at least not until it gets better.)
Wow, "New York Times" and "excellent" in the same sentence. Are you sure it's original work?
I will not reiterate so much of what has already been said above. I travel a lot and to "bad" places like Afghanistan. Always causes consternation when hey see my US passport was issued in Kabul (simply because that's where I was when it expired). A few days ago, a ton of email started to pour in reporting on my frequent flier miles and I got to wondering: if I fly so damned much, shouldn't the TSA be running some sort of Registered Traveler program for free? Why should I pay extra every year when I've got a wallet full of cards and a passport to prove how often I fly and haven't taken out a plane, yet?
Terrorists over 50 apparently are too busy looking forward to their AARP:
Perhaps the terrorists over fifty know what kind of hell 72 (immature females) virgins would be.
(She got a pink cell phone and I did not, I have nothing to wear, all I had is one bight of candy and now I'm fat, I don't like the Porsche, I want a Lexus, I have to go to the beauty parlor my hair is making me look fat, you are spending more time with...................)
I have lived in Denmark, Canada, UK and the US since 2001 and flown domestic and internationally in all of them, and there's huge differences in security.
In Denmark the airport security is relatively relaxed, maybe because the head of security at Copenhagen Airport on several occasions have complained loudly about the tight regulations: It forces security personnel to look for Coke bottles, hand cremes and nail clippers instead of actually doing their job.
Also, it's funny with the shoe scanning issue - it's only in the US it's carried out consistently. In Manchester (UK) it's not, and only now and then in London, even on flights to the US. I have never been shoe screened in any airport in Canada or Denmark, domestic or international. I find it hard to believe it's a really serious issue then, as you wouldn't expect the US to let flights from non-shoe screening airports into their airspace every day (as they do).
Finally, some carriers in Europe actually do complain about the security regulations. Ryanair has complained about the hand luggage limit imposed in the UK, as well as the limited liquid issue. But their business plan is at stake, since they actively try to discourage passengers to check any luggage and carry it all on, so that'd explain it.
Maria isn't alone...
This American chose to drive his family of 4 (and a cat) across 6 states for the holidays.
Flying would have been preferred. (6 hours total flying time vs 4 DAYS driving.)
But with this TSA fiasco... There's nothing you can do about it. There's no way to protest. Other than to avoid air travel. Whatever the cost.
"The last thing I want to do is punish citizens of a state who would love to have a REAL ID license but can't get one," Chertoff said. "But in the end, the rule is the rule as passed by Congress."
Since when did Chertoff think he could punish anyone? Maybe he thinks he's in the Judiciary now? Or is he just admitting that Real ID is another Bill of Attainer aimed at depriving citizens of liberty?
Until the administration changes or Congress grows some balls, TSA and its parent DHS will continue their unconstitutional ways. If you want change, vote for people who will dissolve DHS and repeal laws like the REAL ID act.
Smith makes many cogent points... but IMHO he is profoundly wrong in one important area:
He objects to the x-ray and metal detector screening of pilots and flight attendants. However, the TSA doesn't require this! Rather, it requires the x-ray and metal detector screening of people who show up at the checkpoint who *claim* to be pilots or flight attendants. Not screening these people would mean also not screening imposters who can forge/steal a pilot or flight-attendant ID.
On a related point, to me it seems horribly dangerous to let pilots bring guns onboard, not so much because of the risks of *pilots* bringing on guns, but because it means that anyone who can impersonate a pilot well enough to fool the checkpoint staff, can then bring a gun into the secure area. [It also means there is now a supply of readily-identifyable targets -- who don't have the training of professional police, never mind the close-in-dirty-fighting skills -- for steal-a-gun attacks inside the secure area.] Not good...
How to complain? Simple, don't fly, then send letters (not email) to the airline, the airport, the local mayor, congressman, senator (of both origin and destination) and the president explaining why you don't fly. Tell how you will continue to avoid flying until things improve.
Of course, not flying may cause personal difficulties, but freedom is not always without cost.
What we could do with is a website which counts the number of times we didn't fly because of this crap. Anyone want to volunteer to set one up?
There is much more to democracy than the right to vote. There are many other things you can do . But to get a response there are really only two that stand out.
Petition and peaceful protest.
There was a protest organized for independence day this year. By all accounts not that many people showed up at all.
Basically Americans are just happy to watch some TV instead.
As for not flying. I know that a LOT of people don't go to the US anymore for work or holidays. This must have been noticed, and yet nothing. I still thought the US make a bit of money from foreign tourists. Apprantly not enough to care.
The "drivable" bomb model can be duplicated in many ways. I personally feel that terrorists may actually want to use the commercial airliner again to show just how ineffective our measure have been.
An effective cockpit door and realistic crew training can thwart the drivable bomb model, but not that of the midair targetless bomb.
Current security measures appear to equate the two as equal.
Inane regulations are what you get from regulatory agencies.
Inane regulations are what you get from regulatory agencies operated by tyrants and idiots, especially when lacking in real public oversight.
Instead of letting customers choose which features and benefits they want to pay for, and letting competing businesses vie for the customers' business, politicians impose bureaucracies which limit choice and force companies to slow product and service development.
Some regulations are absolutely necessary, lest, e.g., we return to the patent-medicine era, or we fail to address, e.g., climate change. The "free market" will not address these issues because, absent regulation, it's more profitable to cheat (e.g., sell doubtful medicines, continue to emit CO2 without limit) than it is to cooperate.
You know, it's not my job to ensure that my flying experience is a good one. That job belongs to the airlines. Should I get selected for extra screening, my complaint will go to the airline, not the TSA. If they (the airline) can't make my experience better, I'm not going to fly. It's that simple.
The solution to this problem is to simply transform it into a business one. Once the airlines start losing business due to TSA stupidity, they'll figure out how to pressure Congress into doing something sensible, rather than inane.
If you don't like it, write the airlines a letter. Don't bother with the TSA, because they can't do anything about it. The airlines, OTOH, can.
Write your Congressmen and Senators NOW and demand they Kill the REAL ID! If you do not act, you will give your personal privacy away and will have to pay for, carry, and show a national id upon demand. You can find their emails at:
See more info below :
Statement of Barry Steinhardt and Tim Sparapani
Director, ACLU Technology and Liberty Program and Senior Legislative Counsel, ACLU Washington Legislative Office, respectively
In its new REAL ID regulations, the Department of Homeland Security appears to have dumped the problems of the statute on future presidents like a rotting corpse left on the steps of the next administration – and not just the next one, but the administration of whoever is president in 2018. By the time this thing is supposed to go fully into effect, Chelsea Clinton and Jenna Bush may be fighting for the White House.
That just confirms it: Real ID needs to be repealed. It is not only a threat to Americans' privacy but it is utterly unworkable. After 3½ years of efforts to implement this law, the tortured remains of the statute that appear to survive in these regulations stand as stark evidence of that fact.
We are still analyzing these regulations and the extent to which they address or evade the many specific problems with the original statute, and will be discussing our findings at 2:00 p.m. EST today.
But it is time for Congress to recognize the situation and take action. Rather than saddling the states and the American people with this misfortune of a law until 2018 and beyond, it should be repealed and replaced with a clean, simple, and vigorous new driver's license security law that does not create a national ID.
For more information about why Real ID is a real nightmare, visit:
Someone already mentioned security theater might not be about making travelers feel safe as much as about making people aware of all the scary scariness out there. When I read the article about the Islandic woman who was detained and harassed because her visa expired once, and even more, the comments to that article, I got to wonder about something else. There were all these people claiming the measures were necessary because the US were such a great place to live that everyone from everywhere else would do anything to partake of this land of wine and honey.
Might some of these measures be there to keep Americans convinced that they, even though more and more other countries are getting severely higher standards of living, that the US is still a much better place to live? Are some of these measures there to keep them from realizing that it is not?
I think people ultimately get what they deserve. Want to mess with Middle-East politics? Please be advised, that suicidal terror attacks are part of the menu. What do you mean "not fare"?
Americans want to have something to say about virtually everything going on the planet, and have their opinion enforced by Navy and/or Air Force.
This is where things are backfire, and people are punished for being ignorant. Yes, you deserve all those insane "security" measures. Keep smiling and don't forget your RealID at home.
"control the media control the mind"
Wow I hear the same old complaints and the same threats of "I won't fly". Funny the planes are still packed.
As a IT consultant of over 20 years, I fly a lot. And strangely enough only get further inspected at most once a year. But that was also the rate for me before TSA existed. People tend to forget that we have had some form of inept security at airports since the 70's. And it's main purpose is to stop the nutjobs and prevent accidental discharges of pistols that people left in their luggage. And it does pretty good at that, the problem is all the rest of us inconvenienced.
Now I just got back form Japan and they do the same thing even on their domestic flights. Even got a feel copped by a female scanner when I got the patted down from wearing a pair pants that had metallic zippers for the detachables. I smiled when she did it. I think TSA could learn form the Japanese.
/remind me EU citizens just what ID did you show in that EU line at ORLY? at Gatwick? Thought so
"imagine the outrage among security zealots should airlines be caught lobbying for what is perceived to be a dangerous abrogation..."
Like not securing cockpit doors?
The airlines lobby for government-funded security and lobby against airline-funded security.
"As for Americans themselves, I suppose that it's less than realistic to expect street protests or airport sit-ins from citizen fliers"
I wonder if this is because being an activist correlates with being an environmentalist.
I consider aviation to be a dirty business and have little sympathy for the passengers' discomfort (I am also European). It pains me to see people dumbly accept terrible policies, but that's because the same people will accept terrible policies elsewhere -- in beat policement for example.
When I worked for IBM there were "mobile employees" for whom the job description included "80% travel"... and I commented: "Yeah, you get to spend 80% of your time at a customer site and the other 20% waiting to get through security."
As much as that got a lot of laughs, I now wonder if I had the proportions backwards.
"Civil disobedience is still disobedience."
Ummmmmm... wasn't that the genesis of the United States of America? Isn't that the ONE THING that differentiates the US from the rest of the world?
Civil-- i.e. "polite"-- disobedience is, to my eye, a check-and-balance. Civil disobedience as a corrective mechanism sure beats the heck out of Civil War (how can a war be polite?).
The problem, of course, is that REAL ID pressure on the states _may_ fuel the next major constitutional crisis.
I think my sister explained pretty well why Americans put up with this nonsense: it's worth it *IF* it improves airline security. What we need to find is the proof that it DOESN'T. Unfortunately, it is very difficult - and in this case catastrophically so - to prove a negative.
Just for the record, airlines have no more incentive to lobby for a sane security system than the TSA does. Their incentive is to lobby for one that imposes the lowest cost on them, possibly by being insane in ways different from the current system. Add me to the long list of fly-less-oftens. Little surprise that airlines should still be going through bankruptcies in a time of ostensible economic expansion.
"What we need to find is the proof that it DOESN'T."
That's how all security is tested/assessed, by proving the null hypothesis. This is where the independent reports of 80% success rate getting firearms and "bomb materials" through checkpoints come in to play.
You can't prove that the security does work. Otherwise, scanning my shoes also protects me against shark attacks. Doesn't it?
@Edt & Bill-O:
"it's worth it *IF* it improves airline security."
No, it bloody well isn't.
It probably already does improve security. At least some idiot copycats might get caught by the current system. But I doubt it increases security very much.
The point is (or should be), that the price, both in delays for travelers, extreme discomfort for same, wages for the airport guards, technological gadgets, and general privacy infringement would have to be acceptable compared to the relative increase in aviation security.
I think we all agree it isn't.
The problem is exactly people who think that "if it increases security, it's worth it", without trying to measure the increase in security towards the cost of it.
It's a bit shocking to find this kind of thinking even here, on the blog of one of the most visible advocates against it.
Perhaps it's just me. I'm a private pilot. I fly in the DC area in and around that ridiculous ADIZ which serves no useful purpose other than to scare the wits out of controllers and pilots alike.
I do something that many of you do not. I comment on the notices of proposed rulemaking by the FAA. I'd comment on the TSA's actions if they'd put them up for discussion like every other federal agency.
I think we need to write back. When the FAA proposed making the Air Defense Identification Zone over DC permanant, over 20,000 people, mostly pilots and controllers told the FAA not only no, HELL NO. I doubt there was even one comment that entire morass in favor of what they're doing now.
The problem here is that we're dealing with an agency (TSA) with no checks or balances. That has to change. Until it does, we have no way of letting our emperor know that he's quite naked.
Perhaps someone should set up an e-petitions web site similar to the UK one (see http://petitions.pm.gov.uk/ )?
If enough people sign a petition, say against confiscating 100ml water, then it makes it less easy for government to ignore - then again, perhaps not!
Dudes & Dudettes,
Sorry to pop your bubble ... but the threat is real. Annie Jacobsen's "The Aviation Nation" blog has been keeping tabs on this since here experience several years ago.
Aparently the MSM is too focused on being:
(1) politically correct - all recent terrorist are muslim but don't focus on that fact
(2) underreporting the threat - must not frighten the flying public, better to annoy them with TSA inspections than to make them aware of each reported "dry run or probing event"
(3) contradict the War on Terror - must not aid the BushChenneyHaliburtonChimpyMcHitler industrial complex; although it all got its economic kickstart by Al Gore (sigh)
If the lines get too long, add more lines. Common sense and operations research agree.
Unfortunately, there probably are many people in favor of the absurd TSA policies because they have been told by the media and government that it is "for their own good". The biggest problem today is that people lack enough common sense and ability to critically analyze ANYTHING, let alone security to question what they are told.
i am working in gmr group in delhi airport on the post of in line xrayscreener
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.