Schneier on Security
A blog covering security and security technology.
« Church's Pastor Is an ID Thief |
| For a Safe Night's Sleep »
April 1, 2008
Bottle Liquid Scanners
Got an idea for how to build one? The TSA wants to give you money.
Posted on April 1, 2008 at 5:25 AM
• 19 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
I'm a bit jaded by this whole initiative. The evaluators had no clue what they were doing. They rejected a design proposal I submitted to them last week because it could detect virtually any liquid, except water.
too bad the publish date for the article was March 24 and not April 1
I think it's probably another 'Jobs For The Boys' initiative, based on very wooly thinking. From the snipit spot the important bit,
"TSA will hold an Industry Day at which time appropriately cleared vendors will be allowed to view classified portions of the requirements."
Being rather cynical I would guess that finding out how to be an 'appropriately cleared vendor' you would need to contact the Republican campain treasurer etc...
More seriously how long do the TSA think any of the information will remain secret after the first couple of units are in prototype or deployed.
It would be better to be up front at the begining and come up with a series of draft standards and let those with sufficient knowledge on the practicality of such systems turn the draft into a formal standard.
At least that way you know what you are getting and that it will detect something other than "snake oil".
For those that think that an open standard will let the "bad guys" know how to beat the system then they are making one almighty great assumption that the "bad guys" are more skilled than the current practitioners in the field...
Which is an assumption that keeps getting made without any evidence to back it up.
The whole thing smells of male bovine fertilizer and movie plot motivation.
I suggest we get the passenger to drink the liquid. Wait, I hear you cry, he may be able to do whatever he wanted to with said liquid inside him [or her].... YES, he may, but he could do that before!
uh, they're at every security checkpoint at haneda airport, busiest airport in asia and fourth busiest in the world.
and, fyi, to board a domestic flight, you never show id.
Maybe the TSA folks should drink a sip from each container. Otherwise you risk having the mass spectrometer fooled by the container.
When I first saw the headline of this post, I misread it as "Bottle Squid Scanners." I thought, "is it Friday already?"
"too bad the publish date for the article was March 24 and not April 1"
Quoted for truth. This is dripping with joke juice. But then again, so is the current administration.
About those 'classified' specifications:
The device must be able to sample a minute quantity of the liquid, for testing against a reactive sheet or pad, or for spectrographic analysis.
The container would therefore have to be placed in a vacuum-sealed chamber in case the liquid reacts on contact with air.
While it's not impossible to imagine a machine capable of such operations, it must also perform its task in a rapid manner - if it took 30 seconds to examine one bottle, a traveler carrying the usual 3-4 bottles requires two minutes of scanning.
If you then say, 'we'll only do a random sample,' then you're not really screening much of anything.
I get this image in my mind of two, white coated scientists presenting an empty box to the TSA and explaining that it's a perfect nasty liquid detector which will never give a false positive.
The caption would be, "The TSAs New Detector"
The last time I took a large bottle of saline on board, they actually took it and tested it with some test strips or something.
Nick: you're being too generous. The 'classified' specifications no doubt are classified because they would induce gales of derisive laughter in the reality-based community.
Either that, or they've already decided on a vendor (using their sooper-sekrit GOP/TSA Ouidji board), a fact that would be fairly obvious if the specs were public.
well...could be both
Require transparent bottles and use laser spectral analysis of the liquid. Or, do what CSI does on TV: take a sample of the liquid and burn it. Pretty simple, already existing technologies...
Some airports already had policies where you had to drink some of the liquid in order to bring it on the plane (if you show up with a cup of coffee or something, for example).
As far as I know, the major sticking point with that has been, mothers of small children being forced to drink some of their own breast milk from a bottle in order to bring it on the plane.
How does drinking the liquid prove anything?
Drinking a small sample of liquid explosive might taste bad but would it kill you? If it's a terrorist trying to blow up a plane, he doesn't care if it's bad for his insides.
Also drinking many legitimate substances such as saline would not be pleasant. Do you refuse entry to a passenger because he won't drink his saline solution?
Why do they want to know exactly what is in a bottle?
I can't think of any liquid you would take legitimately on a plane that isn't at least 90% water, and I would think that any liquid containing 90% water can't be a very useful explosive (but I am not a chemist).
So I would say, just detect the (approximate) water content, which, I imagine, is fairly easy to do with a magnetic resonance detector, tuned to the same frequency microwave ovens use.
No problem. I'll even let somone else take the credit. It's called an "NMR spectroscope". Just put a small amount of the fluid into the NMR spectroscope (ideally separating out each chemical first), use it, and compare the results with the archived results of the claimed fluid.
Of course, one may have to wait a little while in the security line, and prices may skyrocket, but hey, it's "improved security".
For a fully automated system that typically generates results within 30 minutes, and gives a quick throughput of 1/5 minutes, I'd guess that a cool 20 million or so would be sufficient for initial production.
The man with a brick of C4 in his vest pocket (TMWABOC4IHVP) approaches the security gate.
"Remove your shoes, sir." says the TSA operative with a smile.
"Of course", says TMWABOC4IHVP in a mellifluous tone of perfectly enunciated English.
He places his briefcase, shoes, and his hat on the conveyor. A raised eyebrow to the guard behind the metal detector is answered with a nod: TMWABOC4IHVP passes through without a beep.
"Thank you." says the guard, relieved he doesn't have to wand another guy.
"Sir!", exclaims the X-Ray machine operator, "we have detected a fluid bottle in your carry-on." Pointing at a long line of people, he continues "Please see the agent at the desk over there."
"Naturally!", answers TMWABOC4IHVP.
After 37 minutes, TMWABOC4IHVP presents his bottle to the NMR spectroscopist. "GLACE Iceberg Water", she notes with approval, "We don't get much of that around here."
"If you can afford it, why not drink it?"
Thirty minutes later, the report is in. "Water, with trace contaminants: Calcium 0.44, Magnesium 0.1, Sodium 0.85, Potassium 0.1, Silica 81.1, Sulfates 0.0, Chloride 0.0, TDS 25, and a pH 6. You are free to board!"
Two and a half hours later a 747 mysteriously explodes over the North Atlantic ocean.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.