Schneier on Security
A blog covering security and security technology.
« Mumbai Terrorists Used Google Earth, Boats, Food |
| Who Worries About Terrorism? »
December 9, 2008
Flying While Armed
Two years ago, all it took to bypass airport security was filling out a form:
Grant was flying from Boston to San Diego on Jan. 1, 2007, when he approached an American Airlines ticket counter at Logan International Airport and flashed a badge he carries as a part-time assistant harbor master in Chatham, according to federal prosecutors.
Grant, a medical supplies salesman, also filled out a "flying while armed" form and wrote that he worked for the Department of Homeland Security, prosecutors said.
He allegedly did the same on his return trip to Boston three days later.
But this time, according to court documents, he was invited into the cockpit, was told the identity of the two air marshals on the flight, and was informed who else on the plane was armed, which raises security concerns.
Since then, the TSA has made changes in procedure.
At the airport, law enforcers now need advance permission to fly armed.
"We have added substantial layers of security to this process," said TSA spokesman George Naccara.
The case took almost two years to come to light so federal authorities could tighten airport security and prevent similar incidents, said Christina DiIorio-Sterling, a spokeswoman for the U.S. attorney's office.
"The flying public can be assured that this has led to a change of procedures to ensure that credentials are properly vetted," said Ann Davis, a spokeswoman for the Transportation Security Administration.
Posted on December 9, 2008 at 7:22 AM
• 48 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
While I applaud the efforts of Grant and people like him to expose gaping holes in the 'security' provided by the TSA, I also have to say that given the limited information I have, he should absolutely be charged. Flying with a weapon while providing false information on an authorization form, just can't be allowed, for any reason. I realize that arresting and prosecuting Grant won't close the hole, but I don't think we can afford to let these sorts of actions go unpunished, regardless of motive. Like it or not, the law is the law and must be obeyed. Were Grant given a get out of jail free card here, it'd open a new vulnerability - anyone who when caught claims their actions were in the interest of testing or critiquing TSA practices would effectively have a free pass.
I appreciate what he was apparently trying to do, and I'm glad there are people willing to do this sort of thing, but clearly you have to expect that you're going to be martyred in the process.
The flying public can be assured that the next case will also take two years to correct, and the next...
Badge, uniform, whatever, lousy authentication/authorization seems to be the rule.
According to the article, he did _not_ bring a gun on the plane, he just filled out a form that would allow him to. It also isn't clear how false the information he filled out was; it was misleading.
There is a defined process for anyone to transport a firearm in their CHECKED luggage. Most firearm related forums have a section devoted to this, since it usually causes problems with airline and TSA personnel not knowing the procedure.
Every once in a while, someone posts a story about how they were mistakenly listed in the system as carrying on the flight. They usually get most of the way past the security checkpoint before they realize the mistake. Of course, by this point their checked bags, and thus the firearm, are out of their control.
Many years ago, prior to 9/11/2001, a police officer friend of mine was going on a trip. I asked him about carrying his pistol on the flight. He said that he could only if he lied on the justification paperwork that he'd need to fill out. Since that could cost him his job, he did not. So, even though he would be an asset on the flight, he wouldn't take the chance. Well, apparently the requirements haven't changed much, and the hurdles that are in place only stop the good guys.
It seems that TSA is abandoning "Registered Travel"?
“It was a very stupid idea in the first place. A background check means nothing. Remember that most of the 9/11 hijackers had no record and would have passed a background check.”
From the look of it, he wasn't penetration testing, he was being a grade-A idiot. A slap on the wrists and a bit of publicity will do no harm.
The process of being invited into the cockpit, even if you are a genuine air marshal, seems to be a hole in the security.
The security-procedure aspect of this story seems incomplete: how'd they catch him? Did they get lucky? Or did he belatedly trip some kind of procedural safeguard? And (a related question) do we have some estimate of how many other people might have pulled the same stunt to date?
Slightly OT: I flew from Frankfurt to Seattle in October and was pleasantly surprised to see that at least in parts of Europe the ban on scissors, small knives etc. in the carry-on has been relaxed (http://www.handgepaeck-berater.com/planer.htm). You could even buy scissors in the duty free shops after security, but I didn't see any knives.
>>was informed who else on the plane was armed
Wow, how many people on the flight were armed? I guess it could have been someone on the flight crew but otherwise, were they all invited into the cockpit and told who else was armed? That part seems very weird.
Also, this guy's story is full of holes. He says he thought he was supposed to carry if allowed, filled out the forms, yet did not really bring the gun on board? Huh?
I don't get it, did he have a gun or not.
If he didn't why did he fill in the form (there is no suggestion from the artical he was doing it to "show a flaw in the system")
If he did was it checked in his luggage and not on his person.
The article makes little sense.
Also even as an assistant part time harbour master I thought that made him part of the U.S. Coastgaurd, which again surly makes him a DHS employee irespective of if he gets paid or not.
On the face of it this sounds like poor training and idiotic procedures with equally impenatrable forms to fill.
The article lacks sufficient information to make any kind of judgment other than "Uh ho here we go again with another pointless prosecution"...
Clive, read the link in the post to see that he did not bring the gun on.
"in parts of Europe the ban on scissors, small knives etc. in the carry-on has been relaxed"
Regular readers may remember my dilema over my cycling multi-tool. I ride my bike to the airport but have no way to lock the tool with the bike. Unless I check a bag, I have no way to carry it on without risking it being taken by zealous TSA.
Imagine my chagrin when waiting at the gate, a lady accross from me takes out her kitting needles and yarn...
I still dare not take my multitool. It just looks like something a terrorist would use. While a set of knitting needles reminds us of mom and apple pie.
@Rich: Only terrorists can't afford a taxi to the airport.
"Department of Homeland Security, prosecutors said. He did not bring a gun on the plane."
And that's what does not make sense.
If he did not have a gun on his person and not in his checked luggage then why fill in the form?
And if he was not trying to show up flaws in the system, why on earth are they trying to prosecute him.
Ok he's a salesman and we have all seen the Dilbert jokes about them...
But I find it difficult to belive that you can be that daft and hold a part time job as a harbor master.
In the UK being a harbour master is quite a serious position and requires not just a high level of knowledge but common sense as well.
The story just does not add up as presented.
So the first thing I wondered was, did the DHS prosecutors get quoted correctly or where they being ambiguous in that they ment he did not bring a gun into the passenger compartment...
We need more information to make any kind of sense out of it.
'On the license to carry he obtained from the Rockland Police Department, Chief John Llewelyn notes, "He put down DHS and had a polo shirt with DHS embroidered on it."'
It's possible that this is what they're getting him on. If he allowed the Rockland PD to assume he was an accredited DHS agent in order to get this permit, and he wasn't, that could be enough for impersonating. (Although it's ridiculous that firearm carry would be restricted to federal agents, this is the People's Republic of Massachusetts we're talking about, so the fact that they didn't check this could be considered a "breach".)
As for his claim that he filled out the air travel paperwork out of confusion, that seems credible. This guy is neither a lawyer nor a great thinker.
A few years ago I was flying from DC to vegas. I requested a form to declare I had a firearm (in my luggage). I was given a long form, and only after filling it out 2/3 of the way, I realized this was to carry it on the plane.
I mentioned this to the desk person, and my DoD ID card (which I forgot was still around my neck from work) made them think I was an agent of some kind.
Seems they would late anyone carry a firearm on a plane.
But but but....
terrorists wouldn't fill out a form in false pretense.
So there was no security breach at any time.
You mean people can fly without arms?
The number of airline ticketing/baggage agents that have no clue about the process for checking (not carrying) a firearm in your luggage is astounding. However, I've done it dozens of times and have never been offered any forms or had it suggested I be allowed to carry on the plane; they usually just call over a supervisor or dig through their computer for the rules -- though I did have one non-native speaker that couldn't understand "I need to declare a checked firearm" at first, and then exclaimed "OH! YOU HAVE GUN!", which got the security folks to come running.
Just think, all I had to do was flash a badge from a Cracker Jack box and I could have avoided all that hassle...
"The case took almost two years to come to light so federal authorities could tighten airport security"
So they can't tighten security unless it gets breached?
This hole should never have existed in the first place.
@lutton at al
The orticle is poorly written. Another interpretation, and the one I took, is:
"I had a license to carry and from a class I took I thought you were supposed to [file in the form] if you [were licensed to carry]"
One possible innocent explanation is that he thought that he was required to inform TSA that he had a concealed carry permit, and that this was the form -- of course there would be a form -- for doing so.
Who cares whether he flew with a gun or not.
What I get from this is that there are passengers on the plane who have guns in their possession.
That completely defeats the security process. You do not need to get a gun through security. All you have to do is get a gun away from an armed passenger.
I'm still advocating tonfas for security personnel. Keep the guns off the planes.
@Brandioch: "All you have to do is get a gun away from an armed passenger."
Interesting point. Make a metal detector that vibrates in your hand or something and walk along the line of people waiting to get on a Southwest plane. Big chunk of metal should be easy to detect from 2' away (I assume people carry the weapon on them, not in their carry-on?).
OMG GUNZ ON PLANEZ. I think we know already. There are several levels of ludicrous to this story.
1) Why is DHS wasting taxpayer time and money on this guy when there are real terrorists to chase after? Thwack him on the head, send a nasty letter to his CCW issuing agency, and move forward. I am not understanding why this needs to be a Federal case.
2) Why is the Federal government so obsessed with requiring prior approval for vetted local law enforcement to fly armed? One almost thinks that the Feds don't trust the locals . . .
3) People who are traveling armed need to have a scorecard. There isn't time for asking when someone rushes forward and someone else stands up with a gun. This is a routine officer safety practice.
4) I wonder how they verify diplomatic and sensitive material courier credentials. (Some of these people travel with automatic weapons, so don't talk to me about the 'hazard' of guns on planes.) Old school practice was that the armed traveler would report to the exit gate and request a supervisor.
5) Of course the pilot needs to meet the armed traveler. In fact the pilot can refuse to transport anyone the pilot is uncomfortable with. Given the history of drunk air marshals, etc., this is perfectly reasonable.
One would think that the Feds would welcome the opportunity to inexpensively increase the number of responsible armed air travelers by blessing local peace officers at the least excuse.
Are they more worried about cops with guns on airplanes than they are about terrorists on airplanes? If so, why TSA?
Remember that from the perspective of the airline security apparatus, the question isn't "Should a cop be allowed to carry a gun on the plane," but "How do I tell whether someone is a cop?"
But in any case, I'm wondering even more about the next step in the process: not so much how or whether the ticket clerk at the desk decides that someone is entitled to carry a gun on the plane, but about what happens after that. Presumably the ticket clerk gives you a piece of paper saying you're allowed to take the gun through security. What happens at the security checkpoint? How good are the TSA workers at telling a genuine piece of paper saying you're allowed to take a gun through the metal detector from a forged paper saying the same thing? Are those notes common enough that the TSA workers are trained to recognize them? Or is there an alternative path from the ticket counter to the airplane that bypasses the checkpoint altogether?
I hope they get this process sorted out soon and then update the computers so I will be allowed to select "seat next to armed passenger" during check-in.
@Andrew: They dont trust the pilots in the cockpit to be armed, so why would you expect them to trust anyone other than themselves (nevermind how unjustified THAT is)?
@lutton, Rick: Apparently if we want to know who is armed, just watch and see who they invite "up front". No way a hijacker could benefit from THAT piece of information.
I'm not concerned about the specifics. That could too easily end up in the "movie plot" category.
What I'm concerned with is the move to "security by obscurity".
If you can defeat the obscurity (in any one of various ways) then you have defeated the "security" of the system.
"1) Why is DHS wasting taxpayer time and money on this guy when there are real terrorists to chase after?"
Because there are so few of them and if this guy gets convicted that's a check in the "win" column that most people will never question. This is how careers are made.
"Slightly OT: I flew from Frankfurt to Seattle in October and was pleasantly surprised to see that at least in parts of Europe the ban on scissors, small knives etc. in the carry-on has been relaxed"
I carry a swisscard in my pocket all the time. I flew with it since I have it (I remember at least 5 times).
A couple of weeks ago I was flying from London-Luton (where I usually fly from), and they found it.
They decided that the letter opener (about 3cm blade) and the pen (!) from it has to be confiscated but the scissors are OK to carry on. I managed to convince them that the pen is not dangerous, but they confiscated the letter opener. Of course nobody could tell me where I can find the rules what I can or can't take on board.
At the end I sent an email to the department of aviation and got a reply:
"...passengers are prohibited from carrying knives and letter openers through UK airport security search points. These measures are contained in restricted documents and thus can only be disclosed to those parties responsible for implementing them.
You should also note that UK airports can implement more stringent measures than those required by the Department, in accordance with their particular circumstances."
Interestingly enough two weeks later I had no problem carrying on the same swisscard with the letter-opener replaced.
My question is only: How can they (in a country thought to be democratic) force you to obey to the rules but at the same time keep the rules secret (and in addition not even enforce them at all the time). Is there a way to force them to disclose the rules, so we can obey them?
@ A traveler,
"Is there a way to force them to disclose the rules, so we can obey them?"
There used to be, but it was used to such good effect it has apparently caused such a drain on UK Governmental and Non Governmental Organisations that now any request for information first has to go through a cost evaluation process. If the person appointed to that task decides it is going to cost more than a certain amount then they can decide it should not be processed...
In the UK there is an arcane bit of law that allows the Police to aresset you and have you prosecuted for "carrying a weapon".
Unfortunatly it is upto the officer to decide if it is a weapon or not, and as it's arcane the tarriff (sentance) is left without sensible limit...
There is a second piece of legislation where as an ordinary citizen "you are required to report to the police" "any person you think may be equipt to commit a crime", again the definition of what equipment is or what the crime is is left open (and yes you can be prosecuted for failing to report).
Taken together these two bits of legislation means that some "airport numpty" MUST (ie is fully covered to) report you to a "transport policeman" who will assess you and if he decides to arresst you and stop you getting on your flight/train etc. Several crimes you might be committing or about to commit at the time is "behaviour occassioning a breach of the peace" (ie talking in what a person regards as a threatening or incitfull manner) or "common assult" (raising your voice, raising your arms above shoulder hight, using an object in a threatening manner) or failing to carry out a lawfull request to "move on" or many many others (why on earth the UK Police or other uniforms need to quote/use "terrorisum law" is beyond me with these in place).
After being arrested you will then be offered the choice of "taking a caution" or "going to court".
The police will over play the consiquences of court (serious jail time) and underplay the consiquences of a caution (criminal record).
If you think I am making this up an engineer has already been put through the process for carrying a swisscard in a zipped compartment of his wallet and making (the mistake of making) a verbal objection to the screener when they tried to conviscate it.
He now regrets having taken the caution as he now has a criminal record and cannot work, and wishes he had kept his mouth closed or gone to court...
I wish I could remember the link to the newspaper article that gave all the info.
"There is a second piece of legislation where as an ordinary citizen "you are required to report to the police" "any person you think may be equipt to commit a crime", again the definition of what equipment is or what the crime is is left open (and yes you can be prosecuted for failing to report)."
So I have a legal responsibility to report each and every:
Locksmith (lock picking tools)
Stonemason (sledge hammers)
Glazier (glass cutters)
*boggle*, this is gonna take a while!
Annnnd I bet he was white. Reverse racial profiling?
I doubt a middle eastern looking man could have gotten away with the same thing...
"So I have a legal responsibility to report each and every:..."
Only if you belive they are or about to commit a crime, and are carrying a tool to aid them in the crime (such as a screwdriver etc), in which case you are not only required to report it but arrest them as well...
So remember to avoid being charged with "assisting" never admit in any way you thought the person was of to commit a crime.
I found out about this particular law after telling a lady friend of mine (who is a well qualified legal type) about an incident that had happened to me a few days befor hand, I thought it might amuse, but she told me I had "been a bit silly" and told me the law (word for word) and it's implications for me...
Although it does have an elemment of the "key stone cops" about it the incident was also very serious and happened a few years ago,
I was riding home on my pushbike "around teatime" minding my own bussiness when a lad in his teens ran out from an alley across the road infront of me with blood streaming down his face. He was being pursued by a gang of teens, one of whom had a full size felling axe (the one with a handle about a meter long which makes it fairly obvious). I phoned the police on my mobile to report it. I was asked a series of inane questions one of which was why did I think there was cause to call the police...
I stated the salient facts again, they then told me to stay there untill the police arrived. At which point I kind of lost it and told the person quite bluntly not a chance whilst also questioning their placing on the IQ scale (but in somewhat different language as you can appriciate). I reiterated what a felling axe was that the lad appeared to be running for his life and that I had reason to belive they would be comming back immenantly and that to me my self preservation was more important than their rules about waiting for a police officer to turn up...
I gave them my contact details and cycled fairly rapidly off in a direction that was not to my house but a public one for a well needed restorative...
You may as well continue reporting anyone who owns a PC. They are well equipt to commit cyber-crimes, which today surely count as crimes as well...
Ahh humm ho.
I guess the moderaror has turned off the feature whereby if you forget to fill in your name it automaticaly prompts you...
Iain as you have probably guessed the above post was from me.
RE: Bike multi-tool. I can think of a couple of "solutions", though I'm sure you've discarded them already.
1. Leave the tool in a zippered seat bag. The security is of the "out of sight, out of mind" variety, but you don't seem to be worried about having your bike stolen.
2. Get a locking saddlebag for your bike that has a way to thread your lock chain through it to secure it.
3. Leave the tool at home. This depends on the distance of your ride, of course, but is your tool worth a 10 mile walk?
"They dont trust the pilots in the cockpit to be armed ..." There is a program for pilots to carry guns, at least in the US.
"Apparently if we want to know who is armed, just watch and see who they invite up front." All you have to do to get into the cockpit on the ground is tell them you're a student pilot and want to take a look. Unless they're unusually busy, they'll invite you up and chat for a few minutes. I've done it many times, including after 9/11. It's not difficult, and does not indicate the person is armed.
An an American aircraft, passengers carrying firearms are required to identify themselves to the flight crew. The captain or first officer will review the passenger's credentials and determine if he/she will be allowed onboard. The flight crew will also then identify any other armed people on the plane.
This procedure is not a security breach. Armed passengers (i.e. federal agents, not local or state) are more common than most people realize. If one armed agent spots another armed agent, but does not realize that the other agent is not a terrorist or hijacker, I think you can see how the situation would end very badly.
The breach here is with TSA check in. The flight crew acted appropriately.
Guns don't really strike me as the problem. A good heavy carry on is going to be just as good of a weapon. If a box cutter is enough to crash a plane, why bother this the gun?
Criminal behavior is the problem. Every day thousands of people in America carry legal concealed firearms. You don't hear about these people committing crimes.
I don't worry about this guy carrying a gun on a plane, I worry about the ones that don't want to register, but still want the gun.
The author of this article is an idiot. Journalists can sometimes be just as stupid as this guy who understands and misused the process just so he could subvert security.
Why would anyone not fly with a gun, but want to get around the checkpoint screening? Many reasons. He didn't want to fly without his 5 ounce bottle of Old Spice. He didn't want to wait in line. He might of had something else on him not allowed through security, but that he did no want to check in a bag.
This guy was an idiot and should be charged and prosecuted as strongly as possible.
Mr. Schneier could have easily wrote this without disclosing information regarding the actual procedures used for authorized, armed individuals to fly armed on passenger aircraft. It is sexier to write a story that explains procedures that the general public DOES NOT need to know.
In the future Mr. Schneier, keep your mouth shut and do a story that does not assist terrorists in attacking America. I know, you are pointing out holes and doing a service. Tell that to the families of FAMs, passengers, pilots and flight attendants in this country.
Call your Congressman and complain if you think you have reason to be afraid.
Thankfully, I can tell by your article that you do not understand the process fully yourself for carrying armed aboard aircraft.
Merry Christmas, even to those that may hurt our country through their own irresponsibility and stupidity.
@Willy If you'd read the article, you'd have no doubt noticed that Mr. Schneier did in fact NOT write it. He simply brought it to the attention of those who read this blog, much as he does with any bit of security-related news.
@Willy: A little emotional about this, huh? I don't follow your thinking -- how much does it help terrorists to know that there is a form to fill out, for Law Enforcement Officers to carry a gun on board an aircraft?
You can find some information about this on the TSA website, as well as other web sites for law enforcement personnel. You don't have to be a rocket scientist, to figure out that someone with a badge and the right paperwork can carry a gun on board a civil airliner.
If these procedures were security secrets, then DHS should have blocked prosecution of the man in the story: once he is prosecuted, the facts of the case (including the procedures) become a matter of public record.
If you believe that Bad Guys are likely to exploit the procedures that permit carrying firearms (somehow, the World Trade Center was destroyed without using any), then you can be deeply grateful that the ignorance and sloppiness of the people involved in this story revealed a security hole, and that TSA has changed the procedures to prevent a recurrence.
As for the families of FAMs, how many Air Marshals have died on the job? Couldn't find numbers on this...
The advance notice and permission referred to by the folks from TSA probably relies on use of messages communicated via NLETS (www.nlets.org). This relatively secure method to communicate the authority and need for armed flight and the approval from TSA would allow for the prior permission commented on by the TSA representative.
The changes are a good thing for limiting the hobbyist from flying armed. However, most frequent business flyers know that if you're early for your flight, you'll know who is on the special guest list - it has been that way for years.
I'll still fly with my ball point pen ready to use to defend my family or myself. (Atta and TSA took away my ability to get through screening with a pocket knife, London's group my can of peaches). Not going to rely on the good marksmanship of someone that may or may not have the mindset to do the job when it comes time.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.