Me on Full-Body Scanners in Airports

I’m very happy with this quote in a CNN.com story on “whole-body imaging” at airports:

Bruce Schneier, an internationally recognized security technologist, said whole-body imaging technology “works pretty well,” privacy rights aside. But he thinks the financial investment was a mistake. In a post-9/11 world, he said, he knows his position isn’t “politically tenable,” but he believes money would be better spent on intelligence-gathering and investigations.

“It’s stupid to spend money so terrorists can change plans,” he said by phone from Poland, where he was speaking at a conference. If terrorists are swayed from going through airports, they’ll just target other locations, such as a hotel in Mumbai, India, he said.

“We’d be much better off going after bad guys … and back to pre-9/11 levels of airport security,” he said. “There’s a huge ‘cover your ass’ factor in politics, but unfortunately, it doesn’t make us safer.”

I’ve written about “cover your ass” security in the past, but it’s nice to see it in the press.

Tags: , , , , , , , , , ,

Posted on May 20, 2009 at 2:34 PM • 30 Comments

Comments

HJohn • May 20, 2009 4:23 PM

@”We’d be much better off going after bad guys … and back to pre-9/11 levels of airport security. There’s a huge ‘cover your ass’ factor in politics, but unfortunately, it doesn’t make us safer.”

@cya: “No one ever got fired for covering their ass…”

But plenty of people catch hell (and get fired) for doing what Bruce said and “going after the bad guys.”

George • May 20, 2009 5:38 PM

So that means we have to (electronically) uncover our asses so the TSA can cover theirs?

BCS • May 20, 2009 6:12 PM

I wold rather people get fired than throw money at the wrong part of the problem just so people can see something being done.

Nyhm • May 20, 2009 7:17 PM

I also thought from the subject line that Bruce Schneier was showing up on full-body scanners. Here’s the fake news article:

“Inexplicable reports of security expert Bruce Schneier appearing on full-body scanners are popping up at airports across the country. Hacker prank? Ghost in the machine? Has Bruce’s brain been incorporated into TSA equipment in an effort to improve the nation’s security? We can only hope.”

Tangerine Blue • May 20, 2009 8:34 PM

No one ever got fired for covering their ass…

I’ve seen good people fired for covering their ass – when that meant the shit hit people higher up the ladder.

Murphy’s Law says CYA’s effectiveness is directly proportional to the damage it causes the general populace, and inversely proportional to the virtue of the ass being covered.

Frank Ch. Eigler • May 20, 2009 8:46 PM

“… If terrorists are swayed from going through airports, they’ll just target other locations, such as a hotel in Mumbai, India …”

Well, what exactly is wrong with that? If others make themselves an easier target by building defenses slower than you do, then you would be silly to feel guilty or stupid about not being attacked.

Note • May 21, 2009 2:34 AM

Well Frank, that is just the point. Airport security as rolled out post 9-11 doesn’t protect us from terrorist, at best it protects the airport and maybe even some flights.
So it’s a good thing to do if you want to scare stupids off, but it’s a stupid thing to do when improving the chance of wrongdoers get caught, or protection of residents is the objective.

Ricky • May 21, 2009 3:58 AM

Exactly Frank, terrorist can target other locations, such as a hotel and building. But Security of airports is most important because, mostly of them entered in country through airports. And mostly, terrorist are targeting planes and airports such as Kandhar plane hijacking, 9/11 in USA.

Clive Robinson • May 21, 2009 4:13 AM

@ Frank Ch. Eigler,

“If others make themselves an easier target by building defenses slower than you do, then you would be silly to feel guilty or stupid about not being attacked.”

Oh dear there is so much wrong with that statment it makes you sound like a “War Hawk” from Dr Strangelove.

It has been suggested that the cost of the “arms race” effectivly bankrupted the USSR as was, and that the “war on terror” has prevented the US from surviving the credit crunch.

Does it matter if it is bombs and delivery systems, Star Wars defence, or concreate and barbed wire poured into every available space. Or worse architects designing buildings that will survive the largest fully laiden aircraft. The cost to you a member of such a society is immense and cannot be supported except by those very few people to gain by it (politicos and security / deffense contractors).

The stupid thing about any kind of arms race is there is no finishing line for a winner to cross and no medals etc. As you get a little ahead others are forced to try that little bit harder to keep up or gain an advantage for their own security. The point is it is alusory security that is ephemaral at best. The only certainty is Just the litter of misused resources used to a pointless end and left in the wake of the compettitors…

Most issues to do with security fall foul of the “first to use” issue. That is the first people to deploy a technology see results, as others follow they see lesser results and so on. To a point where the results disapear or worse aid those seeking to attack such as “security lighting”.

This sort of daftness has been imortalised as a “Red Queens Race” where you have to “run as fast as you possibly can to stay where you are”. In more recent times it has been refered to as “the hamster wheel of pain”.

As Bruce has noted if you use all your resources on security technology that you know will either fail or cause you more problems at a later date you are probably better of using the resources in other areas.

Many years ago the expression,

“Greater fleas have smaller fleas upon their backs to bite them. And smaller fleas have lesser fleas and so ad infinitum”

Made a fairly clear point about the waste involved with such situations, it never stops each stage feeding of the resources of the previous stage.

Sometimes it is better to stop running and walk of the race track and devote your energies to living not running yourself to death.

yt • May 21, 2009 5:40 AM

Nyhm: where were you during the movie plot threat contest? That would have made a great entry!

uk visa • May 21, 2009 6:27 AM

I think you’re on the mark but politicians would rather offer tangible success even if it doesn’t offer any practical benefit i.e. if they support going after the bad guys and the bad guys aren’t got – they look bad but if they put security systems in airports – when the systems are in, they’ve succeeded even though there may be no actual security benefit.

Frank Ch. Eigler • May 21, 2009 6:43 AM

@Clive:

In all those sentences, you wrote nearly nothing that’s actually responsive to the point. This one comes closest:

“… As Bruce has noted if you use all your resources on security technology that you know will either fail or cause you more problems at a later date you are probably better of using the resources in other areas. …”

But that’s a straw man. No one is using “all” their resources on e.g. airport scanners. Or TSA inspections in general. The resources are already being spread into intelligence and whatnot. The fact that you and Bruce don’t happen to know and/or approve of the detailed budgeting is not terribly interesting.

As for the putative pointlessness of arms races, you may think that “there is no finishing line for a winner to cross and no medals etc.”, but then again, several billion people are safer since the CCCP was bankrupted by one.

MathFox • May 21, 2009 7:21 AM

Mr. Eigler, how much has been spent on “Airport and flight security” in the last 5 years?
What are the indirect costs?
How much lives did it save?
How much lives would have been saved if the money had been invested in car-accident prevention?

Franky B. • May 21, 2009 8:42 AM

@Eigler:

All things equal, you’d be right, there’s nothing wrong with boosting your defenses to encourage your enemies to go after someone else. Only, all things are not equal. The other people they go after could just as easily be US citizens through another vector of attack.

Also, if you can spend a given, fixed amount of money, and spending it in one area only protects airports while spending it in another area protects everyone, everywhere, and may even wind up protecting airports better than the first method, why wouldn’t you choose to spend the money that way? Just because it’s a little less showy?

You assume that plenty of cash was also spent on intelligence. That’s debatable, I’d like to see your sources. The fact remains, we could stand to spend more on intelligence because it’s an expensive endeavor. I don’t think anyone here would have any issue with spending on airport security if it was effective, but that doesn’t seem to be the case, does it?

David • May 21, 2009 8:50 AM

@Frank: One issue isn’t that terrorists are likely to target India instead of here, but rather that they’re likely to target other targets around here.

I don’t want an attack on the local baseball stadium, for example, particularly if my mother and sister-in-law are there. I don’t want an attack on the Mall of America (a few miles down Cedar Avenue from my home). I don’t want an attack on infrastructure.

There’s too many ways to attack the US, and far too few resources to lock them all down. The more we spend on one potential threat, the easier we make it for the bad guys to hit elsewhere.

Security is only as good as its weakest link (something Bruce pointed out when I first started reading this blog, about cryptography). If the airports are too hard to attack, terrorists won’t just go home in disgust. They’ll find other things to do.

Frank Ch. Eigler • May 21, 2009 9:19 AM

@David:

“One issue isn’t that terrorists are likely to target India instead of here, but rather that they’re likely to target other targets around here.”

Of course, but Bruce himself said that (and he was proud of the quote), so it seems fair game.

“… If the airports are too hard to attack, terrorists won’t just go home in disgust. They’ll find other things to do.”

Right. However, this also does not constitute an argument against a “defensive arms race”. It just means that budgeting the finite resources is bound to be an ongoing and difficult problem. And it is bound to be one that typical bloggers can barely make informed advice about.

How about accepting that some skepticism and some trust in the authorities (those with the knowledge and responsibility) is appropriate.

Quercus • May 21, 2009 9:24 AM

@ Ricky “Security of airports is most important because, mostly of [terrorists] entered in country through airports.”
First, I’m not sure the second part is true. I’m pretty sure Tim McVeigh and the DC snipers didn’t need airports to get to the U.S. (For that matter, the Mumbai attackers didn’t need airports, either).

But more importantly, are you saying that really invasive body searches at airports are going to somehow prevent terrorists from entering the U.S.?
I mean it’s not like it’s exactly hard to get hold of a gun or make a bomb once you’re in this country. Are you saying terrorists are too stupid to figure that out and are going to all try to board planes carrying an arsenal?

Seth Breidbart • May 21, 2009 10:18 AM

How many lives have been saved by the TSA’s airport nonsense?

Now, how many life-equivalents (measured in people-hours) have been lost by passengers due to the TSA’s airport nonsense?

In 1978, I arrived at LAX at 6:59, and caught a 7:00 flight (that left on time). Last century, the Washington-New York-Boston air shuttles advertised that you’d get on a plane if you arrived 5 minutes (perhaps less) before the scheduled departure.

If we figure that the average American has 50 years of life expectancy left, then a half-hour delay for each passenger adds up to the equivalent of about a dozen lives lost per year. But that’s spread out over lots of people, so it doesn’t make for good headlines.

Dave Aronson • May 21, 2009 10:58 AM

@Nyhm: “I also thought from the subject line that Bruce Schneier was showing up on full-body scanners.”

No, Bruce does not show up on full body scanners. Unless he wants to, of course. That’s just one more of his special powers. 😉

Davi Ottenheimer • May 21, 2009 11:41 AM

Bruce, after I read the headline I expected to find an image of you in a scanner.

Your quote “stupid to spend money so terrorists can change plans” has a nice shock to it, but does it make any sense?

All controls, even intelligence gathering, has a cost and all controls can and usually will cause a change in plans.

Perhaps it is better to say it’s stupid to spend money on things that are easy to avoid.

Pat Cahalan • May 21, 2009 12:12 PM

It just means that budgeting the finite resources is
bound to be an ongoing and difficult problem.

Er, not quite. If you’re sitting in a boat with a hole in the bottom, bailing it out is an ongoing and difficult problem. If you’re sitting in a boat with a hole in the bottom next to an empty boat with no hole in the bottom, bailing it out is stupid, just get into the other boat.

You’re presupposing that this is an either/or choice; that your two options are to “do security” or “not do security” in a particular domain. If this is not an either/or choice, it is an argument against a “defensive arms race”.

And it is bound to be one that typical bloggers
can barely make informed advice about.

Granted; I would posit that the average member of the commentary community here does not intersect trivially with “typical bloggers”, however.

How about accepting that some skepticism
and some trust in the authorities (those
with the knowledge and responsibility) is appropriate.

Certainly. Not everything that has been done in the overall security domain in the last decade has been stupid. However, virtually everything the TSA has done in the last decade has been stupid.

You know how I can tell? By looking at their budget and looking at their security measures. It’s trivially easy to bypass airport security. There are dozens of stories (post 9/11) of amateurs penetrating airport security using the sorts of skills that require all of the foresight and security expertise of a carrot to execute. “Typical bloggers” (and here I mean actual “typical” bloggers) have done it. The TSA has literally spent billions on airport security, and the overall security domain is not appreciably better now than it was in 2000. It’s different… it’s showier, it’s much more “in your face”, and it’s mostly utterly worthless. It’s certainly not worth the money we’ve paid for it.

If you disagree, some sort of analysis that shows value would be the ball in your court. Instead of criticizing commentators here by saying, “You just don’t know what they’re doing and why it works”, you’d have to provide some sort of credible analysis that shows why what they’re doing does work.

If you’re going to turn around and say, “there’s no way for me to show that it does work, because that’s all secret and verboten”, well… you’re committing the same sin you’re accusing other people on the comment thread of committing -> you’re making a statement without any sort of credible evidence to back it up.

Clive Robinson • May 21, 2009 1:45 PM

@ Frank,

To answer the points you directed at me,

“In all those sentences, you wrote nearly nothing that’s actually responsive to the point.”

Hmm that depends on which point it is you have in mind.

What I was saying is that spending more and more resources to make a problem go else where is any easy and well proven method of beggering yourself and others.

To use an analagy when “The fifty foot stake in the ground” does not stop the invading hordes adding ten twenty or fifty feet to the top of it is going to be increasingly expensive for no measurable improvment (except as a measure of folly).

Your resources would be far better spent putting up a moderatly high fence and guards.

Which is again the same as saying

‘… if you use all your resources on security technology that you know will either fail or cause you more problems at a later date you are probably better of using the resources in other areas.’

You go on to say,

“But that’s a straw man.”

Do you actualy know what a “straw man” is?

I suspect that like many it is just an expression you have heard.

A Straw Man gets his name because he would wear a piece of straw in his shoe or hat as an indicator that he would for a negotiable sum go into court and say whatever the person paying would like, this was at a time when stealing a loaf of bread would get you executed in public.

You say,

“No one is using “all” their resources on e.g. airport scanners. Or TSA inspections in general.”

I never said that all the resources were being devoted to just one area of security. What I indicated was that significant resources where being wasted in what is a “Red Queens Race” and that the long term result would be to empoverish all those participating in the race.

Now I do not know which published figures you have read to come up with this statment or if it is mear suposition on your behalf,

“The resources are already being spread into intelligence and whatnot.”

I suspect from the “whatnot” it is mear suposition.

Which makes your next point more than a little churlish,

“The fact that you and Bruce don’t happen to know and/or approve of the detailed budgeting… ”

Further the,

“… is not terribly interesting.”

Is usually indicative of a person with a blinkered and fixed view point, much in the way that people who did and still do argue that the earth is flat.

With regards to

“As for the putative pointlessness of arms races, you may think that “there is no finishing line for a winner to cross and no medals etc.”

As I indicated for the ordinary tax payer that is very much the case.

But your fintal point realy is one that flies in the face of the US Governments own findings and consiquent behaviour,

“, but then again, several billion people are safer since the CCCP was bankrupted by one.”

Perhaps you can answer why the US and other Governments spent vast sums of money desperatly trying to persuad the ex USSR/CCCP states to give up the old “Soviate nuclear capability” and then travaling on a masive paper chase around those states buying up what ever they could from the old Soviet nuclear facilities.

Many people have put pen to paper explaining that the break up of the old USSR/CCCP was pehaps the most dangerous times of all as the old Soviet weapons where in many many unknown and potentialy war making and unknown hands.

Also perhaps you would like to explain the actuall benifit of Ronald Regan’s “Star Wars” project?

I have heard the Republican line about he was an “unrecognised genius” and also the SiFi authors who claim they talked him into the “grand stratagie”. As far as I can tell the only real advantage is that it has potentialy brought clean fusion power 20 years closer.

01 • May 21, 2009 2:44 PM

@Frank Ch. Eigler

do you somehow imply that it was India was slow, and US hotels, unlike that “slow” one in Mumbai, are armored and protected?

Or do you mean that airports are now considered separate countries, and whatever happens to the rest of US is somehow way beyond the concern of people who are tasked with taking care of airports?

P.S.: You know, there is something… In the latter idea… Apparently, the people in charge of airports are not very much concerned about the overall consequences of their activities for US security in general, as if they had some sort of autonomy 😉

Kally • May 22, 2009 2:38 AM

Seems there is a potential for money to be made on body paint that can be read by these scanners. Send ’em a message and all that. I wonder if someone could get detained, harrassed and be able to file a good lawsuit for painting “I’m a real terrorist” on their body under their clothes?

Would that be violating their free speech or just making them incriminate themselves? hmmmm

Pete Austin • May 22, 2009 11:25 AM

According to the report, this is “”a virtual strip search” and produces “naked” pictures of passengers”.

@Fox news…
1) Some of these passengers will be kids.
2) The Obama regime is taking “naked” pictures of kids.
3) These perverts and their evil machines must be locked up immediately!

Jonquil • May 26, 2009 3:05 PM

When I went through airline security yesterday, not only were the two people ahead of me asked to remove their hoodies, but my ankle-length cotton skirt bought me a pat-down. Apparently, unless you’re wearing Lycra, you’re a danger to the citizenry. I asked and was told that, yes, anybody in loose clothing would be physically patted down.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.