Schneier on Security
A blog covering security and security technology.
« Why it's So Difficult to Trace Cyber-Attacks |
| Status Report on the War on Photography »
June 14, 2011
Yet Another Way to Evade TSA's Full-Body Scanners
Last night, at the Third EPIC Champion of Freedom Awards Dinner, we gave an award to Susie Castillo, whose blog post and video of her treatment in the hands of the TSA has inspired thousands to complain about the agency and their treatment of travellers.
Sitting with her at dinner, I learned yet another way to evade the TSA's full body scanners: carry a small pet. She regularly travels with her small dog, and has found that she is always directed away from the full-body scanners and through the magnetometers. I suspect that the difficulty of keeping the dog still is why TSA makes that determination. (The carrier, of course, goes through the x-ray machine.)
I'm not sure what the TSA is going to do now that I've publicized this unpublished exception. Those of you who travel with small pets: please let me know what happens.
(For those of you who are appalled that I could give the terrorists ideas on how to evade the full-body scanners, there are already so many ways that one more can't hurt.)
Posted on June 14, 2011 at 7:54 AM
• 59 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Why not just walk over to a line where people are going through a magnetometer? I've been through a half dozen airports since the scanners have been put in place and I've never had a problem evading the nudie booths.
I guess the question for the "sweepstake" is,
How much longer can the TSA survive the chip chip chip at it's self destroyed image?
Sadly forever is probably the answer - at least as long as we have the all pervading FEAR OF TERRORISM to back them up.
Bruce, you had the chance to correct her view of the safety "risks" of the scanners. Did you?
Her decision to opt out of the scanners is based on her understanding of the perceived health risk, rather than a privacy or security issue.
Yes, she later discusses how the scanners are ineffective at detecting objects inside the body (which is correct), but that was not her rationale to opt out of the scanners.
I agree that there are many obvious ways to evade the scanners. Many are based on the fact that the ergonomics of screening have never been addressed as part of the system design. One look at the way individuals move through and the inconsistency of the movements (and individuals) means that a routine for screening is seldom reached. In designing industrial inspection and security systems over decades it pains to see how TSA continues to react and "fix". Thanks for keeping the lens on this Bruce.
I flew JFK-YYZ last Saturday on AA. My wife and I were in the magnetometer queue, which was somewhat backed up. A TSA agent directed me to the full-body scanner (clearly just wanting to clear the line), and I said, "I'm sorry, I opt out of those," and he looked slightly boggled for a moment, then said, "OK, just go through there," and pointed to the magnetometer. One of his colleagues started to say something, and he said, "It's OK," and directed me to the magnetometer again.
So, one way of beating the full-body scan is to just say "no thank you" on a busy day.
Let's be honest. The TSA is a government job creation tact. There is no more security on airlines today than there was prior to 2001. If you're motivated enough to kill yourself in a plane crash then you're motivated enough to stick explosives in body cavities. There's nothing out there today that will detect it. So just sit back and enjoy the ride. :P
> Bruce, you had the chance to correct her view of the safety "risks" of the scanners. Did you?
> Her decision to opt out of the scanners is based on her understanding of the perceived health risk, rather than a privacy or security issue.
@C: Actually scientists say that risk of X-ray based full body scanners are unknown, and might be much higher than estimates based on existing studies of risks X-ray radiation in tomography... because the mechanism and energies are different.
I never get a choice of using the scanner. At LGA and CLT (the only places I run into these now), I never have a choice. Randomized as far as I can tell.
Very strongly agree with the comments about ergonomics. Even as simple as the part where you do not face the screener, who gives you hand signals to depart the booth. A light would kill them? How about showing the image they got of you, only to you. Think how much that would alleviate fears, if it was that transparent in use.
"Bruce, you had the chance to correct her view of the safety "risks" of the scanners. Did you?"
I did not. From what I've read, there are so many unknowns that no one really knows how safe they are: either for the passengers or for the TSA employees who have to stand near them all day.
I think that carrying a dog might reduce your chances of being an "Islamic" terrorist as they could count as an unclean animal.
Of course horses, and cats are a different matter.
Muslim terrorists should just carry a pig.
Hey, if they don't mind visiting brothels and drinking booze on their missions to dissemble, they shouldn't mind carrying a pig.
OTOH, that would only work once - and maybe not even then.
"Hey, Charlie, this dude's carrying a pig. Ten to one he's a Muslim terrorist trying to pass! Search him!"
Then the pig blows up and kills Charlie...Oops.
Thanks a lot, Bruce. Now the next time I fly, they're going to grope my dog.
Honestly people, throwing around speculations about what "Islamic" folks do or don't do doesn't help. Muslims aren't big on dogs, on person, because a dog slobber makes it difficult to maintain clean ablutions for prayer. Does not mean that we think dogs are an unclean animal. Plenty of Muslims own dogs as pets and work animals. And pigs - we don't eat pigs, nothing prevents us from doing pig related activities that don't involve ingesting them.
More importantly, the 2 billion something Muslims in the world are not a single monolith with identical idiosyncrasies.
"Thanks a lot, Bruce. Now the next time I fly, they're going to grope my dog."
I wonder what an enhanced pat down on a dog would look like.
@bruce: "I wonder what an enhanced pat down on a dog would look like."
It would look like "Oh whadda cute wuddew fuzzums, who's a good puppy? who wants a belly wub?"
There are already so many ways that one more can't hurt? Are you mad?
Why would you ever bother? Just blow up the god damn terminal and be done with it; bigger death toll than downing a friggin' plane. Oh, you mean security will find the bomb? Yeah, that's true ... they'll notice you have explosives when you explode right in front of them, I'm sure.
@Long Term Traveler "Let's be honest. The TSA is a government job creation tact. "
That's not honesty that's interpretation of motive based on supposition and ideology. I disagree. Nobody in Washington does anything for a single reason, 'cept maybe the drug dealers.
@Bruce But wouldn't the same exception apply to carrying infants? Would've thought we'd've heard about that before.
I don't think carrying a horse through the line would work so I'll have to plump down on an iguana.
To find out the risk to health would require embracing fear first by actually measuring it.
I'd start by putting mandatory dosimeter's on all TSA personnel and collecting their incidental exposure rates.
@ittefaaq: thanks for clearing up misconceptions. You learn something every day reading these comments!
Though I can't see why someone who wont eat pig would work with one... maybe truffle hunting!
Though I can't see why someone who wont eat pig would work with one...
I regularly work with people, but do not eat them.
I would have just said "For those of you who are appalled that I could give the terrorists ideas on how to evade the full-body scanners, you are idiots"
@MikeV: "For those of you who are appalled that I could give the terrorists ideas on how to evade the full-body scanners, you are idiots"
Yes, but the message was *for* idiots, so making it a bit more clear and explicit was a reasonable idea.
Also, it seems that having a 6 year old with you will get you into a special line without a scanner.
@BF Skinner: "But wouldn't the same exception apply to carrying infants? Would've thought we'd've heard about that before."
In fact my experience is that carrying infants does work. In March I took a trip to Vegas with my wife and daughter (13 months at the time). Both coming and going we were directed to a separate line and walked through metal detectors.
@Cory Doctorow: "So, one way of beating the full-body scan is to just say "no thank you" on a busy day."
I'm not sure about the "busy day" aspect but I tried this at O'Hare once and found it to be unsuccessful. Everyone in the line for the metal was redirected through the body scanners. However this was not an overly busy day.
Bruce: Kudos for your response on the radiation danger issue.
I've seen a lot of folks in radiology just appalled at the lack of safety and training in the airports. I've heard even more terrifying data regarding the supposed dangers. But much of it is contradictory. (E.g. The power-level is such that it will only penetrate the outer layer of skin when we can clearly see bones in the image.)
Without further reliable data, or some decent testing, it strikes me as a far more real danger than some hypothetical terrorist attack.
"Why not just walk over to a line where people are going through a magnetometer? I've been through a half dozen airports since the scanners have been put in place and I've never had a problem evading the nudie booths."
I use that tactic all the time but it is becoming less and less reliable as a way to avoid the scanners. I've been groped twice this month after attempting this and being commanded to the scanner.
I'm not sure if she's being directed away from the full-body scanners because of the dog or because TSA staff has been instructed to go easy on her for being a national celebrity that has generated seriously negative PR for them, winning mainstream sympathy from many folks in the process. Even TSA must understand that they've got nothing to win groping about a former Miss USA who even with the best will in the world can hardly be considered a potential threat to national security. It's high-profile MFU's like this that make ordinary folks question their security theatre much more than any security expert or civil liberty activist could ever achieve.
It can come to no surprise they are apparently considering a ban on filming/photographing their shopfloor actions all together. Not for security reasons, but obviously to avoid more embarassing or downright shocking material from being uploaded to YouTube and all (e.g. six-year olds and senior citizens being subjected to full patdowns.)
Still, you gotta give the girl a lot of credit for making a stand where so many others have come to accept it as normal or simply are too intimidated to do so.
"More importantly, the 2 billion something Muslims in the world are not a single monolith with identical idiosyncrasies."
Just imagine the utter nightmare the US and other administrations would be facing if suddenly out of the blue Sunnis, Shias, Salafis and Wahabis alike would burry their ideological differences and speak as one.
I don't have a small dog. Guess I'll have to carry my friend's pet boa constrictor, "Sammy Jack".
It works with small children, too. My wife and I have the routine down pretty well. One of us starts to approach the WTMD/AIT while holding our toddler, and they get waved through the metal detector. Then, before walking through it, they hand the kid to the other one, who then also gets waved through the metal detector.
@wiredog pet boa constrictor, "Sammy Jack".
Enough is enough! I have had it with these monkey fighting snakes on this Monday through Friday plane!
I flew threw Los Angeles in April and when I objected to the "nudie" screening the agent literally put her hands up and said, "I don't want to know, just walk around it. It's more work to process you manually". I gladly stepped around it and no one seemed to care.
@Mike Curran There are plenty of checkpoints where that just does not work. Either there are no lines open with just magnetometers or people are randomly pulled out of the magnetometer-only line to go through the nudie booth. You are lucky to have not experienced such a checkpoint yet. Personally, I cancelled an already purchased ticket (lost about half value) and drove Pittsburgh-Boston because I just couldn't take it anymore. (In Boston it was highly unlikely from what I could tell that I would be able to avoid it. The checkpoint I needed for JetBlue is commonly run with only backscatter machines.)
Still not flying until this is sorted out. Which reminds me, need to compose a letter to various entities....
Does the pet have to be alive? Seems to me a fella could pack a lot more Semtex in a dead one. I'm just asking...
"The dog, is Fluffy, he is sleeping. Vet say after surgery he move very not much. Please to give window seat to me near wing root. I am gratitude."
I just flew to and from the west coast to the east coast a couple weeks ago, and last week I discovered that I'd had my 3" Winchester locking blade knife in my purse the whole time. It went through the x-ray machine both ways at security and I carried it onto the plane. So I say "What security?"
It's easier to just purchase a wheelchair and pretend you can't walk. Gets you on-board the plane first also.
"I wonder what an enhanced pat down on a dog would look like"
A piece of history, the British Buldog was selected for breeding by making it bite onto a stick and hang on whilst it's rear feet were chopped off.
The one that won was used for breeding the others ended up (I presume) in a ditch or hole in the ground. Though it has been said that some dogs were trained by making them eat the flesh of other dogs.
Likewise "ratting dogs" such as the Jack Russell were selected for their ability to sieze and hang on, and shake the prey to break it's back.
Both breeds are considered "companion dogs" these days but some have been known to attack and kill adults.
So "tumy wub" could quickly turn into "hand munch" if the dog was trained appropriatly.
"Though I can't see why someone who wont ea pig would work with one.."
I guess you don't know about pigs...
In many parts of the world they are used as garbage disposal units, they quite happily eat all sorts of things including human waste, but they tend to "defecate" in only one place. So you could look on them as a Bio-loo. You might be happy to sit on one but you are very unlikley to get the urge to eat the contents...
The link to the site opens this HUGE, HUGE gif image (2500 by whatever)... not good
@ Dirk Praet
"Just imagine the utter nightmare the US and other administrations would be facing if suddenly out of the blue Sunnis, Shias, Salafis and Wahabis alike would burry their ideological differences and speak as one."
If I could shape a monolithic Islam it would be led by Sufis. Delightful poetry, devotional dance, and deep thinking would break out all over the place.
Then we could turn our efforts to making every last Christian a Quaker.
After that it should be a cinch to convince the Hindus, Sikhs, and Buddhists to become Jains.
@Bruce: (For those of you who are appalled that I could give the terrorists ideas on how to evade the full-body scanners, there are already so many ways that one more can't hurt.)
That, of course, assumes that evading full-body scanners poses any risk to security. In the absence of any evidence that the scanners provide any useful security, there's no reason to believe that evasion does any harm.
@John: "they'll notice you have explosives when you explode right in front of them, I'm sure."
Would they count that as a success or a failure, I wonder?
For those of you who are appalled by Bruce revealing this workaround, realize that the best way to fix a flaw in the system is to expose it. For all we know terrorists already knew about this.
@mcb "Does the pet have to be alive?"
Maybe not. I guess it's changed lately, but back in the day, you were allowed two pieces of carrion luggage.
Steve: "It's easier to just purchase a wheelchair and pretend you can't walk."
I suspect one could conceal quite a bit of explosives in one, too. I bet they don't open the batteries of the motorized ones.
Even the non-motorized ones probably could be fitted to conceal knives, guns (zip guns, at least) and explosives.
Also plays on the fact that people tend not to look too closely at crippled people, so they become invisible. Very advantageous for a terrorist to be invisible.
I've read the idea used in spy fiction.
Alas, the TSA has so far refused employee-union requests for dosimiters. Indeed, the TSA *forbids* employees from wearing dosimiters! Paraphrasing a silly saying from another context, "if the radiation doses are so low, what are they afraid of?".
@Jonathan Thornburg "*forbids* employees from wearing dosimiters"
The story I heard was that screeners are allowed to wear, hidden, dosiometers and weren't encouraged in any way to do so. Different airports would have different cultures though.
I think the reasoning was you don't wanna spook the travelers.
The problem with that is of course, hidden, dosimeters, don't get turned in, get forgotten to be worn and ends up making any monitoring program ineffective.
Congress will likely have to pass law, again.
I came home through Shannon (Ireland) last month. Irish security apparently doesn't trust the Americans OR the French and required transiting passengers to submit to scrutiny again. I removed every ounce of metal (including wedding ring), only to have the metal detector go off. While I was being physically pat down (yes, right there in the open!), I chatted up the officer who told me that the machine is calibrated to go off every few passengers whether you are wearing metal or not. Huh!!?! And how is the pat down doing to find the really hidden jewels?
60% PR, 35% Arrogance of power, 5% security.
"(For those of you who are appalled that I could give the terrorists ideas on how to evade the full-body scanners, there are already so many ways that one more can't hurt.)"
Do you really get people who are appalled about avoiding scanners? Seems to me the easiest way is to pick an airport that does not use them (the TSA must not know about connecting flights).
I flew from Austin last weekend, no naked scanners there. They did however have two reluctant TSA agents do some "security" checks before boarding. One had to "sniff" people's drink bottles and another one checking to make sure my ID matched my ticket. There must be some negative correlation that terrorists don't become thirsty while carrying pictures of themselves in wallets.
@Bruce You don't have to wonder what the pat down of a small animal looks like. I saw it last week when flying from Nashville to BWI. A woman was carrying a long haired cat and I was brought into the same pat down area (public molestation tank) as her. They patted down the entire cat with gloves then tested the gloves. The cat had been "fixed" a few days ago which led to an amusing conversation about "sensitive areas".
Unfortunately, I couldn't get through my own pat down fast enough to video the whole affair.
"Muslim terrorists should just carry a pig."
Forget the pig, carry on a Virginia ham instead.
I am starting not to mind this nonsense at all anymore. Granted, I never fly... but what better way to wake up the Sheeple to the fact that personal privacy and civil liberty should never take a back seat to what some jag-offs call 'security'.
We need a sea-change in this country, and it ain't gonna happen with us nerds spouting our pieces on why this is nonsense, why 'nothing to hide' isn't an argument, etc et al. Obviously deep pockets, cable news, and politicos have no problem defending against us/truth. What they can't defend against, is the majority view (much the same as the truth, since all it took to rape us of our privacy and civil liberties was a little bit of coercion and fear, to sway the majority into a lulled state of complacency).
Here's another way (granted, only happened once): I was flying with my blind sister, and she would need someone to guide her to the body scanner, which I guess would have been too much effort. So the TSO just had me guide her through the metal detector, one after the other.
I talked to some TSA agents today and they said some new technology is coming soon that is apparently more sophisticated but they fear will produce more false positives and require pat-downs. Expect longer wait times soon and more TSA jobs.
@Greg (In Boston it was highly unlikely from what I could tell that I would be able to avoid it. The checkpoint I needed for JetBlue is commonly run with only backscatter machines.)
I fly JetBlue between Boston and Pittsburgh quite a bit (about every one to two months, for the past year) and I've never had to go through a full-body scanner. Maybe I'm just lucky :)
(As a side note, on a JetBlue flight from Boston to Chicago, I magically triggered the metal detector and got the new enhanced patdown, and quite frankly, I don't see what the fuss is about, for women at least.)
Rufuse to be terrorized works both ways. I swagger on through like I own the place and am enjoying the police state.
These checks are a symptom. Fight them and the root cause goes unchecked. (My own humble opinion, of course.)
What I don't get is the terrorists' fixation on bombing planes from the inside. Just waiting near the end of a runway and firing an old Russian RPG into a starting Jumbo should work just as well. I don't know about the US, but this stuff is disturbingly easy to get in Eastern Europe (nearly for scrap metal prices), and thanks to the open borders in the EU just as easily smuggled to a big airport. Or just forgetting about planes and firing a bunch of 40mm grenades into the front of an office building - one could probably inflict impressive carnage before police arrives or the building is evacuated. I really don't want to think about how much of this stuff should still be around from the collapse of the Soviet Union.
This just leaves the conclusion that it became some kind of sport for the terrorists: "No matter how much money you sink into security, we'll still get through." - And if this is the case, all this security theater is probably the worst of all options (including doing nothing).
This thread made me laugh. I'm traveling with my cat for the first time this holiday season. She's a 7 month old kitten that was bottle-fed, hand-raised, whatever you want to call it. (Read: Feisty.) I'd love to see some TSA agents give her a pat-down. In fact, I can think of several ones in particular...Honestly, I always try to be so nice to the TSA people, because their jobs must suck. But so many of them are assholes, especially the younger males... (I am a 22 yr old female..) It used to be impossible to get through security.
Now that there are body scanners, I refuse every single time, and end up dealing only with pissed-off, silent women that are just as anxious to be rid of me as I am to get through security.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.